c.4qw.nl Open in urlscan Pro
45.154.232.28  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Show response c.4qw.nl/	50 KB 50 KB	1243ms 1022ms	Document text/html	45.154.232.28 ITSJEFEN-AS
General Check archive.org Show headers Download Go to Full URL https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 45.154.232.28 Trondheim, Norway, ASN44381 (ITSJEFEN-AS, NO), Reverse DNS sendfiend.com Software nginx / Resource Hash 1a64eae39f6802f71f6c400c66d1dd01edc45fd2a42929f09b2b53283070b757 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers cache-control no-cache, private content-type text/html; charset=UTF-8 date Sun, 27 Oct 2024 01:20:40 GMT referrer-policy no-referrer-when-downgrade server nginx x-content-type-options nosniff x-frame-options DENY x-server-id www-sendfiend x-xss-protection 0
GET H2	200	styles.css static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/	122 KB 122 KB	148ms 52ms	Stylesheet text/css	51.120.91.151 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/styles.css Requested by Host: c.4qw.nl URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.120.91.151 Oslo, Norway, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash 6441129aa6be6b781521e3efbb00dbb24a54426c047d9570127f47852e1d3051 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1;mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers strict-transport-security max-age=31536000;includeSubDomains etag "654a257f-1e7bc" x-content-type-options nosniff referrer-policy no-referrer-when-downgrade accept-ranges bytes content-length 124860 date Sun, 27 Oct 2024 01:20:40 GMT x-xss-protection 1;mode=block content-type text/css last-modified Tue, 07 Nov 2023 11:54:39 GMT server nginx x-frame-options DENY
GET H2	200	microsoftlogoee5c8d9fb6248c938fd0dc19370e90bd.svg static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/	4 KB 4 KB	217ms 124ms	Image image/svg+xml	51.120.91.151 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/microsoftlogoee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: c.4qw.nl URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.120.91.151 Oslo, Norway, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1;mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers strict-transport-security max-age=31536000;includeSubDomains etag "654a257f-e43" x-content-type-options nosniff referrer-policy no-referrer-when-downgrade accept-ranges bytes content-length 3651 date Sun, 27 Oct 2024 01:20:40 GMT x-xss-protection 1;mode=block content-type image/svg+xml last-modified Tue, 07 Nov 2023 11:54:39 GMT server nginx x-frame-options DENY
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg aadcdn.msftauth.net/ests/2.1/content/images/	513 B 668 B	79ms 21ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: c.4qw.nl URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/488E) / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers content-md5 TjUQkZ0p0Y7rbj6LJofS9Q== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8D6410144A4CB90 age 559430 x-ms-version 2009-09-19 x-cache HIT date Sun, 27 Oct 2024 01:20:40 GMT content-type image/svg+xml last-modified Fri, 02 Nov 2018 20:25:02 GMT vary Accept-Encoding cache-control public, max-age=604800 x-ms-request-id f6134c1a-401e-0030-7df7-223fa8000000 accept-ranges bytes access-control-allow-origin * content-length 276 x-ms-blob-type BlockBlob server ECAcc (ama/488E)
GET H2	200	ellipsiswhite0ad43084800fd8b50a2576b5173746fe.png static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/	207 B 471 B	206ms 124ms	Image image/png	51.120.91.151 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/ellipsiswhite0ad43084800fd8b50a2576b5173746fe.png Requested by Host: c.4qw.nl URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.120.91.151 Oslo, Norway, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash 2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1;mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers strict-transport-security max-age=31536000;includeSubDomains etag "654a257f-cf" x-content-type-options nosniff referrer-policy no-referrer-when-downgrade accept-ranges bytes content-length 207 date Sun, 27 Oct 2024 01:20:40 GMT x-xss-protection 1;mode=block content-type image/png last-modified Tue, 07 Nov 2023 11:54:39 GMT server nginx x-frame-options DENY
