lee-johnson.co.nz
Open in
urlscan Pro
185.184.154.65
Malicious Activity!
Public Scan
Effective URL: https://lee-johnson.co.nz/mn/i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkhj39048oiwo598e399693...
Submission: On May 30 via api from US — Scanned from NZ
Summary
TLS certificate: Issued by R3 on April 24th 2024. Valid for: 3 months.
This is the only time lee-johnson.co.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 185.184.154.65 185.184.154.65 | 38719 (DREAMSCAP...) (DREAMSCAPE-AS-AP Dreamscape Networks Limited) | |
2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
2 | 34.197.227.58 34.197.227.58 | 14618 (AMAZON-AES) (AMAZON-AES) | |
9 | 151.101.66.132 151.101.66.132 | 54113 (FASTLY) (FASTLY) | |
3 | 163.172.253.37 163.172.253.37 | 12876 (Online SAS) (Online SAS) | |
18 | 5 |
ASN38719 (DREAMSCAPE-AS-AP Dreamscape Networks Limited, AU)
PTR: ipb9b89a41.ipv4.syd02.ds.network
lee-johnson.co.nz |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-227-58.compute-1.amazonaws.com
pacific-iridescent-lunge.glitch.me |
ASN12876 (Online SAS, FR)
PTR: 163-172-253-37.rev.poneytelecom.eu
www.sado-sa.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
glitch.global
cdn.glitch.global — Cisco Umbrella Rank: 218303 |
134 KB |
3 |
sado-sa.com
www.sado-sa.com |
13 KB |
2 |
glitch.me
pacific-iridescent-lunge.glitch.me |
90 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
50 KB |
2 |
lee-johnson.co.nz
lee-johnson.co.nz |
2 KB |
18 | 5 |
Domain | Requested by | |
---|---|---|
9 | cdn.glitch.global |
lee-johnson.co.nz
|
3 | www.sado-sa.com |
lee-johnson.co.nz
|
2 | pacific-iridescent-lunge.glitch.me |
lee-johnson.co.nz
|
2 | cdn.jsdelivr.net |
lee-johnson.co.nz
|
2 | lee-johnson.co.nz | |
18 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
webdisk.lee-johnson.co.nz R3 |
2024-04-24 - 2024-07-23 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
glitch.com Amazon RSA 2048 M03 |
2023-12-04 - 2025-01-01 |
a year | crt.sh |
cdn.glitch.global R3 |
2024-05-30 - 2024-08-28 |
3 months | crt.sh |
*.sado-sa.com R3 |
2024-05-22 - 2024-08-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lee-johnson.co.nz/mn/i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkhj39048oiwo598e3996932bnedjnd9498329932n5j2902985nmsbnc89496092nsmj94929050k72ol3959037d90mc57.html
Frame ID: 11E46493AE78C337A2DC5715AF60643A
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Microsoft | SharePointPage URL History Show full URLs
-
http://lee-johnson.co.nz/mn/i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkh...
HTTP 307
https://lee-johnson.co.nz/mn/i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkh... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://lee-johnson.co.nz/mn/i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkhj39048oiwo598e3996932bnedjnd9498329932n5j2902985nmsbnc89496092nsmj94929050k72ol3959037d90mc57.html
HTTP 307
https://lee-johnson.co.nz/mn/i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkhj39048oiwo598e3996932bnedjnd9498329932n5j2902985nmsbnc89496092nsmj94929050k72ol3959037d90mc57.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
i9nv68xb7e9615d244ed1b7465211cfb44c6499g8hdsgm4t497zf7mzxn464hfn5fh784dkhj39048oiwo598e3996932bnedjnd9498329932n5j2902985nmsbnc89496092nsmj94929050k72ol3959037d90mc57.html
lee-johnson.co.nz/mn/ Redirect Chain
|
9 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/ |
160 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
pacific-iridescent-lunge.glitch.me/ |
1 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
pacific-iridescent-lunge.glitch.me/ |
87 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.jpg
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
11 KB 11 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.png
www.sado-sa.com/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
402 B 657 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d.png
cdn.glitch.global/bf730a63-df78-4244-8a93-304b5ab441ae/ |
479 B 948 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.png
www.sado-sa.com/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
356 B 608 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.png
www.sado-sa.com/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
405 B 646 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
d.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
479 B 906 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aa.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
687 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ss.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
83 KB 83 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
to.png
cdn.glitch.global/a31a7d01-ebad-4498-99ee-ba6977e57fac/ |
35 KB 35 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/ |
76 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
lee-johnson.co.nz/ |
0 79 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| uidEvent object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.glitch.global
cdn.jsdelivr.net
lee-johnson.co.nz
pacific-iridescent-lunge.glitch.me
www.sado-sa.com
151.101.66.132
163.172.253.37
185.184.154.65
2a04:4e42::485
34.197.227.58
0f0f236b6976b62009da78c47443764ede550fc5041dfbb3a68d2eddea735ab3
119191f22ea22ff461d6f4f4a13a451072aa736d31db3b11f99379305e014d1b
148f106fc77f420a9002cdf65bd26ce8812ef97bcaf994db31fdeb212013cdb5
4f039c50843b6612b0dd48bfacd50e6fcd784630e4bd2be9f41ad4fc3f46df92
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
80489c2ddb2533b0357e28c70524b678d73b06f409f7e7e300554df7851798fd
9eeb371fbff81af820deb5db9a1c8c9e5ac9700fb594ed07c717afb7ab992315
a5699544c0922f1d41f3b41e98bebb052f37058bfb1bb452edb3279a87ab3f70
b14b9d44fefc148919ad878a273e3f8a65a020cd333ee93e90db2db435aca304
b48a7a21cfe1c5ada20a91b04bcb21a71bc831023e454322d4ee59e5a87a030d
c399d6d1fa6493f765d33c90e71e5569fdcdc0623ddcfd69f8ad88a9ef6a4ed0
c43e087c9c0c699cc387124d0273f2fd40f8e087a4e65b207f9fd7de6dbde252
d4ba02dae3549e42d98d680f9b8c534eddc60c1b284200a0669a00119a4b572b
d509a86793135d9691726e796b0263f49df5187d7061755cb237e1ebb0b443a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d