secredocus.mannffjrrrke.com

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2606:4700:3033::6815:2f84, located in United States and belongs to CLOUDFLARENET, US. The main domain is secredocus.mannffjrrrke.com.
TLS certificate: Issued by GTS CA 1P5 on July 14th 2023. Valid for: 3 months.

This is the only time secredocus.mannffjrrrke.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:218... 2600:9000:218e:7800:16:ad5f:7f80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:205... 2600:9000:2057:e400:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3035::6815:36f4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:303... 2606:4700:3033::6815:2f84	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	3

1 2600:9000:218e:7800:16:ad5f:7f80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

protection.greathorn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:e400:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

chipotle.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6815:36f4 (United States)

ASN13335 (CLOUDFLARENET, US)

ostarmenia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3033::6815:2f84 (United States)

ASN13335 (CLOUDFLARENET, US)

secredocus.mannffjrrrke.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	mannffjrrrke.com secredocus.mannffjrrrke.com	125 KB
1	ostarmenia.com ostarmenia.com	497 B
1	app.link 1 redirects chipotle.app.link — Cisco Umbrella Rank: 249603	744 B
1	greathorn.com 1 redirects protection.greathorn.com — Cisco Umbrella Rank: 406041	718 B
3	4

	Domain	Requested by
2	secredocus.mannffjrrrke.com	secredocus.mannffjrrrke.com
1	ostarmenia.com
1	chipotle.app.link	1 redirects
1	protection.greathorn.com	1 redirects
3	4

This site contains no links.

Subject Issuer	Validity	Valid
ostarmenia.com GTS CA 1P5	`2023-07-06` - `2023-10-04`	3 months	crt.sh
mannffjrrrke.com GTS CA 1P5	`2023-07-14` - `2023-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secredocus.mannffjrrrke.com/?username=fmaghak@janney.com
Frame ID: 28DAF8F2C7F155F2746FD0A145E354AC
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

reCAPTCHA

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

3
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

125 kB
Transfer

357 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://protection.greathorn.com/services/v2/lookupUrl/735d7189-2f3d-4bd9-8f85-e102e24caa80/1132/9503e4474e31f2dd09cfc4d9b79286fed0fddd39?domain=chipotle.app.link&path=/ HTTP 302
https://chipotle.app.link/?$3p=e_et&$fallback_url=https%3A%2F%2Fostarmenia.com//wp-includes/pomo/espn/Ne3V5/fmaghak@janney.com HTTP 307
https://ostarmenia.com//wp-includes/pomo/espn/Ne3V5/fmaghak@janney.com?%243p=e_et&_branch_match_id=1209535340129948758&_branch_referrer=H4sIAAAAAAAAAyWLwQrCMBBEvybeTKWpF6GIF48evZY1bk3MZrM0KeLfu0UYeDMDL7Qm9dR1PkQpjdCCiKXIqTubfnAy4oRtp3UGogf4NK0LjWGzjLuY%2FqoptcGSkSNYX%2FL%2F%2B8g%2Bsqf1iVWXlFwUWIUVN3T3o3LO8AqQzHB4AzN%2BN%2FsHLt8UEZAAAAA%3D

3 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

fmaghak@janney.com Show response
ostarmenia.com//wp-includes/pomo/espn/Ne3V5/
Redirect Chain

https://protection.greathorn.com/services/v2/lookupUrl/735d7189-2f3d-4bd9-8f85-e102e24caa80/1132/9503e4474e31f2dd09cfc4d9b79286fed0fddd39?domain=chipotle.app.link&path=/
https://chipotle.app.link/?$3p=e_et&$fallback_url=https%3A%2F%2Fostarmenia.com//wp-includes/pomo/espn/Ne3V5/fmaghak@janney.com
https://ostarmenia.com//wp-includes/pomo/espn/Ne3V5/fmaghak@janney.com?%243p=e_et&_branch_match_id=1209535340129948758&_branch_referrer=H4sIAAAAAAAAAyWLwQrCMBBEvybeTKWpF6GIF48evZY1bk3MZrM0KeLfu0UYe...

