safemark99asw2.xyz
Open in
urlscan Pro
107.180.117.5
Malicious Activity!
Public Scan
Submission Tags: @ecarlesi threat phishing fakesupport Search All
Submission: On March 28 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by R3 on March 27th 2024. Valid for: 3 months.
This is the only time safemark99asw2.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 107.180.117.5 107.180.117.5 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 104.16.87.20 104.16.87.20 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 2a02:4780:1:7... 2a02:4780:1:755:0:298c:cfd9:2 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 2606:4700:10:... 2606:4700:10::6814:4373 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2a02:26f0:710... 2a02:26f0:7100:99f::f03 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 142.4.219.198 142.4.219.198 | 16276 (OVH) (OVH) | |
25 | 9 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 5.117.180.107.host.secureserver.net
safemark99asw2.xyz |
ASN47583 (AS-HOSTINGER, CY)
theflavorsomejourney.com |
ASN20940 (AKAMAI-ASN1, NL)
support.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
theflavorsomejourney.com
theflavorsomejourney.com |
642 KB |
2 |
microsoft.com
1 redirects
support.microsoft.com — Cisco Umbrella Rank: 7851 |
342 B |
2 |
histats.com
s10.histats.com — Cisco Umbrella Rank: 15493 s4.histats.com — Cisco Umbrella Rank: 15484 |
5 KB |
2 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2984 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1117 |
24 KB |
2 |
safemark99asw2.xyz
safemark99asw2.xyz |
61 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 234 |
27 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
32 KB |
25 | 7 |
Domain | Requested by | |
---|---|---|
16 | theflavorsomejourney.com |
safemark99asw2.xyz
|
2 | support.microsoft.com |
1 redirects
safemark99asw2.xyz
|
2 | safemark99asw2.xyz |
safemark99asw2.xyz
|
1 | s4.histats.com |
s10.histats.com
|
1 | s10.histats.com |
safemark99asw2.xyz
|
1 | maxcdn.bootstrapcdn.com |
safemark99asw2.xyz
|
1 | stackpath.bootstrapcdn.com |
safemark99asw2.xyz
|
1 | cdnjs.cloudflare.com |
safemark99asw2.xyz
|
1 | cdn.jsdelivr.net |
safemark99asw2.xyz
|
25 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
safemark99asw2.xyz R3 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
theflavorsomejourney.com R3 |
2024-03-07 - 2024-06-05 |
3 months | crt.sh |
support.microsoft.com Microsoft Azure TLS Issuing CA 02 |
2023-05-18 - 2024-05-12 |
a year | crt.sh |
histats.com R3 |
2024-02-16 - 2024-05-16 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://safemark99asw2.xyz/
Frame ID: E744E210470D6583D01AE5FFF2AE1EC9
Requests: 24 HTTP requests in this frame
Frame:
https://support.microsoft.com/it-IT
Frame ID: FD8975C798A031DFF1BB7CCE64814ADF
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Microsoft Support Final WarningDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 19- https://support.microsoft.com/ HTTP 301
- https://support.microsoft.com/it-IT
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
safemark99asw2.xyz/ |
213 KB 61 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0-alpha1/dist/css/ |
216 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ |
82 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.5.2/js/ |
59 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minimize.jpeg
theflavorsomejourney.com/coc/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kxFy-clip.png
theflavorsomejourney.com/coc/ |
