hobfuntritech-portconst-876.rj.r.appspot.com Open in urlscan Pro
2a00:1450:4001:82a::2014 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/
Effective URL:
https://hobfuntritech-portconst-876.rj.r.appspot.com/
Submission: On October 08 via manual (October 8th 2024, 5:40:13 pm UTC) from US — Scanned from DE

Summary HTTP 7 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 2a00:1450:4001:82a::2014, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is hobfuntritech-portconst-876.rj.r.appspot.com.
TLS certificate: Issued by WR2 on September 24th 2024. Valid for: 3 months.

This is the only time hobfuntritech-portconst-876.rj.r.appspot.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:1450:400... 2a00:1450:4001:827::2014	15169 (GOOGLE) (GOOGLE)
1	2a02:ec80:300... 2a02:ec80:300:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
2	2a00:1450:400... 2a00:1450:4001:82a::2014	15169 (GOOGLE) (GOOGLE)
2	2600:9000:205... 2600:9000:2057:b800:1e:5c56:d400:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:29:1... 2620:1ec:29:1::64	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	6

1 2a00:1450:4001:827::2014 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:ec80:300:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2014 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

hobfuntritech-portconst-876.rj.r.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2057:b800:1e:5c56:d400:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.wixstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:29:1::64 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

images.ecomm.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	appspot.com svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com hobfuntritech-portconst-876.rj.r.appspot.com	10 KB
2	wixstatic.com static.wixstatic.com — Cisco Umbrella Rank: 6375	30 KB
1	microsoft.com images.ecomm.microsoft.com — Cisco Umbrella Rank: 24823	3 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 3371	69 KB
7	4

	Domain	Requested by
2	static.wixstatic.com	hobfuntritech-portconst-876.rj.r.appspot.com
2	hobfuntritech-portconst-876.rj.r.appspot.com
1	images.ecomm.microsoft.com	hobfuntritech-portconst-876.rj.r.appspot.com
1	upload.wikimedia.org	svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com
1	svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com
7	5

This site contains links to these domains. Also see Links.

Domain
login.urggrougpllcdocumetnonline.icu

Subject Issuer	Validity	Valid
*.appspot.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2024-09-26` - `2025-10-17`	a year	crt.sh
*.wixstatic.com R11	`2024-09-09` - `2024-12-08`	3 months	crt.sh
images.ecomm.microsoft.com Microsoft Azure RSA TLS Issuing CA 03	`2024-08-15` - `2025-08-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hobfuntritech-portconst-876.rj.r.appspot.com/
Frame ID: 7877E6CECE838854E2BCE94B07040CB6
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

New Document Received

Page URL History Show full URLs

https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/ Page URL
https://hobfuntritech-portconst-876.rj.r.appspot.com/ Page URL

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

6
IPs

2
Countries

113 kB
Transfer

152 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://login.urggrougpllcdocumetnonline.icu/siwMuGAa
Title: ACCESS MICROSOFT SHAREPOINT FOLDER

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/ Page URL
https://hobfuntritech-portconst-876.rj.r.appspot.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/ 48 KB
9 KB 688ms
327ms Document
text/html 2a00:1450:4001:827::2014
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 1a902a275b600a5f09120802b62723a3229ccd3d1ebb38bf0d55cbe4671c02c9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=600
content-encoding: gzip
content-type: text/html
date: Tue, 08 Oct 2024 17:40:09 GMT
etag: "kDyP5w"
expires: Tue, 08 Oct 2024 17:50:09 GMT
server: Google Frontend
x-cloud-trace-context: 6ed249d07a20f9fed4bd8cbde415b420

GET
H2 200 1200px-Microsoft_Office_SharePoint_%282019%E2%80%93present%29.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/e/e1/Microsoft_Office_SharePoint_%282019%E2%80%93present%29.svg/ 68 KB
69 KB 106ms
29ms Image
image/png 2a02:ec80:300:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/e/e1/Microsoft_Office_SharePoint_%282019%E2%80%93present%29.svg/1200px-Microsoft_Office_SharePoint_%282019%E2%80%93present%29.svg.png

Requested by

Host: svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com
URL: https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:ec80:300:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/9.2.5 /

Resource Hash

8fe6e5eec412b46c73de12b3df837f59e9ae1156cb86e4b1b7021f0359186e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/

