42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com
Open in
urlscan Pro
185.212.128.115
Malicious Activity!
Public Scan
Effective URL: https://42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//-3Ez9CMIswyn1wvpt0bcQDl6AKL9kxUB3mVY9yKGU00qgB3ebeHAyFJryzhLoz...
Submission: On April 10 via manual from US
Summary
TLS certificate: Issued by R3 on April 9th 2021. Valid for: 3 months.
This is the only time 42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.232.205.191 54.232.205.191 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 213.248.110.35 213.248.110.35 | 1299 (TELIANET ...) (TELIANET Telia Carrier) | |
12 | 185.212.128.115 185.212.128.115 | 200313 (INTERNET-IT) (INTERNET-IT) | |
13 | 2 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-232-205-191.sa-east-1.compute.amazonaws.com
nt.embluemail.com |
ASN200313 (INTERNET-IT, SC)
PTR: shopolivecollections.com
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
monakasatelyoum.com
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com |
142 KB |
1 |
drbevital.de
drbevital.de |
887 B |
1 |
embluemail.com
1 redirects
nt.embluemail.com |
195 B |
13 | 3 |
Domain | Requested by | |
---|---|---|
12 | 42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com |
drbevital.de
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com |
1 | drbevital.de | |
1 | nt.embluemail.com | 1 redirects |
13 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
drbevital.de cPanel, Inc. Certification Authority |
2021-03-13 - 2021-06-11 |
3 months | crt.sh |
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com R3 |
2021-04-09 - 2021-07-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//-3Ez9CMIswyn1wvpt0bcQDl6AKL9kxUB3mVY9yKGU00qgB3ebeHAyFJryzhLozre2CCwDhbhGinc3rQ8rU7C4xtbP8LZXiUfohkz008rAJqH9q4UfNLE5NCi4wvpOcLIO1stfc6wRpcCD4Y1mFId2aQJ6VdnyJp2Rc28R9MWdkrDknjbEjr0JppZWgvku6WrUFreoZucj?data=
Frame ID: 67DA5925B72762065732ED283C730599
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://nt.embluemail.com/p/cl?data=r7U0gyIUF9ecCNzyWo0fQ+cRFJyUJUefbTcviShcbsItC7Wbi8imVoWVLBw+cc3uG4...
HTTP 302
https://drbevital.de/lakers/ Page URL
- https://42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//-3Ez9CMIswyn1wvpt0bcQDl6AKL9kxUB3mVY9yKGU0... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nt.embluemail.com/p/cl?data=r7U0gyIUF9ecCNzyWo0fQ+cRFJyUJUefbTcviShcbsItC7Wbi8imVoWVLBw+cc3uG4Ufu7VdWglR9bO4M9yYLg==!-!5d3bmb8!-!https://drbevital.de/lakers/
HTTP 302
https://drbevital.de/lakers/ Page URL
- https://42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//-3Ez9CMIswyn1wvpt0bcQDl6AKL9kxUB3mVY9yKGU00qgB3ebeHAyFJryzhLozre2CCwDhbhGinc3rQ8rU7C4xtbP8LZXiUfohkz008rAJqH9q4UfNLE5NCi4wvpOcLIO1stfc6wRpcCD4Y1mFId2aQJ6VdnyJp2Rc28R9MWdkrDknjbEjr0JppZWgvku6WrUFreoZucj?data= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://nt.embluemail.com/p/cl?data=r7U0gyIUF9ecCNzyWo0fQ+cRFJyUJUefbTcviShcbsItC7Wbi8imVoWVLBw+cc3uG4Ufu7VdWglR9bO4M9yYLg==!-!5d3bmb8!-!https://drbevital.de/lakers/ HTTP 302
- https://drbevital.de/lakers/
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
drbevital.de/lakers/ Redirect Chain
|
1 KB 887 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
-3Ez9CMIswyn1wvpt0bcQDl6AKL9kxUB3mVY9yKGU00qgB3ebeHAyFJryzhLozre2CCwDhbhGinc3rQ8rU7C4xtbP8LZXiUfohkz008rAJqH9q4UfNLE5NCi4wvpOcLIO1stfc6wRpcCD4Y1mFId2aQJ6VdnyJp2Rc28R9MWdkrDknjbEjr0JppZWgvku6WrUFreo...
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15// |
72 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.v2.login.min_k6vcupdeent1wwpsw5wt2g2.css
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/css/ |
127 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ux.converged.login.strings-en.min_xvnavb8ts_r3tr0w_ckg1g2.js
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/js/ |
34 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/img/ |
513 B 655 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.v2.login.min_k6vcupdeent1wwpsw5wt2g2.css
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/css/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ux.converged.login.strings-en.min_xvnavb8ts_r3tr0w_ckg1g2.js
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/js/ |
0 11 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2_bc3d32a696895f78c19df6c717586a5d.svg
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/img/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.v2.login.min_k6vcupdeent1wwpsw5wt2g2.css
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/css/ |
0 20 KB |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ux.converged.login.strings-en.min_xvnavb8ts_r3tr0w_ckg1g2.js
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/js/ |
0 11 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
converged.v2.login.min_k6vcupdeent1wwpsw5wt2g2.css
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/css/ |
127 KB 20 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ux.converged.login.strings-en.min_xvnavb8ts_r3tr0w_ckg1g2.js
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/312520f6bac65d0bbbce0ea5e8ba9b15//assets/js/ |
34 KB 11 KB |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| $Debug object| $Do function| $Loader function| GetString function| GetErrorString function| GetUrl object| $B object| StringRepository object| PROOF boolean| __1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com/ | Name: PHPSESSID Value: 0btjvm4a15keib0ie53b3mj8n7 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
42m6lvv4qywlq97qagwvfhnvm.monakasatelyoum.com
drbevital.de
nt.embluemail.com
185.212.128.115
213.248.110.35
54.232.205.191
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
480e0fbbd4820b94acd5452fceeaa1e29f87655edef23e2dab8864a928016b34
831aa2d6f1b5ef340f30c2f13849d09d002c1dae00b3ca8e8d9162f4520db73a
9a5e7a02c0fb05b057b208a1d3d4047b25d0b5435d1f688a89b35b0d7c463a64
a8fbb4ad615b64053c0dabac8c6e6ff8f53b030cfb2160d2cf9212d44d07f67d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855