0
497 B

159ms
64ms

Document
text/html

2606:4700:3035::6815:36f4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ostarmenia.com//wp-includes/pomo/espn/Ne3V5/fmaghak@janney.com?%243p=e_et&_branch_match_id=1209535340129948758&_branch_referrer=H4sIAAAAAAAAAyWLwQrCMBBEvybeTKWpF6GIF48evZY1bk3MZrM0KeLfu0UYeDMDL7Qm9dR1PkQpjdCCiKXIqTubfnAy4oRtp3UGogf4NK0LjWGzjLuY%2FqoptcGSkSNYX%2FL%2F%2B8g%2Bsqf1iVWXlFwUWIUVN3T3o3LO8AqQzHB4AzN%2BN%2FsHLt8UEZAAAAA%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:36f4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7e841b90cfae92ba-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 17 Jul 2023 17:12:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
refresh: 0;url=https://secredocus.mannffjrrrke.com/?username=fmaghak@janney.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bx7rRN%2BgqKHkZzCdmRIdBDUk9Z6oUDbBBl9Uz1rfdiToZeHPhOvZWC9RjaDSlXuFrnw49wAZwLUOgWHfC0ZMnpEI1amrwLBcegi2UT59yR%2FbUitgKbAdf4vGKdxdsG60TcSXVt3ePqlXBZ6tzw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
date: Mon, 17 Jul 2023 17:12:03 GMT
last-modified: Mon, 17 Jul 2023 17:12:03 GMT
location: https://ostarmenia.com//wp-includes/pomo/espn/Ne3V5/fmaghak@janney.com?%243p=e_et&_branch_match_id=1209535340129948758&_branch_referrer=H4sIAAAAAAAAAyWLwQrCMBBEvybeTKWpF6GIF48evZY1bk3MZrM0KeLfu0UYeDMDL7Qm9dR1PkQpjdCCiKXIqTubfnAy4oRtp3UGogf4NK0LjWGzjLuY%2FqoptcGSkSNYX%2FL%2F%2B8g%2Bsqf1iVWXlFwUWIUVN3T3o3LO8AqQzHB4AzN%2BN%2FsHLt8UEZAAAAA%3D
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 21da0a66bafe2c8de8be4a4d8039346a.cloudfront.net (CloudFront)
x-amz-cf-id: PbiMan3V9QdPZ7bYJSG_AUPH7DCgMIZouvggBWMy5i0z3N7pEhC5Cw==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront

GET
H2 200 Primary Request / Show response
secredocus.mannffjrrrke.com/ 316 KB
125 KB 362ms
273ms Document
text/html 2606:4700:3033::6815:2f84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secredocus.mannffjrrrke.com/?username=fmaghak@janney.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:2f84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7fbb1814caa628be714d44dfa51ba7e2c40a97de563d40ce1c95e4d3be62d3f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ostarmenia.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7e841b91f87390f4-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 17 Jul 2023 17:12:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HG%2FxynNuYgmBruBHMpjmDmJ2AsRQv5sanmEhaDcQQpKZtHr7vNDhhekdheENIgIFQhFcK1YBFmaV0yaHtt9UOlmXbDrFConJjiodWXiOJiST8GMS3eohGA1RJyLfUNLaVdXfahk9hLo8khTFZL%2FBsvM4D5EzvMaVcdQ%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 858 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 / Show response
secredocus.mannffjrrrke.com/ 145 B
456 B 591ms
591ms Fetch
application/json 2606:4700:3033::6815:2f84
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://secredocus.mannffjrrrke.com/?username=fmaghak@janney.com

Requested by

Host: secredocus.mannffjrrrke.com
URL: https://secredocus.mannffjrrrke.com/?username=fmaghak@janney.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:2f84 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49a7fa653e224ad8df4f7c68262ce78b758a66f17e478ffde8b25dbff30dd5ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 17 Jul 2023 17:12:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=we0APHyNcrV6KjAOGceiNg1l0gt73lGnSSoEJoui41FlL4KcWytO9HSZzPhpwgeljb25t05A7sPEthuRJRap9qsKnp7fG7RMLtuUvCcOmBmXqTHkH2hFTX29PDln3RCcliohizJ1BeTq%2FYWziHzrGOtde1mMpdsyiuQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
cf-ray: 7e841b953b8590f4-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.app.link/	1970-01-20 22:05:49	Name: _s Value: %2FgUybZVjbu2zCawV7eI1LznrrFLR40XygUbIun1yquwK8Y1Wmk9VkNWTMYxnIONt

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

chipotle.app.link
ostarmenia.com
protection.greathorn.com
secredocus.mannffjrrrke.com
2600:9000:2057:e400:19:9934:6a80:93a1
2600:9000:218e:7800:16:ad5f:7f80:93a1
2606:4700:3033::6815:2f84
2606:4700:3035::6815:36f4
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
49a7fa653e224ad8df4f7c68262ce78b758a66f17e478ffde8b25dbff30dd5ce
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
7fbb1814caa628be714d44dfa51ba7e2c40a97de563d40ce1c95e4d3be62d3f0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

secredocus.mannffjrrrke.com Open in urlscan Pro 2606:4700:3033::6815:2f84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

125 kBTransfer

357 kBSize

1 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

Indicators

secredocus.mannffjrrrke.com Open in urlscan Pro
2606:4700:3033::6815:2f84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

125 kB
Transfer

357 kB
Size

1
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!