greenglobus.net
Open in
urlscan Pro
101.53.143.13
Malicious Activity!
Public Scan
Submission: On May 07 via automatic, source openphish
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 27th 2020. Valid for: 3 months.
This is the only time greenglobus.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 101.53.143.13 101.53.143.13 | 17439 (NETMAGIC-...) (NETMAGIC-AP Netmagic Datacenter Mumbai) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 | 40.126.1.142 40.126.1.142 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
10 | 3 |
ASN17439 (NETMAGIC-AP Netmagic Datacenter Mumbai, IN)
PTR: webhost.netechno.com
greenglobus.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
greenglobus.net
greenglobus.net |
399 KB |
1 |
microsoftonline.com
login.microsoftonline.com |
|
1 |
aspnetcdn.com
ajax.aspnetcdn.com |
38 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
8 | greenglobus.net |
greenglobus.net
|
1 | login.microsoftonline.com |
greenglobus.net
|
1 | ajax.aspnetcdn.com |
greenglobus.net
|
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
greenglobus.net cPanel, Inc. Certification Authority |
2020-02-27 - 2020-05-27 |
3 months | crt.sh |
*.vo.msecnd.net Microsoft IT TLS CA 2 |
2020-03-18 - 2022-03-18 |
2 years | crt.sh |
stamp2.login.microsoftonline.com Microsoft IT TLS CA 1 |
2018-09-24 - 2020-09-24 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://greenglobus.net/new/common/oauth2/authorize.php
Frame ID: D8E3254228B94A52AACF652AC4C386AD
Requests: 9 HTTP requests in this frame
Frame:
https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Frame ID: E140DF469FAD8658B0D19BF4C09C6480
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
authorize.php
greenglobus.net/new/common/oauth2/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Converged_v21033_LspEdbpUdfwgOwjzn44fsg2.css
greenglobus.net/new/css/ |
100 KB 100 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
greenglobus.net/new/images/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
panah_kiri.svg
greenglobus.net/new/images/ |
513 B 759 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
muter.gif
greenglobus.net/new/images/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
greenglobus.net/new/images/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
logout.srf
login.microsoftonline.com/ Frame E140 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dasar_kecil.jpg
greenglobus.net/new/images/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dasar_besar.jpg
greenglobus.net/new/images/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
greenglobus.net
login.microsoftonline.com
101.53.143.13
152.199.19.160
40.126.1.142
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
ba1f7e7f63a74f50f9e76b5cb1e445545126fac7bd1cb6b6d7fb5ab51acf9f66
ccb8a6c3c6f129b7a2d51bc31ef5b04dd36cfc39a1f1d9a3bac04d68920b6a01
f383bd943e3f4019258d9f8ca8c0d6600a09a8c74dfb011956f656ba02e63cee
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea