upgrade-servero3.ml Open in urlscan Pro
2606:4700:3037::ac43:d632 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://app.nutshell.com/email/click/29112/324583/4a1018a4dda17fcc215f05c6843db953d00dc483ce728c263f27c020091057cc
Effective URL:
https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-chec...
Submission: On August 19 via manual (August 19th 2020, 8:44:46 am UTC) from PH

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2606:4700:3037::ac43:d632, located in United States and belongs to CLOUDFLARENET, US. The main domain is upgrade-servero3.ml.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 18th 2020. Valid for: a year.

This is the only time upgrade-servero3.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.208.37.124 18.208.37.124	14618 (AMAZON-AES) (AMAZON-AES)
3	169.62.254.82 169.62.254.82	36351 (SOFTLAYER) (SOFTLAYER)
1 8	2606:4700:303... 2606:4700:3037::ac43:d632	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2

1 18.208.37.124 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-208-37-124.compute-1.amazonaws.com

app.nutshell.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 169.62.254.82 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 52.fe.3ea9.ip4.static.sl-reverse.com

atmail.us-south.cf.appdomain.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:3037::ac43:d632 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

upgrade-servero3.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	upgrade-servero3.ml 1 redirects upgrade-servero3.ml	301 KB
3	appdomain.cloud atmail.us-south.cf.appdomain.cloud	2 KB
1	nutshell.com 1 redirects app.nutshell.com	344 B
10	3

	Domain	Requested by
8	upgrade-servero3.ml	1 redirects upgrade-servero3.ml
3	atmail.us-south.cf.appdomain.cloud
1	app.nutshell.com	1 redirects
10	3

This site contains no links.

Subject Issuer	Validity	Valid
*.us-south.cf.appdomain.cloud DigiCert SHA2 Secure Server CA	`2019-09-24` - `2020-09-28`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-18` - `2021-08-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true
Frame ID: FDFAA7997698C9D1FBD74BA5F470548A
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://app.nutshell.com/email/click/29112/324583/4a1018a4dda17fcc215f05c6843db953d00dc483ce728c263f2... HTTP 302
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Page URL
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Page URL
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Page URL
https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/index.php?email=miguel.fernandez@paym... HTTP 302
https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_m... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

