Submitted URL: https://cs2480.mojohost.com/
Effective URL: https://cs2480.mojohost.com/license.php
Submission Tags: phishingrod
Submission: On June 26 via api from DE — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 10 HTTP transactions. The main IP is 64.59.123.4, located in United States and belongs to MOJOHOST, US. The main domain is cs2480.mojohost.com.
TLS certificate: Issued by R3 on April 29th 2023. Valid for: 3 months.
This is the only time cs2480.mojohost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 64.59.123.4 27589 (MOJOHOST)
8 151.101.66.137 54113 (FASTLY)
10 3
Apex Domain
Subdomains
Transfer
8 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 511
25 KB
2 mojohost.com
cs2480.mojohost.com
27 KB
0 nr-data.net Failed
bam.nr-data.net Failed
10 3
Domain Requested by
8 js-agent.newrelic.com cs2480.mojohost.com
2 cs2480.mojohost.com 1 redirects
0 bam.nr-data.net Failed js-agent.newrelic.com
10 3

This site contains links to these domains. Also see Links.

Domain
nats.kickasspays.com
Subject Issuer Validity Valid
nats.kickasspays.com
R3
2023-04-29 -
2023-07-28
3 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-04-13 -
2024-05-14
a year crt.sh

This page contains 1 frames:

Primary Page: https://cs2480.mojohost.com/license.php
Frame ID: AC07D397A4FED1FF1FE8CED5B4C01F94
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

NATS - License Information

Page URL History Show full URLs

  1. https://cs2480.mojohost.com/ HTTP 302
    https://cs2480.mojohost.com/license.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

10
Requests

80 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

52 kB
Transfer

87 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cs2480.mojohost.com/ HTTP 302
    https://cs2480.mojohost.com/license.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request license.php
cs2480.mojohost.com/
Redirect Chain
  • https://cs2480.mojohost.com/
  • https://cs2480.mojohost.com/license.php
27 KB
27 KB
Document
General
Full URL
https://cs2480.mojohost.com/license.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.59.123.4 , United States, ASN27589 (MOJOHOST, US),
Reverse DNS
cs2480.mojohost.com
Software
Apache / PHP/5.6.32
Resource Hash
00c05ccecd97dba4300e61fe15febe3a508ca70f830b64e2e97b86c4d7a0d097

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 26 Jun 2023 04:51:30 GMT
Keep-Alive
timeout=5, max=99
Server
Apache
Transfer-Encoding
chunked
X-Powered-By
PHP/5.6.32