GET H2	200	ellipsisgrey5bc252567ef56db648207d9c36a9d004.png static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/	262 B 526 B	206ms 125ms	Image image/png	51.120.91.151 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/ellipsisgrey5bc252567ef56db648207d9c36a9d004.png Requested by Host: c.4qw.nl URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.120.91.151 Oslo, Norway, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash 280eeeba7da255e0fbe039cadb63aede300d0c68a5c322035b89d39b12af8916 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1;mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers strict-transport-security max-age=31536000;includeSubDomains etag "654a257f-106" x-content-type-options nosniff referrer-policy no-referrer-when-downgrade accept-ranges bytes content-length 262 date Sun, 27 Oct 2024 01:20:40 GMT x-xss-protection 1;mode=block content-type image/png last-modified Tue, 07 Nov 2023 11:54:39 GMT server nginx x-frame-options DENY
GET DATA	200 OK	truncated /	21 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3c216a1bf5a0af4e820b08cb8b5169ed539f59a653572e808d98d8375aa32620 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/gif
GET H2	200	jquery-3.4.1.min.js Show response code.jquery.com/	86 KB 30 KB	57ms 16ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.4.1.min.js Requested by Host: c.4qw.nl URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://c.4qw.nl Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers content-encoding gzip etag W/"28feccc0-15851" age 2226402 x-cache HIT, HIT date Sun, 27 Oct 2024 01:20:40 GMT content-type application/javascript; charset=utf-8 last-modified Fri, 18 Oct 1991 12:00:00 GMT x-cache-hits 121864, 16808 x-served-by cache-lga21965-LGA, cache-ams21081-AMS vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=604800 x-timer S1729992041.796299,VS0,VE0 cross-origin-resource-policy cross-origin via 1.1 varnish, 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 30638 server nginx
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	124ms 18ms	Image image/svg+xml	2620:1ec:bdf::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: static.securepractice.co URL: https://static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/styles.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://static.securepractice.co/phishing/bd798dad09a78a85e124b382816e71d13b3d77ea/styles.css Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8D7B0071D86E386 x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Sun, 27 Oct 2024 01:20:41 GMT content-type image/svg+xml last-modified Wed, 12 Feb 2020 22:01:30 GMT cache-control public, max-age=31536000 x-ms-request-id c6315062-b01e-006d-2f84-1d48b0000000 accept-ranges bytes access-control-allow-origin * content-length 673 x-azure-ref 20241027T012041Z-16f99b99587pn4xwwgakx8v9un0000000nng00000000bck5 x-ms-blob-type BlockBlob
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msftauth.net/ests/2.1/content/images/	17 KB 17 KB	21ms 20ms	Other image/x-icon	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/48E4) / Resource Hash 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Response headers content-md5 EuPayFgGHQiAI7K9SOL6lg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding x-ms-lease-status unlocked x-ms-version 2009-09-19 etag 0x8D641014D44D8FD age 506755 x-cache HIT date Sun, 27 Oct 2024 01:20:41 GMT content-type image/x-icon last-modified Fri, 02 Nov 2018 20:25:16 GMT cache-control public, max-age=604800 x-ms-request-id 30ec4621-801e-00db-1d72-23475a000000 accept-ranges bytes access-control-allow-origin * content-length 17174 x-ms-blob-type BlockBlob server ECAcc (ama/48E4)

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getUrlParameter function| setCookie function| getCookie object| regex function| detetch function| isEdge

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://c.4qw.nl/oQKaxIb913oL6Mm0bxTblHDc5viwbxfR Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
c.4qw.nl
code.jquery.com
static.securepractice.co
2606:2800:233:1cb7:261b:1f9c:2074:3c
2620:1ec:bdf::45
2a04:4e42:200::649
45.154.232.28
51.120.91.151
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1a64eae39f6802f71f6c400c66d1dd01edc45fd2a42929f09b2b53283070b757
280eeeba7da255e0fbe039cadb63aede300d0c68a5c322035b89d39b12af8916
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3c216a1bf5a0af4e820b08cb8b5169ed539f59a653572e808d98d8375aa32620
6441129aa6be6b781521e3efbb00dbb24a54426c047d9570127f47852e1d3051
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21