urlscan.io logo urlscan.io
SecurityTrails logo

mta0.prizako.net Open in urlscan Pro
2606:4700:3035::ac43:94e9  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u45856613.ct.sendgrid.net/ls/click?upn=u001.3IiLZyIZOyPeAtnshB-2BhKFqAPydXbH5BirUvraI4ZlELGJtgMLBxUELx9m4sIHsZO2GpMr72R8bw...
Effective URL: https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Submission: On July 23 via api from EE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3035::ac43:94e9, located in United States and belongs to CLOUDFLARENET, US. The main domain is mta0.prizako.net.
TLS certificate: Issued by WE1 on June 24th 2024. Valid for: 3 months.
This is the only time mta0.prizako.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sharepoint (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.122 11377 (SENDGRID)
1 3 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a04:4e42::649 54113 (FASTLY)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 4
Apex Domain
Subdomains		 Transfer
3 prizako.net
mta0.prizako.net
25 KB
1 iconarchive.com
icons.iconarchive.com — Cisco Umbrella Rank: 224534
4 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211
78 KB
1 sendgrid.net
u45856613.ct.sendgrid.net
266 B
4 4
Domain Requested by
3 mta0.prizako.net 1 redirects mta0.prizako.net
1 icons.iconarchive.com
1 code.jquery.com mta0.prizako.net
1 u45856613.ct.sendgrid.net 1 redirects
4 4

This site contains links to these domains. Also see Links.

Domain
www.premierpawn.com
Subject Issuer Validity Valid
prizako.net
WE1		 2024-06-24 -
2024-09-22		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
iconarchive.com
E1		 2024-06-01 -
2024-08-30		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Frame ID: 07626F064168876E92EDF737FAE8C62B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign | SharePoint

Page URL History Show full URLs

  1. https://u45856613.ct.sendgrid.net/ls/click?upn=u001.3IiLZyIZOyPeAtnshB-2BhKFqAPydXbH5BirUvraI4ZlELGJtgMLBxUELx... HTTP 302
    https://mta0.prizako.net/docfile.jsp?account=degrid.end@smit.ee HTTP 302
    https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

107 kB
Transfer

323 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u45856613.ct.sendgrid.net/ls/click?upn=u001.3IiLZyIZOyPeAtnshB-2BhKFqAPydXbH5BirUvraI4ZlELGJtgMLBxUELx9m4sIHsZO2GpMr72R8bwFGzN-2BHHmqxIHRb-2FiwV4L9ibosejzDTY-3D5ZMk_1TWw7dHGXdI6tkIlVmSqFlfUi8tQQSjCOoVZ9U7cl-2FUVWYZfNk9Wr-2BGlZUx-2BZZUYmluVkBYThKvZeWARcNpX-2BFgshMVHWe2Wuzv4-2BWyXb3NDF3NAQYPaFgvyFed0cyE6DKLJc1X6hKQSt-2Bfx1jIcsOJxPTCvaxy7aVD2viIovQkoWuh0UxwJh3ru99mdqIsN7hUQBdP8PkJ1OKhr-2BUqUxFV1OPnNXqLYg2K785KnMjWpuCjRV2sx4HjiCqbmHk3sNUfTU4QayGfP3c7jXwR6NGsP2p8eTe7sSF90uBpaKSYDkEqxBfLzD-2BemUzEIxnZVqyeyXbCupeX86X3zy-2B-2BP7gDB7u-2FtyTcFnc-2F2ghXA-2FTxQ2917asxDeelTQT936IMg-2BFQWTHUeECvFRPP-2FYJY-2BBynCt-2Bs6I3c7JZudWT3HpgnNt0d-2B2Fm4Hxs97ocI0BITMMHP4mW4njwWI3ne2ODvbpshT-2BkI-2FxvwE2-2FbesFQDaL-2BOns1uIIqsUfvcB2B31h7LZIYh-2Bb0PMVhLHcll13FKlXkDnA3VhE1Rqh-2F4mHVE3KnwXGLCuWM4Ate3l7rPwFuQueRd-2F7fht-2BfWIViynsqqGdCTDCt2-2BarpZaShzWvcWawX-2FYhzB6WwD3-2BPaGRydpGwM-2BEutOc16hSx990lLsslqvklH625upRn1vf9Of-2BIqejdmTy3lhHZLgMC6s3p7Fd8fujpTLRs7U2kIHNOGx2HADzPecG1470nAU-2B6Frgt3abriao6154Fi7gA24m0z5t2Up3JJNhedbdBctS8dFVq-2BLdVPrNlXQo9Qmnbsm4Fm6DGoanDrtwsZC5jAsVvJJK-2FJM28hTO01zSuaIzqfsZrbH5qQZGX-2F9TI23014eMC9U-2FxRZne2QKpt0oDa0oe-2BFJbJ23Vkx13-2FwKtAhumccFGg-3D-3D HTTP 302
    https://mta0.prizako.net/docfile.jsp?account=degrid.end@smit.ee HTTP 302
    https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 94.0.jsp
mta0.prizako.net/
Redirect Chain
  • https://u45856613.ct.sendgrid.net/ls/click?upn=u001.3IiLZyIZOyPeAtnshB-2BhKFqAPydXbH5BirUvraI4ZlELGJtgMLBxUELx9m4sIHsZO2GpMr72R8bwFGzN-2BHHmqxIHRb-2FiwV4L9ibosejzDTY-3D5ZMk_1TWw7dHGXdI6tkIlVmSqFlfU...
  • https://mta0.prizako.net/docfile.jsp?account=degrid.end@smit.ee
  • https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
36 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:94e9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99a557649eee0677b3d92dfdecaadb77efd5cf4e0f61b2f25a4335cf36ca97da

