locomonstruo.com
Open in
urlscan Pro
162.215.248.85
Malicious Activity!
Public Scan
Effective URL: http://locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/
Submission: On October 15 via manual from US
Summary
This is the only time locomonstruo.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AWS (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 13 | 162.215.248.85 162.215.248.85 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY) | |
9 | 3 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-215-248-85.unifiedlayer.com
locomonstruo.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
locomonstruo.com
5 redirects
locomonstruo.com |
150 KB |
1 |
imgur.com
i.imgur.com |
34 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
13 | locomonstruo.com |
5 redirects
locomonstruo.com
|
1 | i.imgur.com |
locomonstruo.com
|
9 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/
Frame ID: CC85A09B9FC4DFAB0809867D790D19A2
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://locomonstruo.com/owasp
HTTP 301
http://locomonstruo.com/owasp/ Page URL
-
http://locomonstruo.com/contract
HTTP 301
http://locomonstruo.com/contract/ HTTP 302
http://locomonstruo.com/sdk HTTP 301
http://locomonstruo.com/sdk/ HTTP 302
http://locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://locomonstruo.com/owasp
HTTP 301
http://locomonstruo.com/owasp/ Page URL
-
http://locomonstruo.com/contract
HTTP 301
http://locomonstruo.com/contract/ HTTP 302
http://locomonstruo.com/sdk HTTP 301
http://locomonstruo.com/sdk/ HTTP 302
http://locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://locomonstruo.com/owasp HTTP 301
- http://locomonstruo.com/owasp/
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
locomonstruo.com/owasp/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7JaytmJ.gif
i.imgur.com/ |
34 KB 34 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/ Redirect Chain
|
23 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
composent.css
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/artisan/ |
388 KB 101 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
parametre.css
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/artisan/ |
4 KB 992 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/artisan/ |
22 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wellpapers.jpg
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/image/ |
32 KB 32 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id.png
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/image/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
511 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
down.svg
locomonstruo.com/sdk/605754a1308a2bdf98ccdc9e2b21f3cd/image/ |
226 B 471 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AWS (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes number| currentYear0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
i.imgur.com
locomonstruo.com
151.101.112.193
162.215.248.85
095a716973efa65689c85d85b231e0acbba9789870424b963d514a7cfdb563bc
29a99902773f99382feeeea8f234502538d5a2ade52556ab1d9f5a60393d9f60
50e56bd81afcef466f4155d50c7225da52d1f0594357c32a13762afa69947b73
79b0b1fa95e63846bff63536931f62425fcbe06f9c6f7a6f9a632ca095fd8b79
8d82b1e7faa7f2cdecd63fbe12c5a878d88a70bf383a552c1e66f03d2b795f38
a81161095dde51d624477db809c8cc3af98a71e41d5f29991f3b1dd7b289448c
c6766c3a141781ab316439f48fa6ff5658bbdc5b6e78ca313e1e42d0d46493a6
c6847969733d641b045a9fb414950841bccbdb408dae541ee7ae5c9333ed380b
e89be6bba4cc671c3fe91a5b721d263f88c1e3d1e1bbcccbb035fd7b524f6aa7
f64618697e827903d68c5a8029c2aa3bf38b0ac51b7fa473250401fd173f2cc3