urlscan.io logo urlscan.io
SecurityTrails logo

deck-shared-2023.us-ord-1.linodeobjects.com Open in urlscan Pro
2600:3c06::f03c:93ff:fe54:2fd2  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://r20.rs6.net/tn.jsp?f=001iyhJ9w3TeQwD6Bxo3Vnvf697OL-V7n5sY_mtxFUXoTPUoyErCr3GPMhKzAauLYMm20iNeZLivbK3VAqAC6Wj...
Effective URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Submission: On December 07 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2600:3c06::f03c:93ff:fe54:2fd2, located in Chicago, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is deck-shared-2023.us-ord-1.linodeobjects.com.
TLS certificate: Issued by R3 on October 2nd 2023. Valid for: 3 months.
This is the only time deck-shared-2023.us-ord-1.linodeobjects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 208.75.122.11 40444 (ASN-CC)
1 2 103.253.43.4 133398 (TELE-AS T...)
1 2600:3c06::f0... 63949 (AKAMAI-LI...)
1 212.70.149.197 12615 (GCN-AS GC...)
3 4
Apex Domain
Subdomains		 Transfer
2 sensualite.art.br
docapicvr.sensualite.art.br
751 B
1 officialcountdown9.com
ruthowlevtui.officialcountdown9.com
132 KB
1 linodeobjects.com
deck-shared-2023.us-ord-1.linodeobjects.com
166 KB
1 rs6.net
r20.rs6.net — Cisco Umbrella Rank: 6954
369 B
3 4
Domain Requested by
2 docapicvr.sensualite.art.br 1 redirects
1 ruthowlevtui.officialcountdown9.com deck-shared-2023.us-ord-1.linodeobjects.com
1 deck-shared-2023.us-ord-1.linodeobjects.com
1 r20.rs6.net 1 redirects
3 4

This site contains no links.

Subject Issuer Validity Valid
docapicvr.sensualite.art.br
R3		 2023-12-07 -
2024-03-06		 3 months crt.sh
us-ord-1.linodeobjects.com
R3		 2023-10-02 -
2023-12-31		 3 months crt.sh
officialcountdown9.com
R3		 2023-12-06 -
2024-03-05		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Frame ID: A1C531A85DCAF86CE157ECA0659376C5
Requests: 2 HTTP requests in this frame

Frame: https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Frame ID: 7AA53EF8734B9CE0ED97C87F7E80FC28
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://r20.rs6.net/tn.jsp?f=001iyhJ9w3TeQwD6Bxo3Vnvf697OL-V7n5sY_mtxFUXoTPUoyErCr3GPMhKzAauLYMm... HTTP 302
    https://docapicvr.sensualite.art.br/privacy/policy/ Page URL
  2. https://docapicvr.sensualite.art.br/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

299 kB
Transfer

531 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://r20.rs6.net/tn.jsp?f=001iyhJ9w3TeQwD6Bxo3Vnvf697OL-V7n5sY_mtxFUXoTPUoyErCr3GPMhKzAauLYMm20iNeZLivbK3VAqAC6Wjz4fCyJ2AknoNSdv_gOnY7sbTXHGrI4zNrVo7Wt7hcztxyvoEvc0vKkvHPko_ZqhNyy4xhd1P1FMovQtIQMf1OsdMGnEaeKkA2TrcnwoapfCD HTTP 302
    https://docapicvr.sensualite.art.br/privacy/policy/ Page URL
  2. https://docapicvr.sensualite.art.br/index.php?continue2 HTTP 302
    https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://r20.rs6.net/tn.jsp?f=001iyhJ9w3TeQwD6Bxo3Vnvf697OL-V7n5sY_mtxFUXoTPUoyErCr3GPMhKzAauLYMm20iNeZLivbK3VAqAC6Wjz4fCyJ2AknoNSdv_gOnY7sbTXHGrI4zNrVo7Wt7hcztxyvoEvc0vKkvHPko_ZqhNyy4xhd1P1FMovQtIQMf1OsdMGnEaeKkA2TrcnwoapfCD HTTP 302
  • https://docapicvr.sensualite.art.br/privacy/policy/

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
docapicvr.sensualite.art.br/privacy/policy/
Redirect Chain
  • https://r20.rs6.net/tn.jsp?f=001iyhJ9w3TeQwD6Bxo3Vnvf697OL-V7n5sY_mtxFUXoTPUoyErCr3GPMhKzAauLYMm20iNeZLivbK3VAqAC6Wjz4fCyJ2AknoNSdv_gOnY7sbTXHGrI4zNrVo7Wt7hcztxyvoEvc0vKkvHPko_ZqhNyy4xhd1P1FMovQtIQ...
  • https://docapicvr.sensualite.art.br/privacy/policy/
1 KB
678 B 		Document
General
Check archive.org
Download Go to
Full URL
https://docapicvr.sensualite.art.br/privacy/policy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
103.253.43.4 , Hong Kong, ASN133398 (TELE-AS Tele Asia Limited, HK),
Reverse DNS
slot9.ge-re.com
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Thu, 07 Dec 2023 18:29:29 GMT
server
Apache
vary
Accept-Encoding

Redirect headers

Cache-Control
private, no-cache, no-store, max-age=0, must-revalidate, no-cache="Set-Cookie"
Connection
close
Content-Length
0
Content-Type
text/html;charset=ISO-8859-1
Date
Thu, 07 Dec 2023 18:29:28 GMT
Location
https://docapicvr.sensualite.art.br/privacy/policy/
P3P
CP="CAO DSP TAIa OUR NOR UNI"
Pragma
no-cache
Server
Apache
Primary Request DecGrace.html
deck-shared-2023.us-ord-1.linodeobjects.com/
Redirect Chain
  • https://docapicvr.sensualite.art.br/index.php?continue2
  • https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
166 KB
166 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:3c06::f03c:93ff:fe54:2fd2 Chicago, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software
/
Resource Hash
4ded796f8719ca509cebe2f051ccef7ea35cd0b50efd4f7a90840696909768b4

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://docapicvr.sensualite.art.br
Referer
https://docapicvr.sensualite.art.br/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
170036
Content-Type
text/html
Date
Thu, 07 Dec 2023 18:29:30 GMT
ETag
"e2d6610a57b4d64a69ed28273355cd16"
Last-Modified
Wed, 06 Dec 2023 16:09:01 GMT
x-amz-request-id
tx000002a7098066257f435-0065720f0a-5ede16-default
x-rgw-object-type
Normal

Redirect headers

content-encoding
gzip
content-length
581
content-type
text/html; charset=UTF-8
date
Thu, 07 Dec 2023 18:29:29 GMT
location
https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
server
Apache
vary
Accept-Encoding
/
ruthowlevtui.officialcountdown9.com/ Frame 7AA5 		324 KB
132 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ruthowlevtui.officialcountdown9.com/?8Y6v=ojK
Requested by
Host: deck-shared-2023.us-ord-1.linodeobjects.com
URL: https://deck-shared-2023.us-ord-1.linodeobjects.com/DecGrace.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
212.70.149.197 Dimitrovgrad, Bulgaria, ASN12615 (GCN-AS GCN AD - Sofia, Bulgaria, BG),
Reverse DNS
Software
nginx /
Resource Hash
3319c701c004b976d82fe9454b50b105de0c56b7008e97ddfc269bed0334fced

Request headers

Referer
https://deck-shared-2023.us-ord-1.linodeobjects.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 07 Dec 2023 18:29:31 GMT
server
nginx
vary
Accept-Encoding
truncated
/ Frame 7AA5 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ Frame 7AA5 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| a0_0x375d function| a0_0xe541

0 Cookies