urlscan.io logo urlscan.io
SecurityTrails logo

common.oauth2.d1l.us Open in urlscan Pro
162.0.214.31  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://common-oauth2.app.link/e/stop-robot
Effective URL: https://common.oauth2.d1l.us/next.php?ss=2
Submission: On March 23 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 162.0.214.31, located in United States and belongs to NAMECHEAP-NET, US. The main domain is common.oauth2.d1l.us.
TLS certificate: Issued by R3 on March 19th 2021. Valid for: 3 months.
This is the only time common.oauth2.d1l.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 2 2600:9000:206... 16509 (AMAZON-02)
3 4 107.152.33.84 11878 (TZULO)
2 40.126.31.8 8075 (MICROSOFT...)
1 1 162.215.248.191 46606 (UNIFIEDLA...)
2 10 162.0.214.31 22612 (NAMECHEAP...)
11 3
2    2600:9000:206f:5e00:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)
common-oauth2.app.link
4    107.152.33.84 (United States)

ASN11878 (TZULO, US)
stop-robot.live
2    40.126.31.8 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com
1    162.215.248.191 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-215-248-191.unifiedlayer.com
common.oauth2.ael.com.bd
10    162.0.214.31 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: zoezo.wtf
common.oauth2.d1l.us
Apex Domain
Subdomains		 Transfer
10 d1l.us
common.oauth2.d1l.us
323 KB
4 stop-robot.live
stop-robot.live
5 KB
2 microsoftonline.com
login.microsoftonline.com
2 app.link
common-oauth2.app.link
1 KB
1 ael.com.bd
common.oauth2.ael.com.bd
370 B
11 5
Domain Requested by
10 common.oauth2.d1l.us 2 redirects common.oauth2.d1l.us
4 stop-robot.live 3 redirects
2 login.microsoftonline.com stop-robot.live
2 common-oauth2.app.link 2 redirects
1 common.oauth2.ael.com.bd 1 redirects
11 5

This site contains no links.

Subject Issuer Validity Valid
www.stop-robot.live
R3		 2021-02-22 -
2021-05-23		 3 months crt.sh
stamp2.login.microsoftonline.com
DigiCert SHA2 Secure Server CA		 2021-03-05 -
2022-03-05		 a year crt.sh
common.oauth2.d1l.us
R3		 2021-03-19 -
2021-06-17		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://common.oauth2.d1l.us/next.php?ss=2
Frame ID: 08A94CE370B7C8FAF8D4BC4C8BD79739
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://common-oauth2.app.link/e/stop-robot HTTP 307
    https://stop-robot.live/aWNsb3VkQGljbG91ZC5jb20=?_branch_match_id=902968202683372074&utm_source=utm_... HTTP 302
    https://stop-robot.live/info/ Page URL
  2. https://common-oauth2.app.link/e/cvpxUEkHAQE75z9j HTTP 307
    http://common.oauth2.ael.com.bd/c2FsZXNAa2Fyb3V0YXMuc3V6dWtpLW5ldHdvcmsuZ3I=?_branch_match_id=90296822184474... HTTP 302
    https://common.oauth2.d1l.us/?ss=2&ea=sales@karoutas.suzuki-network.gr&session=3c1c09e7815633df84ea154f7e... HTTP 302
    https://common.oauth2.d1l.us/login.php?ss=2&ea=sales@karoutas.suzuki-network.gr HTTP 302
    https://common.oauth2.d1l.us/next.php?ss=2 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Unix/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

326 kB
Transfer

416 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://common-oauth2.app.link/e/stop-robot HTTP 307
    https://stop-robot.live/aWNsb3VkQGljbG91ZC5jb20=?_branch_match_id=902968202683372074&utm_source=utm_y&utm_campaign=utm_z&utm_medium=utm_x HTTP 302
    https://stop-robot.live/info/ Page URL
  2. https://common-oauth2.app.link/e/cvpxUEkHAQE75z9j HTTP 307
    http://common.oauth2.ael.com.bd/c2FsZXNAa2Fyb3V0YXMuc3V6dWtpLW5ldHdvcmsuZ3I=?_branch_match_id=902968221844745207&utm_source=utm_y&utm_campaign=utm_z&utm_medium=utm_x HTTP 302
    https://common.oauth2.d1l.us/?ss=2&ea=sales@karoutas.suzuki-network.gr&session=3c1c09e7815633df84ea154f7e0a34ac3c1c09e7815633df84ea154f7e0a34ac HTTP 302
    https://common.oauth2.d1l.us/login.php?ss=2&ea=sales@karoutas.suzuki-network.gr HTTP 302
    https://common.oauth2.d1l.us/next.php?ss=2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://common-oauth2.app.link/e/stop-robot HTTP 307
  • https://stop-robot.live/aWNsb3VkQGljbG91ZC5jb20=?_branch_match_id=902968202683372074&utm_source=utm_y&utm_campaign=utm_z&utm_medium=utm_x HTTP 302
  • https://stop-robot.live/info/
Request Chain 1
  • https://stop-robot.live/js/ads.js HTTP 302
  • https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
Request Chain 2
  • https://stop-robot.live/info/js/jquery-2.5.1.min.js HTTP 302
  • https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
stop-robot.live/info/
Redirect Chain
  • https://common-oauth2.app.link/e/stop-robot
  • https://stop-robot.live/aWNsb3VkQGljbG91ZC5jb20=?_branch_match_id=902968202683372074&utm_source=utm_y&utm_campaign=utm_z&utm_medium=utm_x
  • https://stop-robot.live/info/
4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://stop-robot.live/info/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.152.33.84 , United States, ASN11878 (TZULO, US),
Reverse DNS
Software
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash
f7b7e28053006ab5acd2e382276ed17e6479bb860828107fae4a430ca3d64083

