bailoutmedia.co
Open in
urlscan Pro
70.32.68.130
Malicious Activity!
Public Scan
URL:
http://bailoutmedia.co/Kattegat/Adobe_cloud/index.php
Submission: On August 09 via manual from BE — Scanned from DE
Submission: On August 09 via manual from BE — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 70.32.68.130, located in
United States and
belongs to MEDIATEMPLE, US.
The main domain is bailoutmedia.co.
This is the only time bailoutmedia.co was scanned on urlscan.io!
This is the only time bailoutmedia.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 70.32.68.130 70.32.68.130 | 31815 (MEDIATEMPLE) (MEDIATEMPLE) | |
| 2 | 2606:4700:303... 2606:4700:3033::6815:3f36 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 14 | 2 |
12
70.32.68.130
(United States)
ASN31815 (MEDIATEMPLE, US)
PTR: aamoiaqsac.c05.gridserver.com
ASN31815 (MEDIATEMPLE, US)
PTR: aamoiaqsac.c05.gridserver.com
| bailoutmedia.co |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
bailoutmedia.co
bailoutmedia.co |
359 KB |
| 2 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 951 |
77 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 12 | bailoutmedia.co |
bailoutmedia.co
|
| 2 | use.fontawesome.com |
bailoutmedia.co
use.fontawesome.com |
| 14 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-06 - 2023-06-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://bailoutmedia.co/Kattegat/Adobe_cloud/index.php
Frame ID: 47E11830019E203BAC7E382B74828F2D
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Adobe PDF OnlineDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.php
bailoutmedia.co/Kattegat/Adobe_cloud/ |
28 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
bailoutmedia.co/Kattegat/Adobe_cloud/css/ |
147 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
all.css
use.fontawesome.com/releases/v5.3.1/css/ |
48 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.css
bailoutmedia.co/Kattegat/Adobe_cloud/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
spinner.svg
bailoutmedia.co/Kattegat/Adobe_cloud/images/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-header.png
bailoutmedia.co/Kattegat/Adobe_cloud/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
word-icon.png
bailoutmedia.co/Kattegat/Adobe_cloud/images/ |
249 KB 250 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
anti-virus.jpg
bailoutmedia.co/Kattegat/Adobe_cloud/images/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ted.png
bailoutmedia.co/Kattegat/Adobe_cloud/images/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.slim.min.js
bailoutmedia.co/Kattegat/Adobe_cloud/js/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tether.min.js
bailoutmedia.co/Kattegat/Adobe_cloud/js/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
bailoutmedia.co/Kattegat/Adobe_cloud/js/ |
46 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scripts.js
bailoutmedia.co/Kattegat/Adobe_cloud/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fa-solid-900.woff2
use.fontawesome.com/releases/v5.3.1/webfonts/ |
66 KB 66 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery function| Tether function| testEmail function| clearSpace0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bailoutmedia.co
use.fontawesome.com
2606:4700:3033::6815:3f36
70.32.68.130
0442a5d5466a92e46e958f5ba39d50544c2b0ddff96f53733f38e983fc684199
510a325511da46876c69baf81e75ecd19cffca5b1d7c74c6d394a17fdc966f3c
569491fbc351a3bf2f9c9e27d893be6f7a11ed95716c9f6f5c5f7a5d20cf9f25
604dcf1f11698655f75046bb92f98aaa9477e1c16b01c5fc415e78794393ffb9
68ea83e2827400efb3aba1f1f7a6ffa8b296e7043e0b6a7e65c09fc1f7421f5b
74aa4bea40103d121df47c79bcf239a44b0056ec7b1087c15b0cb7681ea519f9
80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f
8f2306735d05cfc385e680d4b6fe06998d3a426c6f4653668e841fb6dc737b06
a38aa9d0155d9e07a648af736bf7dfe2388efd961fbcf5f2eba20256661820bb
b9c8c8672cac9bf52c0319d35c0f85a412b9f312e8f6fb6a46316d0aff4ef91c
ca3ea16761b7d443c64cfd99dd1cf8aa84790a25bb4709582935956fe71d014d
e8d650d36cb3e37496a8bb8f183978cf15cde3652ad3b4e65d70b0620a9b0e83
fd4e36989302bb662963aa5612114b262b8500322ee2171ace464e1d56af12c4
fdb1ee51d20da04d74acdd0c48d74d134016c2c1e243bca316f7fefc0eaa28cb