urlscan.io logo urlscan.io
SecurityTrails logo

cs2480.mojohost.com Open in urlscan Pro
64.59.123.4  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://cs2480.mojohost.com/
Effective URL: https://cs2480.mojohost.com/license.php
Submission Tags: phishingrod
Submission: On April 27 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 64.59.123.4, located in United States and belongs to MOJOHOST, US. The main domain is cs2480.mojohost.com.
TLS certificate: Issued by R3 on February 27th 2023. Valid for: 3 months.
This is the only time cs2480.mojohost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 64.59.123.4 27589 (MOJOHOST)
6 151.101.130.137 54113 (FASTLY)
1 162.247.243.29 54113 (FASTLY)
8 3
Apex Domain
Subdomains		 Transfer
6 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 776
17 KB
2 mojohost.com
cs2480.mojohost.com
30 KB
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 477
8 3
Domain Requested by
6 js-agent.newrelic.com cs2480.mojohost.com
2 cs2480.mojohost.com 1 redirects
1 bam.nr-data.net js-agent.newrelic.com
8 3

This site contains links to these domains. Also see Links.

Domain
nats.kickasspays.com
Subject Issuer Validity Valid
nats.kickasspays.com
R3		 2023-02-27 -
2023-05-28		 3 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2		 2023-04-13 -
2024-05-14		 a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-11-18 -
2023-12-19		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cs2480.mojohost.com/license.php
Frame ID: 9A1223BEFE1910EC962FD0676663D357
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

NATS - License Information

Page URL History Show full URLs

  1. https://cs2480.mojohost.com/ HTTP 302
    https://cs2480.mojohost.com/license.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

47 kB
Transfer

68 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cs2480.mojohost.com/ HTTP 302
    https://cs2480.mojohost.com/license.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request license.php
cs2480.mojohost.com/
Redirect Chain
  • https://cs2480.mojohost.com/
  • https://cs2480.mojohost.com/license.php
30 KB
30 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cs2480.mojohost.com/license.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
64.59.123.4 , United States, ASN27589 (MOJOHOST, US),
Reverse DNS
cs2480.mojohost.com
Software
Apache / PHP/5.6.32
Resource Hash
aea11f561cea9fdbee81ce8b2075bc533ca9367360f808dc78beb394012c909a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 27 Apr 2023 04:55:19 GMT
Keep-Alive
timeout=5, max=99
Server
Apache
Transfer-Encoding
chunked
X-Powered-By
PHP/5.6.32