Response headers

access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
etag: 54cebb5e1827d5f83b2d6449d429772f
age: 36984
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
x-content-type-options: nosniff
server-timing: cache;desc="hit-front", host;desc="cp3080"
x-cache: cp3080 hit, cp3080 hit/42
date: Tue, 08 Oct 2024 07:23:44 GMT
content-type: image/png
content-disposition: inline;filename*=UTF-8''Microsoft_Office_SharePoint_%282019%E2%80%93present%29.svg.png
last-modified: Mon, 15 Jul 2024 08:36:41 GMT
x-client-ip: 2001:1b60:1010:3:1011:6fd3:3662:304
x-cache-status: hit-front
strict-transport-security: max-age=106384710; includeSubDomains; preload
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
timing-allow-origin: *
accept-ranges: bytes
access-control-allow-origin: *
content-length: 69481
server: ATS/9.2.5

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 Primary Request / Show response
hobfuntritech-portconst-876.rj.r.appspot.com/ 2 KB
1 KB 280ms
226ms Document
text/html 2a00:1450:4001:82a::2014
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://hobfuntritech-portconst-876.rj.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 6c46e28543cb8d21292ff32e6e5c831bdc9e8cbb189a3346292abe373051b02a

Request headers

Referer: https://svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

age: 12
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=600
content-encoding: gzip
content-length: 1015
content-type: text/html
date: Tue, 08 Oct 2024 17:39:58 GMT
etag: "HAOY5A"
expires: Tue, 08 Oct 2024 17:49:58 GMT
server: Google Frontend
x-cloud-trace-context: 37f92d13c7401867a8b19cd06270c367;o=1

GET
H2 200 20d36a_e3af02c07bb44a83becc10164251f836~mv2.png
static.wixstatic.com/media/ 5 KB
5 KB 75ms
23ms Image
image/png 2600:9000:2057:b800:1e:5c56:d400:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.wixstatic.com/media/20d36a_e3af02c07bb44a83becc10164251f836~mv2.png
Requested by: Host: hobfuntritech-portconst-876.rj.r.appspot.com
URL: https://hobfuntritech-portconst-876.rj.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:b800:1e:5c56:d400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.25.3.2 /
Resource Hash: 786874cd1016bf2a6caa8042a31e8d641cdcd8b26bb51b5f18d844066e68f990

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://hobfuntritech-portconst-876.rj.r.appspot.com/

Response headers

access-control-expose-headers: Content-Length
etag: "164ed962871ec24f446d557e5e03ff7a"
age: 84122
expires: Mon, 07 Oct 2024 19:18:09 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: IXTmX9L1zzQUnsqaxP2KPV4pROtxkAGm19geH2mfbTjMe61fougsdQ==
date: Mon, 07 Oct 2024 18:18:09 GMT
content-type: image/png
last-modified: Thu, 15 Aug 2024 19:44:34 GMT
cache-control: public, max-age=15552000, immutable
timing-allow-origin: *
via: 1.1 google, 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-seen-by: gcp.us-central-1.media-router-56f88799f9-hct9k
content-length: 4694
x-amz-cf-pop: FRA6-C1
server: openresty/1.25.3.2

GET
H2 200 20d36a_d3d5942f98d246a59a04b8f7c251c413~mv2.png
static.wixstatic.com/media/ 25 KB
25 KB 75ms
24ms Image
image/png 2600:9000:2057:b800:1e:5c56:d400:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.wixstatic.com/media/20d36a_d3d5942f98d246a59a04b8f7c251c413~mv2.png
Requested by: Host: hobfuntritech-portconst-876.rj.r.appspot.com
URL: https://hobfuntritech-portconst-876.rj.r.appspot.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:b800:1e:5c56:d400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.25.3.2 /
Resource Hash: 0e1499463b51cc4c52af0b19f0a5b8c62a041a964e08f7b586c05887dbe927d7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://hobfuntritech-portconst-876.rj.r.appspot.com/

