xn--hotma-f4a1f.com Open in urlscan Pro Puny
hotmaįĺ.com IDN
50.62.144.168 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://xn--hotma-f4a1f.com/
Submission Tags: tweet @atomspam #phishing #microsoft #infosec #cybersecurity #atomspam Search All
Submission: On February 02 via api (February 2nd 2023, 3:13:10 pm UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 50.62.144.168, located in United States and belongs to GO-DADDY-COM-LLC, US. The main domain is xn--hotma-f4a1f.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 2nd 2023. Valid for: 3 months.

This is the only time xn--hotma-f4a1f.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
8	50.62.144.168 50.62.144.168		398101 (GO-DADDY-...) (GO-DADDY-COM-LLC)
8	1

8 50.62.144.168 (United States)

ASN398101 (GO-DADDY-COM-LLC, US)
PTR: 168.144.62.50.host.secureserver.net

xn--hotma-f4a1f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	xn--hotma-f4a1f.com xn--hotma-f4a1f.com	17 KB
8	1

	Domain	Requested by
8	xn--hotma-f4a1f.com	xn--hotma-f4a1f.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid
xn--hotma-f4a1f.com cPanel, Inc. Certification Authority	`2023-02-02` - `2023-05-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://xn--hotma-f4a1f.com/
Frame ID: 1C559C46AE9C0281781BF794D2EFE79F
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Microsoft hesabınızda oturum açın

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

17 kB
Transfer

50 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response xn--hotma-f4a1f.com/	3 KB 1 KB	629ms 207ms	Document text/html	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / PHP/7.4.33 Resource Hash `61c2b4a75f74298c5bb83bb1033c207510a06c7bbd9595945287447acdff09cf` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-length 910 content-type text/html; charset=UTF-8 date Thu, 02 Feb 2023 15:13:04 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server Apache vary Accept-Encoding x-powered-by PHP/7.4.33
GET H2	200	style.css xn--hotma-f4a1f.com/assets/css/	13 KB 3 KB	194ms 193ms	Stylesheet text/css	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL https://xn--hotma-f4a1f.com/assets/css/style.css Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `152527afae31554c5846f96b508cc9a8d737f746dfdf0be03f2704497c55bf90` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT content-encoding br last-modified Fri, 16 Dec 2022 18:49:54 GMT server Apache etag "1c0c2e-3241-5eff66f6d9880-br" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2487
GET H2	200	ms_logo.svg xn--hotma-f4a1f.com/assets/img/	4 KB 1 KB	193ms 192ms	Image image/svg+xml	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://xn--hotma-f4a1f.com/assets/img/ms_logo.svg Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT content-encoding br last-modified Fri, 16 Dec 2022 19:00:58 GMT server Apache etag "1c0c34-e43-5eff697016e80-br" vary Accept-Encoding content-type image/svg+xml accept-ranges bytes content-length 1375
GET H2	200	question_mark.svg xn--hotma-f4a1f.com/assets/img/	2 KB 642 B	191ms 191ms	Image image/svg+xml	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://xn--hotma-f4a1f.com/assets/img/question_mark.svg Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT content-encoding br last-modified Fri, 16 Dec 2022 19:01:54 GMT server Apache etag "1c0c36-613-5eff69a57ec80-br" vary Accept-Encoding content-type image/svg+xml accept-ranges bytes content-length 562
GET H2	200	option.svg xn--hotma-f4a1f.com/assets/img/	2 KB 644 B	192ms 184ms	Image image/svg+xml	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://xn--hotma-f4a1f.com/assets/img/option.svg Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT content-encoding br last-modified Fri, 16 Dec 2022 19:02:12 GMT server Apache etag "1c0c35-638-5eff69b6a9500-br" vary Accept-Encoding content-type image/svg+xml accept-ranges bytes content-length 564
GET H2	200	back.png xn--hotma-f4a1f.com/assets/img/	240 B 322 B	345ms 337ms	Image image/png	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://xn--hotma-f4a1f.com/assets/img/back.png Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT last-modified Fri, 16 Dec 2022 19:02:38 GMT server Apache accept-ranges bytes etag "1c0c31-f0-5eff69cf74f80" content-length 240 content-type image/png
GET H2	200	index.js Show response xn--hotma-f4a1f.com/assets/js/	25 KB 9 KB	345ms 345ms	Script application/javascript	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL https://xn--hotma-f4a1f.com/assets/js/index.js Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `f568f1600c580891aef913f4a9f210b09fde1fedf11a849f5073ed39a11b0ddc` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT content-encoding br last-modified Mon, 19 Dec 2022 10:39:16 GMT server Apache etag "1c0c39-65c0-5f02bee4f7d00-br" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 9300
GET H2	200	bg.svg xn--hotma-f4a1f.com/assets/img/	2 KB 707 B	191ms 191ms	Image image/svg+xml	50.62.144.168 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://xn--hotma-f4a1f.com/assets/img/bg.svg Requested by Host: xn--hotma-f4a1f.com URL: https://xn--hotma-f4a1f.com/assets/css/style.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 50.62.144.168 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 168.144.62.50.host.secureserver.net Software Apache / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language fi-FI,fi;q=0.9 Referer https://xn--hotma-f4a1f.com/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36 Response headers date Thu, 02 Feb 2023 15:13:04 GMT content-encoding br last-modified Tue, 13 Dec 2022 06:38:10 GMT server Apache etag "1c0c32-748-5efafdd059880-br" vary Accept-Encoding content-type image/svg+xml accept-ranges bytes content-length 627

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			xn--hotma-f4a1f.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0d5ad8dd7979303a512f563d93ee4032

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

xn--hotma-f4a1f.com
50.62.144.168
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
152527afae31554c5846f96b508cc9a8d737f746dfdf0be03f2704497c55bf90
61c2b4a75f74298c5bb83bb1033c207510a06c7bbd9595945287447acdff09cf
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
f568f1600c580891aef913f4a9f210b09fde1fedf11a849f5073ed39a11b0ddc

xn--hotma-f4a1f.com Open in urlscan Pro Puny hotmaįĺ.com IDN 50.62.144.168 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

17 kBTransfer

50 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

xn--hotma-f4a1f.com Open in urlscan Pro Puny
hotmaįĺ.com IDN
50.62.144.168 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

17 kB
Transfer

50 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!