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 26 Jun 2023 04:51:30 GMT
Keep-Alive
timeout=5, max=100
Location
/license.php
Server
Apache
X-Powered-By
PHP/5.6.32
async-api.d1647fbb-1.235.0.min.js
js-agent.newrelic.com/
3 KB
2 KB
Script
General
Full URL
https://js-agent.newrelic.com/async-api.d1647fbb-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
928d99d484efe9f20001fe0174e3347806989f534ec020ed2522e3ce5615e38d
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
PGx68fBemYK57.2UTlf_G7ch3pUyoCTv
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
CQ6SM332C3HD866D
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1421
x-amz-id-2
WuNZPXVQbOLmtPM+zBKXnizPHVcP2FYBaGxUdjQqADPztZoRz/Kmz/uQlDTLKlOAloIqp3rRK0A=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.847367,VS0,VE0
etag
"183fa36ece8fcbbc903243ccb0afa0e9"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1194
860.e997904f-1.235.0.min.js
js-agent.newrelic.com/
14 KB
6 KB
Script
General
Full URL
https://js-agent.newrelic.com/860.e997904f-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6c82d14f968f93df57674479a67bf2fb0dc32b64afbeb6c509cae5dc6ae2381f
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
sUb0oAFSUge4mZLwGJwT_rzmsxJnvqEB
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
CQ6XYGJRGFGPNYQA
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5275
x-amz-id-2
cT06Qvonteb3ID8BpPNYFwhPC2sMVbTLqFQ9bkLthFeEf8+5lqkHpPGXdU7SleF9YPlT++2v5aw=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.847342,VS0,VE0
etag
"5f8f767cf1bda85c34af0dacc0622d4f"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1190
session-manager.2a64278a-1.235.0.min.js
js-agent.newrelic.com/
1 KB
887 B
Script
General
Full URL
https://js-agent.newrelic.com/session-manager.2a64278a-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
BZkWMpEwsOZuYqIlvS4C.QETPn3AglYd
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
HZW2G30BGRNNN4TS
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
677
x-amz-id-2
Sxl+8++Y1u/GFQtzg7EzgdTWYK7rr+d8fE3nlXg5xLcrbcjgyRncVPpV9R+BFNe6M0Rm2KS//dA=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.847516,VS0,VE0
etag
"a097cb2068fb2d63e521cacf139c921d"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1043
lazy-feature-loader.0ba331d7-1.235.0.min.js
js-agent.newrelic.com/
1 KB
883 B
Script
General
Full URL
https://js-agent.newrelic.com/lazy-feature-loader.0ba331d7-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de82d3f1b1bd63a9117fcd54ca0a2cb7d9a5e1d294e9d0c67166500e47d683f3
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
kqNen_b1zcbOI7SyHGNKYG._1v1cXBiu
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
N1SD7H903P5Q22T7
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
436
x-amz-id-2
Wh3ZZJ5jB1Gg31wjMrY2DoN+0p09HJogmWSRbyLPVxRml0QnnmpATIQb5EaV3pnhuMK1mAwHZS8=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.862033,VS0,VE0
etag
"8d1984f1b5a2b054e6fbe6c9c886193d"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1186
148.03807465-1.235.0.min.js
js-agent.newrelic.com/
7 KB
3 KB
Script
General
Full URL
https://js-agent.newrelic.com/148.03807465-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d1c9a859fe4f1eedc6f90b7c399d8a358dc93ff23c7a9c420e85bafd6ef50a64
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
mDm_lN1BZVH2jPuTvP8RgDwAdg9JNOCQ
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
N1SDECHWP5PTTN5D
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3209
x-amz-id-2
1TTnWkxad5cjD1hoxvPgSZItBvlRosmaPIA+/ffw5r8WKVQ/l4deQg+b2znpLk7ulepqhqQ79V8=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.870861,VS0,VE0
etag
"35f2c02180f390df3c795c872bcd7e41"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
864
page_view_event-aggregate.a7935af6-1.235.0.min.js
js-agent.newrelic.com/
11 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_event-aggregate.a7935af6-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f126f1b7ce191cf1a80f1dee6a2bbfa9fee141340e4ef9cc3b683fda9ac588d8
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
iSz7800SnmJ3Lz40oo.gR_eRsbNM3wY9
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
N1SB1756BM88ZF6A
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4116
x-amz-id-2
sLXktn+URmDXsUO+k1hjrF0R5d9TfLmODEVN0dMWOSbiBA+UVp2aY/Rz1DnPuoPDgTBp1aYPPig=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.871033,VS0,VE0
etag
"17ee92570a5dd947879416128fe6fa35"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
869
page_view_timing-aggregate.1c78d061-1.235.0.min.js
js-agent.newrelic.com/
15 KB
6 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_timing-aggregate.1c78d061-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9cc22f48470a0a4efa956daa4bf294039262d6e67d1f334c5c69aef46c277607
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
ONOhcsdtj24uD13zUbxHsdKusbQBhxx7
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
N1SBJ5GTQ6D61GGJ
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5448
x-amz-id-2
iZNp8QDKT5F2bM/JHNRUJefLVFKK7Z5gDZ1txk0ELfU1S1Zg91RaoJfVkEelN5xpqQ3xpM1DCd0=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.871435,VS0,VE0
etag
"5c4172c97936d3532e8f1d2e2a9579f2"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
379
metrics-aggregate.7ece083a-1.235.0.min.js
js-agent.newrelic.com/
8 KB
3 KB
Script
General
Full URL
https://js-agent.newrelic.com/metrics-aggregate.7ece083a-1.235.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
55e1407e5ec63b06d024a1badf14b8f7c6eacdead13d9407ffcc5e18502224b5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
QEARPx5T2d1YDGdgs6LZVWFi.ZeJwkAi
content-encoding
gzip
via
1.1 varnish
date
Mon, 26 Jun 2023 04:51:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
N1S2PKNPWEDDX1PY
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
2956
x-amz-id-2
bmCsouFbfVfFoQ0rHzg2QuJYXWtdRqyrfbw4h99bVKz5EAXRojak/LwD9sjNvNCKjO6qOJNHd44=
x-served-by
cache-fra-eddf8230120-FRA
last-modified
Tue, 20 Jun 2023 20:09:41 GMT
server
AmazonS3
x-timer
S1687755091.871544,VS0,VE0
etag
"efb4026fb6f7446f879ec5aee982bd11"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
849
b42ac20c27
bam.nr-data.net/1/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
bam.nr-data.net
URL
https://bam.nr-data.net/1/b42ac20c27?a=55516769&v=1.235.0&to=Z1cHZkZWDRVQVRJQX14dMEBdGA8PUlMISlUeQg1C&rst=1296&ck=0&s=76cf9a31030eb91a&ref=https://cs2480.mojohost.com/license.php&ap=51&be=1153&fe=71&dc=69&at=SxAEEA5MHhs%3D&perf=%7B%22timing%22:%7B%22of%22:1687755089588,%22n%22:0,%22r%22:0,%22re%22:977,%22f%22:977,%22dn%22:977,%22dne%22:977,%22c%22:977,%22s%22:977,%22ce%22:977,%22rq%22:977,%22rp%22:1153,%22rpe%22:1197,%22di%22:1222,%22ds%22:1222,%22de%22:1222,%22dc%22:1222,%22l%22:1222,%22le%22:1224%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=1229&fcp=1229