Response headers

access-control-expose-headers: Content-Length
etag: "8cb8d63e86d8a2bed9ef6972e4651cb1"
age: 84122
expires: Mon, 07 Oct 2024 19:18:09 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: LgQxkRyCpqV-Z08haIw94IMpWwv9uEGY2TRdMxUDLNAlQxsjHgY1ug==
date: Mon, 07 Oct 2024 18:18:09 GMT
content-type: image/png
last-modified: Mon, 26 Aug 2024 16:12:02 GMT
cache-control: public, max-age=15552000, immutable
timing-allow-origin: *
via: 1.1 google, 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-seen-by: gcp.us-central-1.media-router-56f88799f9-frxrk
content-length: 25221
x-amz-cf-pop: FRA6-C1
server: openresty/1.25.3.2

GET
H2 200 microsoft-2x.png
images.ecomm.microsoft.com/cdn/mediahandler/azure-emails-templates/production/shared/images/templates/shared/ 3 KB
3 KB 509ms
374ms Image
image/png 2620:1ec:29:1::64
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.ecomm.microsoft.com/cdn/mediahandler/azure-emails-templates/production/shared/images/templates/shared/microsoft-2x.png

Requested by

Host: hobfuntritech-portconst-876.rj.r.appspot.com
URL: https://hobfuntritech-portconst-876.rj.r.appspot.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:1ec:29:1::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

b2de0a72b086dc480e990a04470b7b674330945705fc37a7733a833fda971dcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://hobfuntritech-portconst-876.rj.r.appspot.com/

Response headers

x-robots-tag: noindex
etag: "0x8DCD4DDF68CC05F"
x-fd-int-roxy-purgeid: 0
x-content-type-options: nosniff
expires: Sun, 13 Oct 2024 04:43:37 GMT
x-cache: TCP_MISS
date: Tue, 08 Oct 2024 17:40:11 GMT
content-type: image/png
last-modified: Sat, 14 Sep 2024 16:54:56 GMT
vary: *
strict-transport-security: max-age=31536000
cache-control: public, max-age=385405
accept-ranges: bytes
content-length: 3025
arr-disable-session-affinity: true
x-azure-ref: 20241008T174011Z-r15dd9fcfbbbdbrp1fazfxy9sw000000082000000000020m
x-powered-by: ASP.NET

GET
H2 502 favicon.ico
hobfuntritech-portconst-876.rj.r.appspot.com/ 568 B
657 B 798ms
798ms Other
text/html 2a00:1450:4001:82a::2014
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://hobfuntritech-portconst-876.rj.r.appspot.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2014 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://hobfuntritech-portconst-876.rj.r.appspot.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 568
date: Tue, 08 Oct 2024 17:40:12 GMT
content-type: text/html
x-cloud-trace-context: c1ae657da9f909ec22ebd2d469a1a80d
server: Google Frontend

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://hobfuntritech-portconst-876.rj.r.appspot.com/favicon.ico Message: Failed to load resource: the server responded with a status of 502 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hobfuntritech-portconst-876.rj.r.appspot.com
images.ecomm.microsoft.com
static.wixstatic.com
svboxy-dot-project-ripsawoxy-polynomial.as.r.appspot.com
upload.wikimedia.org
2600:9000:2057:b800:1e:5c56:d400:93a1
2620:1ec:29:1::64
2a00:1450:4001:827::2014
2a00:1450:4001:82a::2014
2a02:ec80:300:ed1a::2:b
0e1499463b51cc4c52af0b19f0a5b8c62a041a964e08f7b586c05887dbe927d7
1a902a275b600a5f09120802b62723a3229ccd3d1ebb38bf0d55cbe4671c02c9
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6c46e28543cb8d21292ff32e6e5c831bdc9e8cbb189a3346292abe373051b02a
786874cd1016bf2a6caa8042a31e8d641cdcd8b26bb51b5f18d844066e68f990
7921a6035cc8a0981a5dee737dd3d29b150ddd48407717d3fca4b6376f2b0e70
8fe6e5eec412b46c73de12b3df837f59e9ae1156cb86e4b1b7021f0359186e81
b2de0a72b086dc480e990a04470b7b674330945705fc37a7733a833fda971dcd

hobfuntritech-portconst-876.rj.r.appspot.com Open in urlscan Pro 2a00:1450:4001:82a::2014 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

4 Domains

5 Subdomains

6 IPs

2 Countries

113 kBTransfer

152 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

hobfuntritech-portconst-876.rj.r.appspot.com Open in urlscan Pro
2a00:1450:4001:82a::2014 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

6
IPs

2
Countries

113 kB
Transfer

152 kB
Size

0
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!