metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz
Open in
urlscan Pro
139.59.255.208
Malicious Activity!
Public Scan
Effective URL: https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142ddcde90db
Submission: On September 16 via manual from AU — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 2nd 2021. Valid for: 3 months.
This is the only time metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.94.61.151 54.94.61.151 | 16509 (AMAZON-02) (AMAZON-02) | |
1 11 | 139.59.255.208 139.59.255.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
10 | 1 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-94-61-151.sa-east-1.compute.amazonaws.com
nt.embluemail.com |
ASN14061 (DIGITALOCEAN-ASN, US)
ansley.farazbamgostar.com | |
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
cloudns.nz
1 redirects
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
262 KB |
1 |
farazbamgostar.com
ansley.farazbamgostar.com |
23 KB |
1 |
embluemail.com
1 redirects
nt.embluemail.com |
238 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
1 redirects
ansley.farazbamgostar.com
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
1 | ansley.farazbamgostar.com | |
1 | nt.embluemail.com | 1 redirects |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ansley.farazbamgostar.com R3 |
2021-09-16 - 2021-12-15 |
3 months | crt.sh |
www.metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz R3 |
2021-09-02 - 2021-12-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142ddcde90db
Frame ID: 3DC9AFF4276117AEE5DFACC5D839DBBA
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
37A9AF33AA86AC4D7AD32F79EB6648DF6142DDCE2A2CBPage URL History Show full URLs
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2...
HTTP 302
https://ansley.farazbamgostar.com/Z3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno= Page URL
-
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/$&gh16ZXaFm2uFsB9E9kEtpYg...
HTTP 302
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142ddcde90db Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fansley.farazbamgostar.com%2FZ3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno=
HTTP 302
https://ansley.farazbamgostar.com/Z3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno= Page URL
-
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/$&gh16ZXaFm2uFsB9E9kEtpYgzevUxtPsuG3x7zxwFt1WnquzAQlLFNtJ71Co5LYkTeUsRANtUoIS1yQH6Ch9N96kbWSqlYj5JoV2IdjbcQXzXcKrG91NpUTXhzZdi78Tb4X4Lc89a1JIWbmsXLd9wxp4jGb9ftvxq0CYsp6Rh6V7lgHSvy32Ws1Mv7MIoqdWdOQfhaQ73?client=Z3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno=
HTTP 302
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142ddcde90db Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fansley.farazbamgostar.com%2FZ3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno= HTTP 302
- https://ansley.farazbamgostar.com/Z3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno=
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Z3JhbnQuc3VsbGl2YW5AbWVyaWRpYW5lbmVyZ3kuY28ubno=
ansley.farazbamgostar.com/ Redirect Chain
|
23 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
PS-6142ddcde90db
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ Redirect Chain
|
38 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c8ad3937f3bffaadc423bdec982daa641d4a227676e6a
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/APP-UYAWSC/ |
103 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cfeaf248a612a9783464bac2dcf6d332aaa9ebddd7367
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/o/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
67dba3c3c84ad44feed69226fadab27796f312adaa8c3
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/e/ |
513 B 635 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2da39c6c463a63beda478f4ac2a1d28d6aa279f73fdeb
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/jq/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2acad3637f6447da2a92eb98c8bd4acaed3f66a7f312d
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/boot/ |
50 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6ac1fedb3646d8f32d7dcaa27d92fc93342aea7ab48a6
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/jm/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-9dfaf2a3afc32ca6ea6db324dda86eb2c449d78a76371
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ |
5 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-9da6c76d634aa63e3a8278ca7fc449aab2312fb2dddfe
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ |
190 KB 188 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/ | Name: PHPSESSID Value: p46a8ig4md9f93sg8qm6n7h40d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ansley.farazbamgostar.com
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz
nt.embluemail.com
139.59.255.208
54.94.61.151
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
52f3b79a6ef42bc2e598cae638bf733ad82f394df75726362b12d8b30ae7f333
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
8259d8c350776e34737a33b9fb42728ed4a179212d00b8a477634ce7ccb4af4f
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
c319a2ea383c1bcf7d2986b336f49e1e627c5414a156b60b6a9595a35a57aab6
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7