542 B 604 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qsbs-firewall.png
theflavorsomejourney.com/coc/ |
920 B 982 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s-S4-acc.png
theflavorsomejourney.com/coc/ |
813 B 876 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Z5BR-network.png
theflavorsomejourney.com/coc/ |
607 B 670 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uZbx-si.png
theflavorsomejourney.com/coc/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
okPE-vs.png
theflavorsomejourney.com/coc/ |
313 B 376 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
-EBq-current.png
theflavorsomejourney.com/coc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nOxp-sett.png
theflavorsomejourney.com/coc/ |
463 B 525 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
def.png
theflavorsomejourney.com/coc/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cross.png
theflavorsomejourney.com/coc/ |
377 KB 378 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
virus-images.jpeg
theflavorsomejourney.com/coc/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft.png
theflavorsomejourney.com/coc/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stop.png
theflavorsomejourney.com/coc/ |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js15_as.js
s10.histats.com/ |
11 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
it-IT
support.microsoft.com/ Frame FD89 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Fm7-alert.mp3
theflavorsomejourney.com/coc/ |
196 KB 196 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stars2.html
safemark99asw2.xyz/images/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.php
s4.histats.com/stats/ |
50 B 184 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft.png
theflavorsomejourney.com/coc/ |
1 KB 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onpagereveal object| _Hasync function| $ function| jQuery object| bootstrap object| elem function| openFullscreen function| closeFullscreen function| getVariableFromURl string| ph0ne function| startScan function| playSound object| date string| current_date string| current_time string| date_time function| _typeof function| _classCallCheck function| _defineProperties function| _createClass function| FlipDown function| pad function| appendChildren function| getParameterByName function| finalCountdown function| exitModal number| _kmodal boolean| _smodal number| _now number| _tmx function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues23 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
support.microsoft.com/signin-oidc | Name: .AspNetCore.OpenIdConnect.Nonce.CfDJ8AfnZ7Mjx1BCgeFmRZwDwXA4IJYBW8TdQq1tBPBFN1XH8HWSJ4ucpGETAk2H7yj0LrwYjhmdoAyXTmaYLTbgEKqE6ALzjLAI_kPvcXd33Td2WJgzTwiGAspI3haEfzFisqCx7tWDJUNhB3FLWmaTaQKQMJ3c7uzbjqzOYpsz6qF3eGt0E2iy-WWa4ndXcyflqsIf3LJb0izR4-9JyVtRIle0C8FtmvwwXD9jVg1yeW5T7xI8zGHoBaR-3oHxa8R2sde6bN0T8G2P8pWG6Nw2YO4 Value: N |
|
safemark99asw2.xyz/ | Name: HstCfa4854462 Value: 1711590133118 |
|
safemark99asw2.xyz/ | Name: HstCla4854462 Value: 1711590133118 |
|
safemark99asw2.xyz/ | Name: HstCmu4854462 Value: 1711590133118 |
|
safemark99asw2.xyz/ | Name: HstPn4854462 Value: 1 |
|
safemark99asw2.xyz/ | Name: HstPt4854462 Value: 1 |
|
safemark99asw2.xyz/ | Name: HstCnv4854462 Value: 1 |
|
safemark99asw2.xyz/ | Name: HstCns4854462 Value: 1 |
|
support.microsoft.com/ | Name: EXPID Value: 6d21e4c8-2918-4689-92bb-6940aae6c994 |
|
support.microsoft.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: 07d9e6c0-12c9-432f-98e8-6e9551bf652f |
