urlscan.io logo urlscan.io
SecurityTrails logo

7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com Open in urlscan Pro
2a00:1450:4001:814::2014  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Submission: On May 12 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2a00:1450:4001:814::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com.
TLS certificate: Issued by GTS CA 1O1 on April 15th 2020. Valid for: 3 months.
This is the only time 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
13 160.153.53.104 26496 (AS-26496-...)
14 2
Domain Requested by
13 adkpd.com 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
1 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
14 2

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
Subject Issuer Validity Valid
*.appspot.com
GTS CA 1O1		 2020-04-15 -
2020-07-08		 3 months crt.sh
adkpd.com
ZeroSSL RSA Domain Secure Site CA		 2020-05-08 -
2020-08-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Frame ID: 6C42E3A7A268F77500919A0BB2850C24
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Google Frontend/i

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

28 kB
Transfer

53 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/ 		18 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:814::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
8dabd22cf9ae86336f81c4e1708111df5b63f379fac7c5479dfcde795e3b5df4

Request headers

:method
GET
:authority
7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
:scheme
https
:path
/?t=1&e=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
content-type
text/html
content-encoding
gzip
x-cloud-trace-context
d8d152aed852e509d3c432533e9f9aa5
vary
Accept-Encoding
date
Tue, 12 May 2020 16:48:29 GMT
server
Google Frontend
cache-control
private
content-length
4510
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
logon.css
adkpd.com/oyhash/media/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adkpd.com/oyhash/media/css/logon.css
Requested by
Host: 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
URL: https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
e2668bd835e43e98af69578a65ae2378ba6fc64c77c7a673efa7407ba934a612

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
content-encoding
gzip
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0186-9d1-5a554ccb80080-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
888
owafont.css
adkpd.com/oyhash/media/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://adkpd.com/oyhash/media/css/owafont.css
Requested by
Host: 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
URL: https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
content-encoding
gzip
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0187-12d6-5a554ccb80080-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
1571
helpers.js
adkpd.com/oyhash/media/js/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://adkpd.com/oyhash/media/js/helpers.js?ver=12839297292
Requested by
Host: 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
URL: https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
f3ca37e5de471db84ff63a0b227798863f9173e8b604e7ff04882725dc0f205c

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
content-encoding
gzip
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0196-247f-5a554ccb80080-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
2384
app.js
adkpd.com/oyhash/media/js/ 		1 KB
562 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adkpd.com/oyhash/media/js/app.js?ver=21313
Requested by
Host: 7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com
URL: https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
c7d898fe02a498faf9fbe172ea56b6456c7111e5176488bac84c15eb1278cffc

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
content-encoding
gzip
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0198-463-5a554ccb80080-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
486
lgntopl.gif
adkpd.com/oyhash/media/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/images/lgntopl.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0191-1167-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
4455
lgntopr.gif
adkpd.com/oyhash/media/images/ 		581 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/images/lgntopr.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0190-245-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
581
lgnexlogo.gif
adkpd.com/oyhash/media/images/ 		61 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/images/lgnexlogo.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a018f-3d-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
61
lgnbotl.gif
adkpd.com/oyhash/media/images/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/images/lgnbotl.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a018e-245f-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
9311
lgnbotr.gif
adkpd.com/oyhash/media/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/images/lgnbotr.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Request headers

Referer
https://7fd7f5ea23c4a2fb1a212624ea166195-dot-bles05.wn.r.appspot.com/?t=1&e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0193-958-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
2392
lgntopm.gif
adkpd.com/oyhash/media/css/ 		58 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/css/lgntopm.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6

Request headers

Referer
https://adkpd.com/oyhash/media/css/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a018a-3a-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
58
lgnleft.gif
adkpd.com/oyhash/media/css/ 		290 B
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/css/lgnleft.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185

Request headers

Referer
https://adkpd.com/oyhash/media/css/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0189-122-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
290
lgnright.gif
adkpd.com/oyhash/media/css/ 		306 B
359 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/css/lgnright.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775

Request headers

Referer
https://adkpd.com/oyhash/media/css/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a018b-132-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
306
lgnbotm.gif
adkpd.com/oyhash/media/css/ 		276 B
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adkpd.com/oyhash/media/css/lgnbotm.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
160.153.53.104 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-160-153-53-104.ip.secureserver.net
Software
Apache /
Resource Hash
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a

Request headers

Referer
https://adkpd.com/oyhash/media/css/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 12 May 2020 16:48:30 GMT
last-modified
Mon, 11 May 2020 00:55:14 GMT
server
Apache
etag
"5a0188-114-5a554ccb80080"
content-type
image/gif
status
200
accept-ranges
bytes
content-length
276

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| LIB_phrase string| LIB_view string| ____media string| ____b string| ____rdr object| d object| s function| getEmailDomain function| getEmailDomainName function| bindElements function| validateEmail function| getUrlParameter function| dDOM object| Base64 number| LIB_submitTrial object| LIB_submitButton object| LIB_userInput object| LIB_pwdInput undefined| LIB_form function| initForLogin function| initForTrueLogin function| loginUser function| trueLoginUser function| initApp function| sendPost function| sendGet function| bindXhr number| c2 number| c1 number| c3

0 Cookies