303 kB
Transfer

518 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://app.nutshell.com/email/click/29112/324583/4a1018a4dda17fcc215f05c6843db953d00dc483ce728c263f27c020091057cc HTTP 302
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Page URL
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Page URL
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Page URL
https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/index.php?email=miguel.fernandez@paymaya.com HTTP 302
https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://app.nutshell.com/email/click/29112/324583/4a1018a4dda17fcc215f05c6843db953d00dc483ce728c263f27c020091057cc HTTP 302
https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.php Show response atmail.us-south.cf.appdomain.cloud/ Redirect Chain https://app.nutshell.com/email/click/29112/324583/4a1018a4dda17fcc215f05c6843db953d00dc483ce728c263f27c020091057cc https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com	668 B 740 B	1368ms 917ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `6a77bdf1228977f62e9820b970e7e58758f8017de71b0c74706ebff67cfd488a` Request headers Host atmail.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 19 Aug 2020 08:44:28 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 6d6595795f3ce66c304ca4e7 Redirect headers status 302 date Wed, 19 Aug 2020 08:44:27 GMT content-type text/html; charset=UTF-8 location https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com server nginx/1.16.1 set-cookie PHPSESSID=amkke3268p5d2nko0o1sjpik1a; path=/; secure expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache x-ua-compatible IE=Edge referrer-policy origin-when-cross-origin x-nutshell-app-version 3800
GET H/1.1	200 OK	index.php Show response atmail.us-south.cf.appdomain.cloud/	668 B 740 B	381ms 381ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `6a77bdf1228977f62e9820b970e7e58758f8017de71b0c74706ebff67cfd488a` Request headers Host atmail.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 19 Aug 2020 08:44:29 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 6d6595795f3ce66d6f260bb9
GET H/1.1	200 OK	index.php Show response atmail.us-south.cf.appdomain.cloud/	735 B 788 B	205ms 204ms	Document text/html	169.62.254.82 SOFTLAYER
General Check archive.org Show headers Download Go to Full URL https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 169.62.254.82 , United States, ASN36351 (SOFTLAYER, US), Reverse DNS 52.fe.3ea9.ip4.static.sl-reverse.com Software Apache / Resource Hash `b2cf1cbeca9398bb632ee4b84ff4a2636599fbf081f2565d6d6688bc54c1cafc` Request headers Host atmail.us-south.cf.appdomain.cloud Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Response headers X-Backside-Transport OK OK Connection Keep-Alive Transfer-Encoding chunked Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 19 Aug 2020 08:44:29 GMT Server Apache Vary Accept-Encoding X-Global-Transaction-ID 6d6595795f3ce66dea0970d1
GET H2	200	Primary Request index.php Show response upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/ Redirect Chain https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/index.php?email=miguel.fernandez@paymaya.com https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf...	3 KB 1 KB	183ms 182ms	Document text/html	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.8 Resource Hash `cac7de7b833c1448883ed28488146f78c33f1d65603282a12d949154c0c82535` Request headers :method GET :authority upgrade-servero3.ml :scheme https :path /websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com accept-encoding gzip, deflate, br accept-language en-US cookie __cfduid=d3f35f881b7d6217463494244414819581597826669 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://atmail.us-south.cf.appdomain.cloud/index.php?email=miguel.fernandez@paymaya.com Response headers status 200 date Wed, 19 Aug 2020 08:44:30 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.4.8 cf-cache-status DYNAMIC cf-request-id 04a77d35b800000b88c0bab200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5c5297cf8d860b88-AMS content-encoding br Redirect headers status 302 date Wed, 19 Aug 2020 08:44:29 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d3f35f881b7d6217463494244414819581597826669; expires=Fri, 18-Sep-20 08:44:29 GMT; path=/; domain=.upgrade-servero3.ml; HttpOnly; SameSite=Lax; Secure x-powered-by PHP/7.4.8 location microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true cf-cache-status DYNAMIC cf-request-id 04a77d34f700000b88c0ba2200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5c5297ce5b290b88-AMS
GET H2	200	bootstrap.min.css upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/vendor/bootstrap/css/	138 KB 19 KB	428ms 426ms	Stylesheet text/css	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/vendor/bootstrap/css/bootstrap.min.css Requested by Host: upgrade-servero3.ml URL: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11` Request headers Referer https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 19 Aug 2020 08:44:30 GMT content-encoding br cf-cache-status MISS last-modified Mon, 17 Aug 2020 14:04:51 GMT server cloudflare etag W/"22688-5ad134117ff92" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 5c5297d0cfa80b88-AMS cf-request-id 04a77d367d00000b88c0bb3200000001