|
support.microsoft.com/ | Name: ai_session Value: jLrcul1myIGh7EhlBCKPfo|1711590133896|1711590134223 |
|
login.microsoftonline.com/ | Name: buid Value: 0.AV0AMe_N-B6jSkuT5F9XHpElWhkrJ-4RRD9DjyhcE8tv1AcBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8vNO4NvsuNSWp0RU7mpIKbMNC3hqLYCkPU0cajdv9oLF2LGP85sJMLM5grsohcVtjTTb6MwPTK5VRo7pPXmxWCnFl1OtzFpmRIQ_wkMY2eRQgAA |
|
.login.microsoftonline.com/ | Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8IjS3CGMV1fHvZ3-joQI050CuejG-1d1KcP8o1TXlMfR8SdXVyBNzst5YMoLXIfm7zMr-GHb_HvhfsD66TEaxyzHLl-HLVQKYMnON6BPjBhYW2U1AfBlPvgoZOztI5kr-z2ED0tofRvo2qM4PybwOX9QpiNcFYIgNs4n1KZ1pQ9kgAA |
|
.login.microsoftonline.com/ | Name: esctx-mK4R6iBPPY Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8Ip35LgbBys048mb5ZRVHYbWSqXLI6Ien0R6a0y5xkqkRPzbfgFJAYxSZU1Kh7wRIiYQa08yJY0hFMgA9flc5QFbK3kRQg8aFxIvZIRznf1RLAbhuHI1wQ9TuVJp1VoFpOJ5kdY8YmUNNjWXSs2L_riAA |
|
login.microsoftonline.com/ | Name: fpc Value: Al5lkac1B-NDtasOQ9bPgVJqwEtIAQAAAPXBlt0OAAAA |
|
login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
|
.login.live.com/ | Name: uaid Value: 550ffa42fcbe421eb08153d01bcf23e0 |
|
.login.live.com/ | Name: MSPRequ Value: id=12<=1711590134&co=0 |
|
.login.live.com/ | Name: OParams Value: 11O.DoKAtYkV3Wuj2RGhL4!jMqFtT68UDvUEFZQQoZ!mq5SeN7lw1EuKTarvV1Wo4k8yV7vfGiYuT!pJv1SpEt5IJ9ACsZshfD0VP5rF8S6UUjTZdTOdWxInUtWkL0CAUZ4lbRvQ3lQmqEsexNUNB!7EfCUKzES8ah4BQYO8nlb2i207CfUmv4CZH3iYQ6q32S9GHgo1*6OkK7mHUOIP9GEv7HT8iBopS2Vn79FuQBjPAVpBaIoIBE3xZpFYoe1yywksZesjNyEVFAV3fNewqdKBpcU$ |
|
.microsoft.com/ | Name: MC1 Value: GUID=44849ed608e4448ab8490c22aafd3077&HASH=4484&LV=202403&V=4&LU=1711590136834 |
|
.microsoft.com/ | Name: MS0 Value: 37932a2462704f2796ca8026f60535ce |
|
support.microsoft.com/ | Name: MSFPC Value: GUID=44849ed608e4448ab8490c22aafd3077&HASH=4484&LV=202403&V=4&LU=1711590136834 |
254 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
s10.histats.com
s4.histats.com
safemark99asw2.xyz
stackpath.bootstrapcdn.com
support.microsoft.com
theflavorsomejourney.com
104.16.87.20
104.17.25.14
104.18.11.207
107.180.117.5
142.4.219.198
2606:4700:10::6814:4373
2606:4700::6812:bcf
2a02:26f0:7100:99f::f03
2a02:4780:1:755:0:298c:cfd9:2
0d9940eb4c8ba6d8a8e362b1cc54c5d774aca0bfc74e0019ead8ab9b4d9b48ab
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
25e6759cb766022e77e2d37b55449dc1fd8d62370282018d579c8ecb28ea5956
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede
316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c
3b531d403dc8ce7cbb0efb1a0c307cfb2bbaaf21feaff9f3546f13bebda71887
52b762d47c066e16300675d56cc359b504ffd3239438c96eb973864311bb7b79
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
91fb42a68a122344fd78cfd5f0cf9d06ff6d307fd4a5c68f40231c5950ece9a1
92d8510869b3d581401a93130fa72e4b54c5bf28dc8005994c5248d9afbfc37b
932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386
9cffd13c2ce05ebe032709a88fa59504e1218a12b175ec40d5aab280c18be51e
9edbf56b360080f5d6765dce77353b8130e9f8316ad34c68f6c2792cdc446321
a85f1e749a829c5c909837844c6b53ce0a9ae2adb7c8eac0e7b96c372c679a0d
bf8ebf2c2aeb4d8310341694baf1ed935d35c68c1572588af85b4775d5cf500e
c1d52e31f7fc13cbb3efca8b0ec937ddd97a5ec545c4dad26193429db10d8662
c3ad6aa1c03fd108854f008cfec2753ba623e1470a4d61798b5d8c050e474868
c56a8ae4818963e0d71eda4ebf46b4f2cdd3a238537dc8e99711fb690d272a73
cc9492581764043ba1b1f7cd3561e035a1c365d09eda4df29c4e1cadb304fc5c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65