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Thu, 27 Apr 2023 04:55:18 GMT
Keep-Alive
timeout=5, max=100
Location
/license.php
Server
Apache
X-Powered-By
PHP/5.6.32
async-api.6c072bf7-1.230.0.min.js
js-agent.newrelic.com/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/async-api.6c072bf7-1.230.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b6a613ee9108f1d682a41dbf67bf48474111f09ae1b3f9610371f9e9ab310ba1
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
rWoTEmf9ai1ouwS3ToIE043y.yHgDQor
content-encoding
gzip
via
1.1 varnish
date
Thu, 27 Apr 2023 04:55:19 GMT
strict-transport-security
max-age=300
x-amz-request-id
YVRRHVHR4D7K46HB
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1210
x-amz-id-2
avgg89H5rk5aYtPbeIrRMFjRlGj6QDlTTkyzMxN+Ydis79kzRrtTJWtwJCds8e0JBairb0jeVpU=
x-served-by
cache-fra-eddf8230106-FRA
last-modified
Mon, 10 Apr 2023 17:14:03 GMT
server
AmazonS3
x-timer
S1682571319.251853,VS0,VE0
etag
"a21c5f6b7cdfc3dedc83c2262a56d7cd"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4142
lazy-loader.ff971c03-1.230.0.min.js
js-agent.newrelic.com/ 		928 B
905 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/lazy-loader.ff971c03-1.230.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
16a2fcf59eb7e6f04fe15ad2b13cff5fd8813a3267e7f4c57fdf16d35470f5d8
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
moNPj5M8w_3ogm1Lwe_Y7qB7rdPjSB51
content-encoding
gzip
via
1.1 varnish
date
Thu, 27 Apr 2023 04:55:19 GMT
strict-transport-security
max-age=300
x-amz-request-id
YVRXB8NHMHBMJ3AV
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
414
x-amz-id-2
m4ym4ZwaIycficb98m5tCcgQwnZ9/YUPIP0mTNjPSpgqOFhazVhi0u2nnpvDeCTmB4M5tJaRtaI=
x-served-by
cache-fra-eddf8230106-FRA
last-modified
Mon, 10 Apr 2023 17:14:03 GMT
server
AmazonS3
x-timer
S1682571319.251675,VS0,VE0
etag
"5c71e603fdc4b5e7eb31a10d4bf90768"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4163
862.9f44b58b-1.230.0.min.js
js-agent.newrelic.com/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/862.9f44b58b-1.230.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f6859eb8f0f96a1493a47e0cab0144e6dba46b3c492042660dd5b02b6cec167b
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
xRkMl8fpKmpkb8xSPDFwInKFtxpiLeiU
content-encoding
gzip
via
1.1 varnish
date
Thu, 27 Apr 2023 04:55:19 GMT
strict-transport-security
max-age=300
x-amz-request-id
YVRH1ZZT8CA99JEH
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3583
x-amz-id-2
Iw6BgJ5Ue2KFZ/eigGTsOO9GAeaucfq6gfGys5wnALjyKYcmi2mnyVFT79I/DVRHp6vLSnSkLNw=
x-served-by
cache-fra-eddf8230106-FRA
last-modified
Mon, 10 Apr 2023 17:14:03 GMT
server
AmazonS3
x-timer
S1682571319.261924,VS0,VE0
etag
"c4e5d826698f6566f247167a7565c832"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4103
page_view_event-aggregate.75812140-1.230.0.min.js
js-agent.newrelic.com/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/page_view_event-aggregate.75812140-1.230.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3c124e8d5cc4a724c0cc1650bbb0c64f90f6cd00807ec75353423d6cb0880390
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
7bfBjgjP9vhwGKyYNbxNdw69c7w6yepO
content-encoding
gzip
via
1.1 varnish
date
Thu, 27 Apr 2023 04:55:19 GMT
strict-transport-security
max-age=300
x-amz-request-id
YVRHSAD1J400YFYV
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3954
x-amz-id-2
3tPPvzU39gHKEnONrN6/9fvuU0BpGpfc3qOYprwhXfEabcrI8m7NefBck8hvAWf20OWH2WxepmI=
x-served-by
cache-fra-eddf8230106-FRA
last-modified
Mon, 10 Apr 2023 17:14:03 GMT
server
AmazonS3
x-timer
S1682571319.261695,VS0,VE0
etag
"a4978f5fb64e86334a1dbb282220c851"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4087
page_view_timing-aggregate.9590bdab-1.230.0.min.js
js-agent.newrelic.com/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/page_view_timing-aggregate.9590bdab-1.230.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ffa12a66b77bcb1fc0cc691ed439b877e084a91bd9f5537e651306fcf6246049
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
Fq.2FKw4tsY9sm_ft7J67YTmHBEmGUpk
content-encoding
gzip
via
1.1 varnish
date
Thu, 27 Apr 2023 04:55:19 GMT
strict-transport-security
max-age=300
x-amz-request-id
YVRGD9X1F94WQ9BY
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4624
x-amz-id-2
cOG8euC06r/w65i+XwFhZY+QhFkrZcZ5daiYUTwbFYDxQs2WzzTQSfhlT8L9ZOP6b1izPVl1zGM=
x-served-by
cache-fra-eddf8230106-FRA
last-modified
Mon, 10 Apr 2023 17:14:03 GMT
server
AmazonS3
x-timer
S1682571319.261663,VS0,VE0
etag
"2357140ba2b3c410d01d12937c6269d8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4102
metrics-aggregate.20a08804-1.230.0.min.js
js-agent.newrelic.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/metrics-aggregate.20a08804-1.230.0.min.js
Requested by
Host: cs2480.mojohost.com
URL: https://cs2480.mojohost.com/license.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9b1fb531c79eb8ce9a6e9f833b9de4a43be31458e9a999dcced9147e0176d601
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
Ue3teI4xiVp879tlCKhGPbDuwtTRksP9
content-encoding
gzip
via
1.1 varnish
date
Thu, 27 Apr 2023 04:55:19 GMT
strict-transport-security
max-age=300
x-amz-request-id
YVRNNA1WK7C2FNNV
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1593
x-amz-id-2
Gemm/DssGl2WQezeypri1eW17aoNV3zHu+zakIi9taf894xBLOuhJiKmuf7g+4JxUOYDtxA0GSM=
x-served-by
cache-fra-eddf8230106-FRA
last-modified
Mon, 10 Apr 2023 17:14:03 GMT
server
AmazonS3
x-timer
S1682571319.261653,VS0,VE0
etag
"2b4287467d6e1c411110556d75fe617a"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
4071
b42ac20c27
bam.nr-data.net/1/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/b42ac20c27?a=55516769&v=1.230.0&to=Z1cHZkZWDRVQVRJQX14dMEBdGA8PUlMISlUeQg1C&rst=1032&ck=0&s=f59be8051b1abb81&ref=https://cs2480.mojohost.com/license.php&ap=53&be=918&fe=69&dc=67&perf=%7B%22timing%22:%7B%22of%22:1682571318242,%22n%22:0,%22r%22:0,%22re%22:740,%22f%22:740,%22dn%22:740,%22dne%22:740,%22c%22:740,%22ce%22:740,%22rq%22:741,%22rp%22:917,%22rpe%22:974,%22dl%22:919,%22di%22:984,%22ds%22:984,%22de%22:984,%22dc%22:984,%22l%22:984,%22le%22:986%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=987&fcp=987&at=SxAEEA5MHhs%3D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/async-api.6c072bf7-1.230.0.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cs2480.mojohost.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
cache-fra-eddf8230070-FRA
date
Thu, 27 Apr 2023 04:55:18 GMT
Connection
keep-alive
Content-Length
2
content-type
application/json; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://bam.nr-data.net/1/b42ac20c27?a=55516769&v=1.230.0&to=Z1cHZkZWDRVQVRJQX14dMEBdGA8PUlMISlUeQg1C&rst=1032&ck=0&s=f59be8051b1abb81&ref=https://cs2480.mojohost.com/license.php&ap=53&be=918&fe=69&dc=67&perf=%7B%22timing%22:%7B%22of%22:1682571318242,%22n%22:0,%22r%22:0,%22re%22:740,%22f%22:740,%22dn%22:740,%22dne%22:740,%22c%22:740,%22ce%22:740,%22rq%22:741,%22rp%22:917,%22rpe%22:974,%22dl%22:919,%22di%22:984,%22ds%22:984,%22de%22:984,%22dc%22:984,%22l%22:984,%22le%22:986%7D,%22navigation%22:%7B%22rc%22:1%7D%7D&fp=987&fcp=987&at=SxAEEA5MHhs%3D&jsonp=NREUM.setToken
Message:
Failed to load resource: the server responded with a status of 402 (Payment Required)