mymortgage.com.my - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 103.6.245.199, located in Malaysia and belongs to ICORE-MY iCore Technology Sdn Bhd, MY. The main domain is mymortgage.com.my.

This is the only time mymortgage.com.my was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
2 6	103.6.245.199 103.6.245.199		132198 (ICORE-MY ...) (ICORE-MY iCore Technology Sdn Bhd)
4	1

6 103.6.245.199 (Malaysia) 2 redirects

ASN132198 (ICORE-MY iCore Technology Sdn Bhd, MY)
PTR: whm1002.icorehosting.com

mymortgage.com.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	mymortgage.com.my 2 redirects mymortgage.com.my	18 KB
4	1

	Domain	Requested by
6	mymortgage.com.my	2 redirects mymortgage.com.my
4	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon
Frame ID: 31062.1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in

Page URL History Show full URLs

http://mymortgage.com.my/login-secureoffice365/hot/ HTTP 302
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9 HTTP 301
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/ Page URL
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https:/... Page URL

Detected technologies

Ruby (Programming Languages) Expand

Overall confidence: 50%
Detected patterns

headers server /(?:mod_rails|mod_rack|Phusion(?:\.|_)Passenger)/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 50%
Detected patterns

headers server /(?:mod_rails|mod_rack|Phusion(?:\.|_)Passenger)/i

mod_jk (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_jk(?:\/([\d\.]+))?/i

Apache Tomcat (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_jk(?:\/([\d\.]+))?/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

18 kB
Transfer

18 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://mymortgage.com.my/login-secureoffice365/hot/ HTTP 302
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9 HTTP 301
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/ Page URL
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://mymortgage.com.my/login-secureoffice365/hot/ HTTP 302
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9 HTTP 301
http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/ Redirect Chain http://mymortgage.com.my/login-secureoffice365/hot/ http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9 http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/	129 B 135 B	327ms 326ms	Document text/html	103.6.245.199 ICORE-MY iCore Te...
General Check archive.org Show headers Download Go to Full URL http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/ Protocol HTTP/1.1 Server 103.6.245.199 , Malaysia, ASN132198 (ICORE-MY iCore Technology Sdn Bhd, MY), Reverse DNS whm1002.icorehosting.com Software Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 / PHP/5.5.38 Resource Hash `c1fcc9104c2e2a3bb52bbe2f450c50d77c42857b3a81b59bb63779b022d58744` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 22 Sep 2017 08:23:35 GMT Server Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 Connection Keep-Alive X-Powered-By PHP/5.5.38 Transfer-Encoding chunked Keep-Alive timeout=1 Content-Type text/html Redirect headers Location http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/ Date Fri, 22 Sep 2017 08:23:35 GMT Server Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 Connection Keep-Alive Keep-Alive timeout=1 Content-Length 292 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	Primary Request login.php Show response mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/	2 KB 2 KB	363ms 363ms	Document text/html	103.6.245.199 ICORE-MY iCore Te...
General Check archive.org Show headers Download Go to Full URL http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon Protocol HTTP/1.1 Server 103.6.245.199 , Malaysia, ASN132198 (ICORE-MY iCore Technology Sdn Bhd, MY), Reverse DNS whm1002.icorehosting.com Software Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 / PHP/5.5.38 Resource Hash `4ee0b6b2f2eaa61fd7d413ca815245cc956d47fb331a2bdcf8b2191a84aa1e36` Request headers Upgrade-Insecure-Requests 1 Referer http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 22 Sep 2017 08:23:35 GMT Server Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 Connection Keep-Alive X-Powered-By PHP/5.5.38 Transfer-Encoding chunked Keep-Alive timeout=1 Content-Type text/html
GET H/1.1	200 OK	01.png mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/images/	14 KB 14 KB	289ms 289ms	Image image/png	103.6.245.199 ICORE-MY iCore Te...
General Check archive.org Show headers Download Go to Show image Full URL http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/images/01.png Requested by Host: mymortgage.com.my URL: http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon Protocol HTTP/1.1 Server 103.6.245.199 , Malaysia, ASN132198 (ICORE-MY iCore Technology Sdn Bhd, MY), Reverse DNS whm1002.icorehosting.com Software Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 / Resource Hash `36aee83a1b4b9a82c761cb7eab0a073c35806db6bc8b562cb33c320a9899145b` Request headers Referer http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 22 Sep 2017 08:23:36 GMT Last-Modified Fri, 22 Sep 2017 08:23:34 GMT Server Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 ETag "8e44b9d-39d1-559c2eccdb525" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1 Content-Length 14801
GET H/1.1	200 OK	02.png mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/images/	787 B 787 B	277ms 277ms	Image image/png	103.6.245.199 ICORE-MY iCore Te...
General Check archive.org Show headers Download Go to Show image Full URL http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/images/02.png Requested by Host: mymortgage.com.my URL: http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon Protocol HTTP/1.1 Server 103.6.245.199 , Malaysia, ASN132198 (ICORE-MY iCore Technology Sdn Bhd, MY), Reverse DNS whm1002.icorehosting.com Software Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 / Resource Hash `ca10c9ed6b63eaa44d80d2a12816b77ccf11cc9fbe0ef24118ac1cdce9180270` Request headers Referer http://mymortgage.com.my/login-secureoffice365/hot/d5e8857675b1bd4d952b024cbbcaf9a9/login.php?https://login.live.com/public/IdentifyUser.aspx?LOB=RBGLogon User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 22 Sep 2017 08:23:36 GMT Last-Modified Fri, 22 Sep 2017 08:23:34 GMT Server Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips Phusion_Passenger/5.1.6 mod_jk/1.2.37 mod_bwlimited/1.4 ETag "8e44b99-313-559c2eccd9db5" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1 Content-Length 787

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mymortgage.com.my
103.6.245.199
36aee83a1b4b9a82c761cb7eab0a073c35806db6bc8b562cb33c320a9899145b
4ee0b6b2f2eaa61fd7d413ca815245cc956d47fb331a2bdcf8b2191a84aa1e36
c1fcc9104c2e2a3bb52bbe2f450c50d77c42857b3a81b59bb63779b022d58744
ca10c9ed6b63eaa44d80d2a12816b77ccf11cc9fbe0ef24118ac1cdce9180270

mymortgage.com.my Open in urlscan Pro 103.6.245.199 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

18 kBTransfer

18 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

mymortgage.com.my Open in urlscan Pro
103.6.245.199 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

18 kB
Transfer

18 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!