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8a7b8a8cee533a52-FRA
content-encoding
br
content-type
text/html;charset=ISO-8859-1
date
Tue, 23 Jul 2024 12:05:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=803dxC6xNUI7UDxvWANHZhGFFj65kFp6QdO19Eom3Rd7S9TNrFJynTkmfoSv37xkWQhUW%2FJQPSpULspYMrSSez7JiY3uP3DG%2FM4FplWzaLkDJRyObCExEcCHnKTf1lroOUfMzNQvKCoqWIupj8AR"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8a7b8a8bdce03a52-FRA
content-type
text/html;charset=UTF-8
date
Tue, 23 Jul 2024 12:05:52 GMT
location
94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TRDMHbFd8wQZ87n5QzeKMwzz%2F9KiiA6W0bw1QwENHkO0bHmwz6ldAMT957fhO6e4y7hXEpWgNZbauNuBq%2BXoHh8EBlOndG3SpZpZhrlXxrQZiFDv4pckE91%2BBGiNdd3xkvmSeaHPbQ8gf5Y7QOee"}],"group":"cf-nel","max_age":604800}
server
cloudflare
myscr584876.js.download
mta0.prizako.net/index_files/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://mta0.prizako.net/index_files/myscr584876.js.download
Requested by
Host: mta0.prizako.net
URL: https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::ac43:94e9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 23 Jul 2024 12:05:53 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MbKtPcl%2F7qeKCB0d2l65HwjUlppsdRZ5edflNf2n6RG9TUFcItqJzzVpDDQZ%2B%2FdjPG3N9fWvGvgIRh0ZmR9x6D%2F0%2BLBbmSGPb7jtssoM7sEKEzHsv9v%2F7V%2F%2FQHv0X2TVtnsGFnJvt3RenUKoYCTn"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=utf-8
content-language
de
cf-ray
8a7b8a8e1df037f7-FRA
alt-svc
h3=":443"; ma=86400
jquery-1.9.1.js
code.jquery.com/ 		262 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.9.1.js
Requested by
Host: mta0.prizako.net
URL: https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

Referer
https://mta0.prizako.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 23 Jul 2024 12:05:53 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9361819
x-cache
HIT, HIT
content-length
79506
x-served-by
cache-lga21952-LGA, cache-fra-eddf8230144-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1721736353.039734,VS0,VE0
etag
W/"28feccc0-4185d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
16, 619
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5757e602c5502496be5d7ec17d19cd1d97dc216497dfc6a7654f2b6396e546f4

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		13 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f672d39017602a1ef5b484477bb7743904515691c3a0242993934d1dd833ece

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
Microsoft-SharePoint-2013-icon.png
icons.iconarchive.com/icons/dakirby309/simply-styled/256/ 		4 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://icons.iconarchive.com/icons/dakirby309/simply-styled/256/Microsoft-SharePoint-2013-icon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ebd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98af5967761222708dc79f43df493e4cc2e085376bf8d50be5560d6c6e1fa7de

Request headers

Referer
https://mta0.prizako.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Tue, 23 Jul 2024 12:05:53 GMT
cf-cache-status
HIT
last-modified
Tue, 07 Feb 2023 10:06:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
410
etag
"63e222a4-fc1"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8NIx5qfLaGm4PI7voEphy3paco4NMXdp4VZsV0gcztcJM92342DqoefStVR2r1vyDRKtrWa01Wm2fFB2D0IOwXek5wP2ZsIni4zq4vaLKUBlmRxCbVnt9KAKxY0wWBFr%2Fw5NLofNWiJDHp0EIlC0C72dTwo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=5356800
accept-ranges
bytes
cf-ray
8a7b8a8f6eda9193-FRA
alt-svc
h3=":443"; ma=86400
content-length
4033

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sharepoint (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
mta0.prizako.net/ Name: JSESSIONID
Value: 7ABCC178D0D2BB39306A44983BA6CF8A

2 Console Messages

Source Level URL
Text
network error URL: https://mta0.prizako.net/index_files/myscr584876.js.download
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://mta0.prizako.net/94.0.jsp?/ce94f19f-250b-4932-9a3d-4fe40d25d011/oc53600del20240325.pdf?v=1711382411072
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o