GET H2	200	microsoft.svg upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/	4 KB 1 KB	192ms 191ms	Image image/svg+xml	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/microsoft.svg Requested by Host: upgrade-servero3.ml URL: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Referer https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 19 Aug 2020 08:44:30 GMT content-encoding br cf-cache-status MISS last-modified Mon, 17 Aug 2020 14:04:50 GMT server cloudflare etag W/"e43-5ad13410accb4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/svg+xml status 200 cache-control max-age=14400 cf-ray 5c5297d0cfb20b88-AMS cf-request-id 04a77d367e00000b88c0bb7200000001
GET H2	200	jquery-2.2.3.min.js Show response upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/vendor/jquery/	84 KB 29 KB	350ms 349ms	Script application/javascript	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/vendor/jquery/jquery-2.2.3.min.js Requested by Host: upgrade-servero3.ml URL: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6b6de0d4db7876d1183a3edb47ebd3bbbf93f153f5de1ba6645049348628109a` Request headers Referer https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 19 Aug 2020 08:44:30 GMT content-encoding br cf-cache-status MISS last-modified Mon, 17 Aug 2020 14:04:53 GMT server cloudflare etag W/"14e9b-5ad13413ab247" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 5c5297d0cfac0b88-AMS cf-request-id 04a77d367e00000b88c0bb4200000001
GET H2	200	bootstrap.min.js Show response upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/vendor/bootstrap/js/	50 KB 13 KB	342ms 341ms	Script application/javascript	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/vendor/bootstrap/js/bootstrap.min.js Requested by Host: upgrade-servero3.ml URL: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4` Request headers Referer https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 19 Aug 2020 08:44:30 GMT content-encoding br cf-cache-status MISS last-modified Mon, 17 Aug 2020 14:04:53 GMT server cloudflare etag W/"c75f-5ad1341308540" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 5c5297d0cfae0b88-AMS cf-request-id 04a77d367e00000b88c0bb5200000001
GET H2	200	data.js Show response upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/js/	2 KB 775 B	186ms 185ms	Script application/javascript	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/js/data.js Requested by Host: upgrade-servero3.ml URL: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4a3259a30daf6c595e77f78f5e7c4dff535d8fef0f673b06942d321ffb23269c` Request headers Referer https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 19 Aug 2020 08:44:30 GMT content-encoding br cf-cache-status MISS last-modified Mon, 17 Aug 2020 14:04:50 GMT server cloudflare etag W/"7f8-5ad13410d3db4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 5c5297d0cfb10b88-AMS cf-request-id 04a77d367e00000b88c0bb6200000001
GET H2	200	bg1.jpg upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/	237 KB 237 KB	337ms 336ms	Image image/jpeg	2606:4700:3037::ac43:d632 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/bg1.jpg Requested by Host: upgrade-servero3.ml URL: https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:d632 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `263c44467ca59350f59ceb85fdfe0e06649b9202b469342b0d901a08af9e1f53` Request headers Referer https://upgrade-servero3.ml/websrvcs/clientarea/logix/0xcg39ujhd/0/microsoft/index.php?microsoft_login_mail=1&microsoft-check-level=8d3abf851a9a96e17cb7f4751b2829f7&security=d0bc60a036685786ec755cf95aeeb61b&email=miguel.fernandez@paymaya.com&session-id=ituu88847&NhYt5565dh7738xxcefrsts&auth0=true User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 19 Aug 2020 08:44:30 GMT cf-cache-status MISS last-modified Mon, 17 Aug 2020 14:04:50 GMT server cloudflare etag "3b221-5ad134102ab19" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 5c5297d39ca70b88-AMS content-length 242209 cf-request-id 04a77d383c00000b88c0bd5200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.upgrade-servero3.ml/	1970-01-19 12:33:38	Name: __cfduid Value: d3f35f881b7d6217463494244414819581597826669

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.nutshell.com
atmail.us-south.cf.appdomain.cloud
upgrade-servero3.ml
169.62.254.82
18.208.37.124
2606:4700:3037::ac43:d632
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
263c44467ca59350f59ceb85fdfe0e06649b9202b469342b0d901a08af9e1f53
4a3259a30daf6c595e77f78f5e7c4dff535d8fef0f673b06942d321ffb23269c
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6a77bdf1228977f62e9820b970e7e58758f8017de71b0c74706ebff67cfd488a
6b6de0d4db7876d1183a3edb47ebd3bbbf93f153f5de1ba6645049348628109a
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
b2cf1cbeca9398bb632ee4b84ff4a2636599fbf081f2565d6d6688bc54c1cafc
cac7de7b833c1448883ed28488146f78c33f1d65603282a12d949154c0c82535

upgrade-servero3.ml Open in urlscan Pro 2606:4700:3037::ac43:d632 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

303 kBTransfer

518 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

upgrade-servero3.ml Open in urlscan Pro
2606:4700:3037::ac43:d632 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

303 kB
Transfer

518 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!