hne.nuu.mybluehost.me
Open in
urlscan Pro
162.241.218.73
Malicious Activity!
Public Scan
Submission: On November 19 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 6th 2023. Valid for: 3 months.
This is the only time hne.nuu.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nickel (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 162.241.218.73 162.241.218.73 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 52.109.76.142 52.109.76.142 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 23.53.43.83 23.53.43.83 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 23.53.43.58 23.53.43.58 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
17 | 6 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5545.bluehost.com
hne.nuu.mybluehost.me |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-43-83.deploy.static.akamaitechnologies.com
app.nickel.eu |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-53-43-58.deploy.static.akamaitechnologies.com
static-resources.nickel.eu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
mybluehost.me
hne.nuu.mybluehost.me |
54 KB |
4 |
nickel.eu
app.nickel.eu static-resources.nickel.eu |
101 KB |
1 |
rawgit.com
rawgit.com — Cisco Umbrella Rank: 10288 |
43 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 762 |
30 KB |
1 |
office.com
sway.office.com — Cisco Umbrella Rank: 37987 |
43 KB |
17 | 5 |
Domain | Requested by | |
---|---|---|
10 | hne.nuu.mybluehost.me |
hne.nuu.mybluehost.me
|
3 | static-resources.nickel.eu |
hne.nuu.mybluehost.me
|
1 | rawgit.com |
hne.nuu.mybluehost.me
|
1 | code.jquery.com |
hne.nuu.mybluehost.me
|
1 | app.nickel.eu |
hne.nuu.mybluehost.me
|
1 | sway.office.com |
hne.nuu.mybluehost.me
|
17 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpanel.hne.nuu.mybluehost.me R3 |
2023-10-06 - 2024-01-04 |
3 months | crt.sh |
sway.office.com Microsoft Azure TLS Issuing CA 05 |
2023-10-10 - 2024-06-27 |
9 months | crt.sh |
bnp02sw.bnpparibas.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-10-25 - 2024-05-15 |
7 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
rawgit.com GTS CA 1P5 |
2023-10-30 - 2024-01-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://hne.nuu.mybluehost.me/fr/nickel/clients/
Frame ID: DD6A06A279644C7C87C7490C8810BB5E
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
hne.nuu.mybluehost.me/fr/nickel/clients/ |
186 KB 36 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
86fffa26.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
25 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
24571a40.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
32 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
des.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f55d3599.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
645939e1.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fe9185d1.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2282daa7.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
74.b7389af6.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
65.045f2d82.chunk.css
hne.nuu.mybluehost.me/fr/nickel/assets/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vu4jz7qzAFWYi4
sway.office.com/s/FwF7eDt2ADsieHjq/images/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
card-back.f1f8eab6.svg
app.nickel.eu/static/media/ |
16 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.inputmask.js
rawgit.com/RobinHerbots/Inputmask/5.x/dist/ |
225 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MullerNarrow-Light.woff2
static-resources.nickel.eu/fonts/ |
31 KB 32 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MullerNarrow-ExtraBold.woff2
static-resources.nickel.eu/fonts/ |
30 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MullerNarrow-Medium.woff2
static-resources.nickel.eu/fonts/ |
32 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nickel (Financial)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| Inputmask function| default function| resetpass function| refreshpass3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
hne.nuu.mybluehost.me/ | Name: PHPSESSID Value: d6c18f6b74e9578e9bb248c25147fe70 |
|
.sway.office.com/ | Name: AuthSess Value: b542b0b0-2214-4988-80a0-1c7a58a82c80 |
|
.office.com/ | Name: AADNonce Value: 53094ed5-2685-42b1-803f-79f2bc12e41d.638359641391086808 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.nickel.eu
code.jquery.com
hne.nuu.mybluehost.me
rawgit.com
static-resources.nickel.eu
sway.office.com
162.241.218.73
23.53.43.58
23.53.43.83
2a04:4e42:400::649
2a06:98c1:3121::3
52.109.76.142
222662d0ed5617d8df9772f5394fdb715acdd3296f00d6db261b682e8400ecd2
29a377530b36d1a9e568c24f4539126c6342ce8bc14de3843fdcf7a3dc18add4
368d3e222fb20951615a298ab3bd932813679981b92d448183a988068c113d77
476f270e826992d2d2fe59ad3a3db7beec5478b6a7b1633de3df18a2a65c951e
4da7ff58a085e3c3fdc781d9e38117c808d7d3425dda5ab7d605d05ad7025493
5ce7979af69c35c2381677bbb13f2c07717278dbbb31c09984310e34408d5c4b
6392a748f3002e48611ba86cd3f3bec9ff95a4f2c11449e15dc1253ce3585028
7200907126c92e6db88c0b89fbfa738ff6a9ad5dd0f7ac49e0d98c1db03ae13d
9975f01b5c37637ad69bbf03f593d335875f255be681505ef64541d1696f5fd4
cdc59faf2e130ca1efe657cd09bb5f5957e1b6c79ff1cc2cd78e08ffb3a44d8e
e671416c9ac25a7877362f1c6581b91fbe987ec04e187b365a96a3feecc2bb1a
f0e7fef75b97057f33e9ba884f068688dd6514ad2e303685ab29418e1390b842
f996d7eb10768373376f60c455f38135808f5ad7d6a347aec0584362de092fa7
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e