urlscan.io logo urlscan.io
SecurityTrails logo

mandeskdhkalas.officialcountdown27.com Open in urlscan Pro
194.233.171.161  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://action.azurecomm.net/api/a/c?r=AIAACKFE6RTOKQKYC25PNZL6J4IOLJBGRU6J4QWU5KX35WYJC4H6TLU3BXTYRD7EPST3FHSYLPFEYAF2LACQUX...
Effective URL: https://mandeskdhkalas.officialcountdown27.com/?menmount=matthias.hentzen@hengeler.com
Submission: On January 24 via manual from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 2 HTTP transactions. The main IP is 194.233.171.161, located in Frankfurt am Main, Germany and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is mandeskdhkalas.officialcountdown27.com.
TLS certificate: Issued by R3 on January 10th 2024. Valid for: 3 months.
This is the only time mandeskdhkalas.officialcountdown27.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 20.85.207.172 8075 (MICROSOFT...)
1 1 159.26.124.245 13900 (CBN)
1 192.185.92.186 19871 (NETWORK-S...)
1 194.233.171.161 63949 (AKAMAI-LI...)
2 3
Apex Domain
Subdomains		 Transfer
1 officialcountdown27.com
mandeskdhkalas.officialcountdown27.com
132 KB
1 tcrmultispecialityhospital.in
tcrmultispecialityhospital.in
137 B
1 cbn.com
mailings.vb.cbn.com
463 B
1 azurecomm.net
action.azurecomm.net — Cisco Umbrella Rank: 213529
529 B
2 4

This site contains no links.

Subject Issuer Validity Valid
*.tcrmultispecialityhospital.in
R3		 2024-01-20 -
2024-04-19		 3 months crt.sh
officialcountdown27.com
R3		 2024-01-10 -
2024-04-09		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://mandeskdhkalas.officialcountdown27.com/?menmount=matthias.hentzen@hengeler.com
Frame ID: 3AB9E4311E4CBE712171E2FD9AB3E189
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

reCAPTCHA

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

132 kB
Transfer

364 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://action.azurecomm.net/api/a/c?r=AIAACKFE6RTOKQKYC25PNZL6J4IOLJBGRU6J4QWU5KX35WYJC4H6TLU3BXTYRD7EPST3FHSYLPFEYAF2LACQUXYIR2535N4OYNPRDWJ5XLGWBG5JIB5OYYPGMS7KISK5WTZW5EDBTWGNZPVS5T2QTYYMYT2W24ANN5RXY333THAL6UPVKS6LEQ56F6Q3VZH5UN7TKFLRT45ODCH5FOODUH5BGVKBOUQDMHQTHKBEVAINW45RCSMKRMJCL2NGBTOXC6A7E6OR7Q6ECO263HIVE4WFXSCW5GQJTJL34RA2NJJCCCMC3L56RZ4SWBE4IRYQB4FOUAOLCIZOXORCAHV3H6XNQ7PIVBKDXADDSAWZUZF5OSVESQOMCE2CKKMIBAHM65GQ6O2YLRV7KEVZOTQBWFICHX7AH4JRIR4ZL6QQ5Y574TGWBHGNQB4P2APOJ5V5QJ5UX7FMZKJMZYSPDB3JBOKDNQLE7A44IUHFNM4LYTMPXIJJPN6M6BCT4BBXS4G4SAOL2QFIKHHSAQRLPAOTWGA4QBP3ADXCZFANNHPAXGAOMKUJGNFG3YNFCIBR5XJFFEJ5BPVYH54F46TMZUX3MX26TXFXNSQS7KNHLWBVVV3I6PVTDJMAOHNQFNLZVBBFUSXNI7RG7Q6RINEC6EZPTS7XKIL3RHTPOWAON4CM4XOUSEWC4TU2U6ZIG5IOC27U4VECZDEHZI5AAZUCL5VPBJJSFK2PUJKUSKOMERCA3VLDT74R56KNUQV2LDM4IRKNM5BAWDOJQAOYQNGD6TGTHTZD6JCAXGOQVCAULCDGKJFWLHPFP3KDRGQ5&d=AIAADIIBBOICXF4B7KEUL4CZAUB5MOAPTIZ63D7YCJR6QEVOJZEMUPAYE7ZAJIB4IEFPQEQNMGQXUBODC6GRGUVAC43Q3P7LXPASNR47FSCRAMATU45UA43BDRZG6NM6ERF2IFEHHPMMFNTTKOCWI5HAD6HV4MFXQLULEAYUDTUZUA55QRU7CDN2VBGXPRZPV3HA3IQLHJSA3FROTE3EZSQFWHHXFNMIDPCKNCVRABXAYM7XRPUV4ZQWBCUGNKQSGYPVP6NX22WXBJDDPEBFGIRK7CUFFZQ&url=ZZHBbqMwFEX/JrsBmyYddaRopg24LQqeQCGAd2Bb4MTPsYJbCl9fOlnO6khncfXevb1z9pfvQ6O0Mt3gfbQeb43HL+C7a8PPv91k5ZZrxc8raZTYspLMhzyCtqKWhegzBoKbMn2IAfdN+WlbEP98EiaYnh7x4jW/oz0Ljjc/FzgJH4E9E1SXcc9vHtG5G5Mdm1kV27ocH5K8XtO8C2j+Cqy8ZbMQ39dlhmkerUVAlCiexvaOor0RHxyykcNx5tPm1AYIREU1B30+FDFJzunmb/S63ufpmJ4SR0MSZW94RxEj+5w8Z6dsl+TRnBbFhk4M1VVsWJV93wUMxuW341q8xP2hwLh9yawAMjUlQaxY8t9qiLvtdrVaBSj4uaBfKh2WTh2/wrt2arCSq0YrN/WXwSrXaE8Z3x/tD2W4fhdy8O0FLssGRkhY4FyvmsHrpXGzNP+JPws7qeX1e6Uv HTTP 302
  • http://mailings.vb.cbn.com/track?type=click&enid=ZWFzPTEmbXNpZD0xJmF1aWQ9Jm1haWxpbmdpZD0xMDM1NjA1Jm1lc3NhZ2VpZD0xMzU1MDAmZGF0YWJhc2VpZD00NzgwMCZzZXJpYWw9MTY4NTg2NTImZW1haWxpZD16YWR1NTE4d2FidUBwb3N0LndvcmRwcmVzcy5jb20mdXNlcmlkPUJFMkQ5OEI4LTQwQjMtNDFERS1CN0ZFLTFGRjRCMTEzQUU5NyZ0YXJnZXRpZD0mZmw9JmV4dHJhPU11bHRpdmFyaWF0ZUlkPSYmJg==&&&2027&&&https://tcrmultispecialityhospital.in//wp-includes/pomo/mandem/matthias.hentzen/matthias.hentzen@hengeler.com HTTP 302
  • https://tcrmultispecialityhospital.in//wp-includes/pomo/mandem/matthias.hentzen/matthias.hentzen@hengeler.com?cbnrd=true