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA

0 Cookies

2 Console Messages

Source Level URL
Text
javascript error URL: https://cs2480.mojohost.com/license.php
Message:
Access to XMLHttpRequest at 'https://bam.nr-data.net/1/b42ac20c27?a=55516769&v=1.235.0&to=Z1cHZkZWDRVQVRJQX14dMEBdGA8PUlMISlUeQg1C&rst=1296&ck=0&s=76cf9a31030eb91a&ref=https://cs2480.mojohost.com/license.php&ap=51&be=1153&fe=71&dc=69&at=SxAEEA5MHhs%3D&perf=%7B%22timing%22:%7B%22of%22:1687755089588,%22n%22:0,%22r%22:0,%22re%22:977,%22f%22:977,%22dn%22:977,%22dne%22:977,%22c%22:977,%22s%22:977,%22ce%22:977,%22rq%22:977,%22rp%22:1153,%22rpe%22:1197,%22di%22:1222,%22ds%22:1222,%22de%22:1222,%22dc%22:1222,%22l%22:1222,%22le%22:1224%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=1229&fcp=1229' from origin 'https://cs2480.mojohost.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://bam.nr-data.net/1/b42ac20c27?a=55516769&v=1.235.0&to=Z1cHZkZWDRVQVRJQX14dMEBdGA8PUlMISlUeQg1C&rst=1296&ck=0&s=76cf9a31030eb91a&ref=https://cs2480.mojohost.com/license.php&ap=51&be=1153&fe=71&dc=69&at=SxAEEA5MHhs%3D&perf=%7B%22timing%22:%7B%22of%22:1687755089588,%22n%22:0,%22r%22:0,%22re%22:977,%22f%22:977,%22dn%22:977,%22dne%22:977,%22c%22:977,%22s%22:977,%22ce%22:977,%22rq%22:977,%22rp%22:1153,%22rpe%22:1197,%22di%22:1222,%22ds%22:1222,%22de%22:1222,%22dc%22:1222,%22l%22:1222,%22le%22:1224%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=1229&fcp=1229
Message:
Failed to load resource: net::ERR_FAILED