Request headers

Host
stop-robot.live
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:43 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
Last-Modified
Fri, 19 Mar 2021 23:37:06 GMT
ETag
"e39-5bdec319f2c80"
Accept-Ranges
bytes
Content-Length
3641
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html

Redirect headers

Date
Tue, 23 Mar 2021 18:03:42 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
X-Powered-By
PHP/7.4.11
Location
https://stop-robot.live/info/
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
logout
login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/
Redirect Chain
  • https://stop-robot.live/js/ads.js
  • https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
Requested by
Host: stop-robot.live
URL: https://stop-robot.live/info/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.31.8 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Date
Tue, 23 Mar 2021 18:03:43 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
X-Powered-By
PHP/7.4.11
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
location
https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
logout
login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/
Redirect Chain
  • https://stop-robot.live/info/js/jquery-2.5.1.min.js
  • https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
Requested by
Host: stop-robot.live
URL: https://stop-robot.live/info/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.126.31.8 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Redirect headers

Date
Tue, 23 Mar 2021 18:03:43 GMT
Server
Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
X-Powered-By
PHP/7.4.11
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
location
https://login.microsoftonline.com/3b5c2832-4b4d-4b6a-aa14-ffb05086b26c/oauth2/logout
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Primary Request next.php
common.oauth2.d1l.us/
Redirect Chain
  • https://common-oauth2.app.link/e/cvpxUEkHAQE75z9j
  • http://common.oauth2.ael.com.bd/c2FsZXNAa2Fyb3V0YXMuc3V6dWtpLW5ldHdvcmsuZ3I=?_branch_match_id=902968221844745207&utm_source=utm_y&utm_campaign=utm_z&utm_medium=utm_x
  • https://common.oauth2.d1l.us/?ss=2&ea=sales@karoutas.suzuki-network.gr&session=3c1c09e7815633df84ea154f7e0a34ac3c1c09e7815633df84ea154f7e0a34ac
  • https://common.oauth2.d1l.us/login.php?ss=2&ea=sales@karoutas.suzuki-network.gr
  • https://common.oauth2.d1l.us/next.php?ss=2
13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx / PHP/5.6.40
Resource Hash
01c3d25d773b79067d6b57c7a0ad6b440cc07340532acda65b8b1df076a24f6d

Request headers

Host
common.oauth2.d1l.us
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=1cu42gvch70l0paub4vc7cvfo0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://stop-robot.live/info/

Response headers

Server
nginx
Date
Tue, 23 Mar 2021 18:03:50 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Vary
Accept-Encoding
X-Powered-By
PHP/5.6.40
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Tue, 23 Mar 2021 18:03:50 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
X-Powered-By
PHP/5.6.40
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Location
next.php?ss=2
Converged1033.css
common.oauth2.d1l.us/files/ 		99 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://common.oauth2.d1l.us/files/Converged1033.css
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
2ec900b69976ea8831b52fe02092bccc9ed9b6a178f1154fb16d8a9b309c36bb

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
W/"5f0da660-18cef"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
logo3.png
common.oauth2.d1l.us/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://common.oauth2.d1l.us/files/logo3.png
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
"5f0da660-6d6"
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
1750
Expires
Thu, 31 Dec 2037 23:55:55 GMT
load2.gif
common.oauth2.d1l.us/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://common.oauth2.d1l.us/files/load2.gif
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
82bb14eaeec4c971c85dafc91a78999a5b9f52eeaa3be657f55be9dbe3d4aff0

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
"5f0da660-84b"
Content-Type
image/gif
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
2123
Expires
Thu, 31 Dec 2037 23:55:55 GMT
microsoft_logo.svg
common.oauth2.d1l.us/files/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://common.oauth2.d1l.us/files/microsoft_logo.svg
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
W/"5f0da660-e43"
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=60
Expires
Thu, 31 Dec 2037 23:55:55 GMT
quest.png
common.oauth2.d1l.us/files/ 		355 B
684 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://common.oauth2.d1l.us/files/quest.png
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
85eb7e94db9425fd39e3a6d89e5abaf398611529a3d25d078015cc11e055260b

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
"5f0da660-163"
Content-Type
image/png
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
355
Expires
Thu, 31 Dec 2037 23:55:55 GMT
0-small.jpg
common.oauth2.d1l.us/files/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://common.oauth2.d1l.us/files/0-small.jpg
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
"5f0da660-405"
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
1029
Expires
Thu, 31 Dec 2037 23:55:55 GMT
0.jpg
common.oauth2.d1l.us/files/ 		291 KB
291 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://common.oauth2.d1l.us/files/0.jpg
Requested by
Host: common.oauth2.d1l.us
URL: https://common.oauth2.d1l.us/next.php?ss=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.0.214.31 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
zoezo.wtf
Software
nginx /
Resource Hash
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Referer
https://common.oauth2.d1l.us/next.php?ss=2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 18:03:50 GMT
Last-Modified
Tue, 14 Jul 2020 12:34:40 GMT
Server
nginx
ETag
"5f0da660-48c79"
Content-Type
image/jpeg
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=60
Content-Length
298105
Expires
Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| empty function| change function| myFunction function| myFunction2

1 Cookies

Domain/Path Name / Value
common.oauth2.d1l.us/ Name: PHPSESSID
Value: 1cu42gvch70l0paub4vc7cvfo0