ceqiiesz.co.uk
Open in
urlscan Pro
51.75.161.20
Malicious Activity!
Public Scan
Submitted URL: http://ceqiiesz.co.uk/
Effective URL: https://ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/login.php?cmd=login_submit&id=5aa4390f121148f2359eb9a09a542b...
Submission: On December 06 via manual from US
Effective URL: https://ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/login.php?cmd=login_submit&id=5aa4390f121148f2359eb9a09a542b...
Submission: On December 06 via manual from US
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 8 HTTP transactions.
The main IP is 51.75.161.20, located in
United Kingdom and
belongs to OVH, FR.
The main domain is ceqiiesz.co.uk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 5th 2018. Valid for: 3 months.
This is the only time ceqiiesz.co.uk was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 5th 2018. Valid for: 3 months.
This is the only time ceqiiesz.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 9 | 51.75.161.20 51.75.161.20 | 16276 (OVH) (OVH) | |
| 8 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
ceqiiesz.co.uk
1 redirects
ceqiiesz.co.uk |
654 KB |
| 8 | 1 |
| Domain | Requested by | |
|---|---|---|
| 9 | ceqiiesz.co.uk |
1 redirects
ceqiiesz.co.uk
|
| 8 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| privacy.microsoft.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ceqiiesz.co.uk cPanel, Inc. Certification Authority |
2018-12-05 - 2019-03-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/login.php?cmd=login_submit&id=5aa4390f121148f2359eb9a09a542b1f5aa4390f121148f2359eb9a09a542b1f&session=5aa4390f121148f2359eb9a09a542b1f5aa4390f121148f2359eb9a09a542b1f
Frame ID: 3B39292B1D084639A500DA32D62C8DF2
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://ceqiiesz.co.uk/ Page URL
-
http://ceqiiesz.co.uk/backup.php?id=010f43a491c2e831447b7ac1f527f093010f43a491c2e831447b7ac1f527f093
HTTP 302
https://ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/login.php?cmd=login_submit&id=5aa4390f12... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Terms of use
Title: Terms of use
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://ceqiiesz.co.uk/ Page URL
-
http://ceqiiesz.co.uk/backup.php?id=010f43a491c2e831447b7ac1f527f093010f43a491c2e831447b7ac1f527f093
HTTP 302
https://ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/login.php?cmd=login_submit&id=5aa4390f121148f2359eb9a09a542b1f5aa4390f121148f2359eb9a09a542b1f&session=5aa4390f121148f2359eb9a09a542b1f5aa4390f121148f2359eb9a09a542b1f Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
ceqiiesz.co.uk/ |
123 B 312 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
login.php
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
conv.min.css
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/css/ |
18 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lofo.png
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/images/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
m6.png
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/images/ |
366 B 366 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
continue.png
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/images/ |
19 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
t1.jpg
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/images/ |
566 KB 566 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
small.jpg
ceqiiesz.co.uk/pig/login.microsoftonline.com.auth2/images/ |
369 B 369 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ceqiiesz.co.uk
51.75.161.20
10850cdb2399ea1b052befbe9681b61141db03c5abac2f3c7341cf6acc2d2ebf
46cbe22a7922d0a7f08c90d42ef3dc9d54c4d16c20fd69cd3c4a9f2631e3b305
4a85514093de00ade19131ac893aa3d5d4dd5e2195557ecba4b27c0350e5262c
6689b88e97e5847b5b3442488016e853cd3be24ca14d4a98f52f4990e5e60b29
68b035e4914cf1ed97a02d5c4d424e9f3b32db5fb5a75f9b2061ed60b7a5e3d7
7764c38d71f5ee52d39f237f08b4e82b4715c73bfa0afbaee30a60b0dfd058ca
bec7e91fc6b42a054ab3106dc6e031d71cb9fc957ea0b79d56db8b5cbdfc0488
e1597a3895eb3548ce1160d7f10dc1f7894815132e61a5beda1efa79e2cfef9b