2 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
matthias.hentzen@hengeler.com
tcrmultispecialityhospital.in//wp-includes/pomo/mandem/matthias.hentzen/
Redirect Chain
  • https://action.azurecomm.net/api/a/c?r=AIAACKFE6RTOKQKYC25PNZL6J4IOLJBGRU6J4QWU5KX35WYJC4H6TLU3BXTYRD7EPST3FHSYLPFEYAF2LACQUXYIR2535N4OYNPRDWJ5XLGWBG5JIB5OYYPGMS7KISK5WTZW5EDBTWGNZPVS5T2QTYYMYT2W24...
  • http://mailings.vb.cbn.com/track?type=click&enid=ZWFzPTEmbXNpZD0xJmF1aWQ9Jm1haWxpbmdpZD0xMDM1NjA1Jm1lc3NhZ2VpZD0xMzU1MDAmZGF0YWJhc2VpZD00NzgwMCZzZXJpYWw9MTY4NTg2NTImZW1haWxpZD16YWR1NTE4d2FidUBwb3N0...
  • https://tcrmultispecialityhospital.in//wp-includes/pomo/mandem/matthias.hentzen/matthias.hentzen@hengeler.com?cbnrd=true
0
137 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tcrmultispecialityhospital.in//wp-includes/pomo/mandem/matthias.hentzen/matthias.hentzen@hengeler.com?cbnrd=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.92.186 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-92-186.unifiedlayer.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 24 Jan 2024 08:06:55 GMT
refresh
0;url=https://mandeskdhkalas.officialcountdown27.com/?menmount=matthias.hentzen@hengeler.com
server
Apache

Redirect headers

Connection
keep-alive
Content-Length
237
Content-Type
text/html; charset=utf-8
Date
Wed, 24 Jan 2024 08:06:54 GMT
Location
https://tcrmultispecialityhospital.in//wp-includes/pomo/mandem/matthias.hentzen/matthias.hentzen@hengeler.com?cbnrd=true
Server
Microsoft-IIS/10.0
Vary
Accept-Encoding
X-Powered-By
ASP.NET
Primary Request /
mandeskdhkalas.officialcountdown27.com/ 		324 KB
132 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mandeskdhkalas.officialcountdown27.com/?menmount=matthias.hentzen@hengeler.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
194.233.171.161 Frankfurt am Main, Germany, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
194-233-171-161.ip.linodeusercontent.com
Software
nginx /
Resource Hash
db9033a8aed24b3ee8201355d48bb09d7cd1cbd3bfed73c65dfc318a3f552e31

Request headers

Referer
https://tcrmultispecialityhospital.in/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 24 Jan 2024 08:06:55 GMT
server
nginx
vary
Accept-Encoding
truncated
/ 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| a0_0x36cd function| a0_0x3766 function| onCheckBoxChange

1 Cookies

Domain/Path Name / Value
mailings.vb.cbn.com/ Name: BIGipServermailings.vb.cbn.com.app~mailings.vb.cbn.com_pool
Value: 1736206346.32287.0000