deck-shared-2023.us-ord-1.linodeobjects.com Open in urlscan Pro
2600:3c06::f03c:93ff:fe54:2fd2  Malicious Activity! Public Scan

Submitted URL: https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_...
Effective URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Submission: On December 07 via manual from GB — Scanned from GB

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 2600:3c06::f03c:93ff:fe54:2fd2, located in Chicago, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is deck-shared-2023.us-ord-1.linodeobjects.com.
TLS certificate: Issued by R3 on October 2nd 2023. Valid for: 3 months.
This is the only time deck-shared-2023.us-ord-1.linodeobjects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2 103.253.43.4 133398 (TELE-AS T...)
1 2600:3c06::f0... 63949 (AKAMAI-LI...)
1 212.70.149.197 12615 (GCN-AS GC...)
3 4
Domain Requested by
2 docapicvr.sensualite.art.br 1 redirects
1 ruthowlevtui.officialcountdown9.com deck-shared-2023.us-ord-1.linodeobjects.com
1 deck-shared-2023.us-ord-1.linodeobjects.com
3 3

This site contains no links.

Subject Issuer Validity Valid
docapicvr.sensualite.art.br
R3
2023-12-07 -
2024-03-06
3 months crt.sh
us-ord-1.linodeobjects.com
R3
2023-10-02 -
2023-12-31
3 months crt.sh
officialcountdown9.com
R3
2023-12-06 -
2024-03-05
3 months crt.sh

This page contains 2 frames:

Primary Page: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Frame ID: 1EC76E78934FA5275E4D045EEB92FE00
Requests: 2 HTTP requests in this frame

Frame: https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Frame ID: 559467DF83C0A6F2242BF043FD897957
Requests: 3 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_em... Page URL
  2. https://docapicvr.sensualite.art.br/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

298 kB
Transfer

531 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me Page URL
  2. https://docapicvr.sensualite.art.br/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me
docapicvr.sensualite.art.br/
1 KB
678 B
Document
General
Full URL
https://docapicvr.sensualite.art.br/privacy-policy-2-utm_source=Herefish&utm_medium=email&utm_campaign=client_email&hf=68610841&utm_campaign=website&utm_medium=shared_with_me
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.253.43.4 , Hong Kong, ASN133398 (TELE-AS Tele Asia Limited, HK),
Reverse DNS
slot9.ge-re.com
Software
Apache /
Resource Hash
a981a07eda9f0b473a291df3da0e86545d9316ee03ab16de10390ea8b12c6990

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Thu, 07 Dec 2023 16:51:26 GMT
server
Apache
vary
Accept-Encoding
Primary Request DecGrace.html
deck-shared-2023.us-ord-1.linodeobjects.com/
Redirect Chain
  • https://docapicvr.sensualite.art.br/index.php?continue2
  • https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
166 KB
166 KB
Document
General
Full URL
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:3c06::f03c:93ff:fe54:2fd2 Chicago, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
4ded796f8719ca509cebe2f051ccef7ea35cd0b50efd4f7a90840696909768b4

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://docapicvr.sensualite.art.br
Referer
https://docapicvr.sensualite.art.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
170036
Content-Type
text/html
Date
Thu, 07 Dec 2023 16:51:27 GMT
ETag
"e2d6610a57b4d64a69ed28273355cd16"
Last-Modified
Wed, 06 Dec 2023 16:09:01 GMT
x-amz-request-id
tx0000061c21edc97e96dc1-006571f80f-79290b-default
x-rgw-object-type
Normal

Redirect headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Thu, 07 Dec 2023 16:51:26 GMT
location
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
server
Apache
vary
Accept-Encoding
/
ruthowlevtui.officialcountdown9.com/ Frame 5594
324 KB
131 KB
Document
General
Full URL
https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Requested by
Host: deck-shared-2023.us-ord-1.linodeobjects.com
URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.70.149.197 Dimitrovgrad, Bulgaria, ASN12615 (GCN-AS GCN AD - Sofia, Bulgaria, BG),
Reverse DNS
Software
nginx /
Resource Hash
8997033d1a85d405784f9abe2b09af37529f20c755d3aa6255edeaf05c5d8bb0

Request headers

Referer
https://deck-shared-2023.us-ord-1.linodeobjects.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 07 Dec 2023 16:51:28 GMT
server
nginx
vary
Accept-Encoding
truncated
/ Frame 5594
858 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ Frame 5594
40 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| a0_0x375d function| a0_0xe541

0 Cookies