dependencysubdomainfilelogs.commonb.com Open in urlscan Pro
64.190.113.121 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://llink.to/?u=https%3A%2F%2Fspiculum.net%2FSNCC%2Fsales%2Fc2FsZXNAdGhvcmxhYnMuY29t
Effective URL:
https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com
Submission: On June 16 via manual (June 16th 2023, 11:31:34 pm UTC) from US — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 1 countries across 4 domains to perform 7 HTTP transactions. The main IP is 64.190.113.121, located in Los Angeles, United States and belongs to BLNWX, US. The main domain is dependencysubdomainfilelogs.commonb.com.
TLS certificate: Issued by R3 on June 2nd 2023. Valid for: 3 months.

This is the only time dependencysubdomainfilelogs.commonb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	185.199.108.153 185.199.108.153	54113 (FASTLY) (FASTLY)
1	2606:4700:310... 2606:4700:3108::ac42:2b96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1901:0:e... 2600:1901:0:e8fb::	15169 (GOOGLE) (GOOGLE)
1	104.206.225.156 104.206.225.156	62904 (AS62904) (AS62904)
2	64.190.113.121 64.190.113.121	399629 (BLNWX) (BLNWX)
7	6

1 185.199.108.153 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-108-153.github.com

llink.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:2b96 (United States)

ASN13335 (CLOUDFLARENET, US)

track.salesflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:e8fb:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

api.salesflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.206.225.156 (United States)

ASN62904 (AS62904, US)
PTR: start.beamerchandise.com

spiculum.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.190.113.121 (Los Angeles, United States)

ASN399629 (BLNWX, US)

dependencysubdomainfilelogs.commonb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	commonb.com dependencysubdomainfilelogs.commonb.com	132 KB
2	salesflare.com track.salesflare.com api.salesflare.com — Cisco Umbrella Rank: 734882	10 KB
1	spiculum.net spiculum.net Failed	280 B
1	llink.to llink.to	644 B
7	4

	Domain	Requested by
2	dependencysubdomainfilelogs.commonb.com	dependencysubdomainfilelogs.commonb.com
1	api.salesflare.com	track.salesflare.com
1	spiculum.net	track.salesflare.com
1	track.salesflare.com	llink.to
1	llink.to
7	5

This site contains no links.

Subject Issuer	Validity	Valid
llink.to R3	`2023-05-31` - `2023-08-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-03-20` - `2024-03-19`	a year	crt.sh
api.salesflare.com GTS CA 1D4	`2023-05-31` - `2023-08-29`	3 months	crt.sh
spiculum.net cPanel, Inc. Certification Authority	`2023-05-13` - `2023-08-11`	3 months	crt.sh
commonb.com R3	`2023-06-02` - `2023-08-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com
Frame ID: A66D8C14AF223F24981603586B1CCD14
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

reCAPTCHA

Page URL History Show full URLs

https://llink.to/?u=https%3A%2F%2Fspiculum.net%2FSNCC%2Fsales%2Fc2FsZXNAdGhvcmxhYnMuY29t Page URL
https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com Page URL

Page Statistics

7
Requests

86 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

6
IPs

1
Countries

143 kB
Transfer

343 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://llink.to/?u=https%3A%2F%2Fspiculum.net%2FSNCC%2Fsales%2Fc2FsZXNAdGhvcmxhYnMuY29t Page URL
https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
llink.to/ 528 B
644 B 136ms
41ms Document
text/html 185.199.108.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://llink.to/?u=https%3A%2F%2Fspiculum.net%2FSNCC%2Fsales%2Fc2FsZXNAdGhvcmxhYnMuY29t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.199.108.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-108-153.github.com
Software: GitHub.com /
Resource Hash: cef628c25de0e74a1b9644b9b536388bf5770d15fdc6657adeb0bc14e7443cba

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 80
cache-control: max-age=600
content-encoding: gzip
content-length: 247
content-type: text/html; charset=utf-8
date: Fri, 16 Jun 2023 23:31:28 GMT
etag: W/"63974a53-210"
expires: Tue, 06 Jun 2023 02:25:52 GMT
last-modified: Mon, 12 Dec 2022 15:35:47 GMT
server: GitHub.com
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1
x-fastly-request-id: fcee4b4e2eb85581de17c80f17104012c138bb62
x-github-request-id: 375E:ED10:2757A7D:28ADDDD:647E96D8
x-origin-cache: HIT
x-proxy-cache: MISS
x-served-by: cache-fra-eddf8230056-FRA
x-timer: S1686958289.895065,VS0,VE1

GET
H2 200 flare.js Show response
track.salesflare.com/ 25 KB
10 KB 153ms
58ms Script
application/javascript 2606:4700:3108::ac42:2b96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://track.salesflare.com/flare.js

Requested by

Host: llink.to
URL: https://llink.to/?u=https%3A%2F%2Fspiculum.net%2FSNCC%2Fsales%2Fc2FsZXNAdGhvcmxhYnMuY29t

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3108::ac42:2b96 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be78f01895edc773a13548123092abe460b3d9c5eac8def3121c0bb37426ea2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://llink.to/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 16 Jun 2023 23:31:29 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9838
cf-polished: origSize=25857
x-guploader-uploadid: ADPycdvzgh0yXZCOEe4JpHpJojsT4Wdpw5D6V3BsB4BhfZ_jiLfKn73UGlh994yn0ySqOcEiu_Y5zbIB_q1s-OcwVGYF1w
x-goog-storage-class: STANDARD
content-encoding: br
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 31 Jan 2022 15:07:13 GMT
server: cloudflare
etag: W/"f0f9b9e0eff4cb7320ab07be423b3697"
vary: Accept-Encoding,Origin
x-goog-generation: 1643641633015855
content-language: en
content-type: application/javascript
x-goog-hash: crc32c=xHIp5A==, md5=8Pm54O/0y3Mgqwe+Qjs2lw==
cache-control: public, max-age=14400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p1uaO0p8mlhQXgD%2FrpoTxruaRuH0ZfpKURsrXXM8I3%2FIPgaW%2Bi4aQtrJxLhyQoOn1xDHMVjnqccvp8wrU%2BGzHr8IDLa9TkEruP8UmtBX00zOlZYDNbD02UOMn%2BvS0B1U8lzcvIp5psySibDtH%2FWfugo%2F"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 8963
cf-ray: 7d86d8ba7d466901-FRA
expires: Sat, 17 Jun 2023 00:47:31 GMT

GET c2FsZXNAdGhvcmxhYnMuY29t
spiculum.net/SNCC/sales/ 0
0

POST
H2 401 forward
api.salesflare.com/interactions/ 76 B
375 B 167ms
75ms XHR
application/json 2600:1901:0:e8fb::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.salesflare.com/interactions/forward?instant=true
Requested by: Host: track.salesflare.com
URL: https://track.salesflare.com/flare.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:e8fb:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Referer: https://llink.to/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Fri, 16 Jun 2023 23:31:29 GMT
via: 1.1 google
www-authenticate: Bearer
server: Google Frontend
vary: origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://llink.to
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
x-cloud-trace-context: 836dd44d8c903f83f693ccfaec7e001f
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76

GET
H/1.1 200
OK c2FsZXNAdGhvcmxhYnMuY29t Show response
spiculum.net/SNCC/sales/ 0
280 B 559ms
172ms Document
text/html 104.206.225.156
AS62904

General

Check archive.org

Show headers Download Go to

Full URL: https://spiculum.net/SNCC/sales/c2FsZXNAdGhvcmxhYnMuY29t
Requested by: Host: track.salesflare.com
URL: https://track.salesflare.com/flare.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.206.225.156 , United States, ASN62904 (AS62904, US),
Reverse DNS: start.beamerchandise.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://llink.to/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Fri, 16 Jun 2023 23:31:29 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
refresh: 0;url=https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com

GET
H2 200 Primary Request / Show response
dependencysubdomainfilelogs.commonb.com/ 277 KB
132 KB 2055ms
1501ms Document
text/html 64.190.113.121
BLNWX

General

Check archive.org

Show headers Download Go to

Full URL

https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

64.190.113.121 Los Angeles, United States, ASN399629 (BLNWX, US),

Reverse DNS

Software

nginx /

Resource Hash

29e6d0b6eace7c011e4ece3686618607883e43a9ebcc984593fe1cb289c6a8a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://spiculum.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Fri, 16 Jun 2023 23:31:31 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 858 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 / Show response
dependencysubdomainfilelogs.commonb.com/ 140 B
308 B 992ms
992ms Fetch
application/json 64.190.113.121
BLNWX

General

Check archive.org

Show headers Download Go to

Full URL

https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com

Requested by

Host: dependencysubdomainfilelogs.commonb.com
URL: https://dependencysubdomainfilelogs.commonb.com/?username=sales@thorlabs.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

64.190.113.121 Los Angeles, United States, ASN399629 (BLNWX, US),

Reverse DNS

Software

nginx /

Resource Hash

d399a9601a5b7958f9d5582d73957415839b86c1dab3898b6e931f520c3778d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 16 Jun 2023 23:31:33 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/json

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: spiculum.net
URL: https://spiculum.net/SNCC/sales/c2FsZXNAdGhvcmxhYnMuY29t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.salesflare.com/interactions/forward?instant=true Message: Failed to load resource: the server responded with a status of 401 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.salesflare.com
dependencysubdomainfilelogs.commonb.com
llink.to
spiculum.net
track.salesflare.com
spiculum.net
104.206.225.156
185.199.108.153
2600:1901:0:e8fb::
2606:4700:3108::ac42:2b96
64.190.113.121
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
29e6d0b6eace7c011e4ece3686618607883e43a9ebcc984593fe1cb289c6a8a3
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
be78f01895edc773a13548123092abe460b3d9c5eac8def3121c0bb37426ea2f
cef628c25de0e74a1b9644b9b536388bf5770d15fdc6657adeb0bc14e7443cba
d399a9601a5b7958f9d5582d73957415839b86c1dab3898b6e931f520c3778d4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

dependencysubdomainfilelogs.commonb.com Open in urlscan Pro 64.190.113.121 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

86 %HTTPS

40 %IPv6

4 Domains

5 Subdomains

6 IPs

1 Countries

143 kBTransfer

343 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

dependencysubdomainfilelogs.commonb.com Open in urlscan Pro
64.190.113.121 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

6
IPs

1
Countries

143 kB
Transfer

343 kB
Size

0
Cookies

7 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!