sa-cq.uk
Open in
urlscan Pro
51.68.175.128
Malicious Activity!
Public Scan
Submitted URL: http://sa-cq.uk/Sadlive/scan.html
Effective URL: https://sa-cq.uk/sadlive/index.php
Submission: On April 14 via api from CA
Effective URL: https://sa-cq.uk/sadlive/index.php
Submission: On April 14 via api from CA
Summary
This website contacted 5 IPs
in 4 countries
across 4 domains to perform 27 HTTP transactions.
The main IP is 51.68.175.128, located in
United Kingdom and
belongs to OVH, FR.
The main domain is sa-cq.uk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 10th 2019. Valid for: 3 months.
This is the only time sa-cq.uk was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 10th 2019. Valid for: 3 months.
This is the only time sa-cq.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Office 365 (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 51.68.175.128 51.68.175.128 | 16276 (OVH) (OVH) | |
| 11 | 64.58.126.236 64.58.126.236 | 7979 (SERVERS) (SERVERS - Servers.com) | |
| 1 | 144.76.185.168 144.76.185.168 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 1 | 93.190.140.94 93.190.140.94 | 49981 (WORLDSTREAM) (WORLDSTREAM) | |
| 27 | 5 |
1
144.76.185.168
(Germany)
ASN24940 (HETZNER-AS, DE)
PTR: static.168.185.76.144.clients.your-server.de
ASN24940 (HETZNER-AS, DE)
PTR: static.168.185.76.144.clients.your-server.de
| urlvalidation.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
sa-cq.uk
sa-cq.uk |
188 KB |
| 12 |
lancheck.net
lancheck.net |
8 KB |
| 1 |
urlvalidation.com
urlvalidation.com |
285 B |
| 0 |
similardeals.net
Failed
rules.similardeals.net Failed |
|
| 27 | 4 |
| Domain | Requested by | |
|---|---|---|
| 13 | sa-cq.uk |
sa-cq.uk
|
| 12 | lancheck.net |
sa-cq.uk
|
| 1 | urlvalidation.com |
sa-cq.uk
|
| 0 | rules.similardeals.net Failed |
sa-cq.uk
|
| 27 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sa-cq.uk cPanel, Inc. Certification Authority |
2019-04-10 - 2019-07-09 |
3 months | crt.sh |
| lancheck.net Let's Encrypt Authority X3 |
2019-03-10 - 2019-06-08 |
3 months | crt.sh |
| urlvalidation.com Let's Encrypt Authority X3 |
2019-03-29 - 2019-06-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sa-cq.uk/sadlive/index.php
Frame ID: 6AB94F2EED9BF7DBDFBDEAE5E286BE74
Requests: 27 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://sa-cq.uk/Sadlive/scan.html Page URL
- https://sa-cq.uk/sadlive/index.php Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://sa-cq.uk/Sadlive/scan.html Page URL
- https://sa-cq.uk/sadlive/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
scan.html
sa-cq.uk/Sadlive/ |
79 B 320 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
index.php
sa-cq.uk/sadlive/ |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
whoami
sa-cq.uk/sadlive/files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
offff.png
sa-cq.uk/sadlive/files/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
wrdd.png
sa-cq.uk/sadlive/files/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
e.jpg
sa-cq.uk/sadlive/files/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
p.jpg
sa-cq.uk/sadlive/files/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
email-validation.js
sa-cq.uk/sadlive/files/ |
97 B 350 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
oflog.png
sa-cq.uk/sadlive/files/ |
63 KB 64 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
5cfd9308c50e4f8ae9.js
sa-cq.uk/sadlive/files/ |
55 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lnkr5.js
sa-cq.uk/sadlive/files/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bac.jpg
sa-cq.uk/sadlive/files/ |
32 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mm.jpg
sa-cq.uk/sadlive/ |
331 B 331 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
whoami
urlvalidation.com/ |
57 B 285 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
get
lancheck.net/optout/ |
144 B 356 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
userid
lancheck.net/optout/set/ |
0 263 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
strtm
lancheck.net/optout/set/ |
0 274 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
lnkr5.min.js
lancheck.net/addons/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
sa-cq.uk
rules.similardeals.net/v1.0/whitelist/1108/49499x1487x/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
lancheck.net/metric/ |
43 B 229 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- rules.similardeals.net
- URL
- https://rules.similardeals.net/v1.0/whitelist/1108/49499x1487x/sa-cq.uk?partnerName=S3.Google%20Translator%20extension&partnerLink=http%3A%2F%2Fthisadsfor.us%2Foptout%3Ft%3D1487%26u%3D49499%26block%3D02d38
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Office 365 (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| login function| getParm object| __twb__5cfd9308c50e4f8ae9 object| _lnkr5 function| func86843 undefined| __twb_cb_687630649 function| __twb_cb_660763001 function| __twb_cb_564257255 object| EmailField0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
lancheck.net
rules.similardeals.net
sa-cq.uk
urlvalidation.com
rules.similardeals.net
144.76.185.168
51.68.175.128
64.58.126.236
93.190.140.94
02332602c0226a1c7b8eb909859644f929708195285325d020e00d124a7b2881
03513176f7a21c4e8972d213100197b61a69b6ede43d41c7b5aa8bc4e8a41dd5
0c2e658db622dfc713cd80763f428372d41caa38fd242a55f35eab7d395504a0
35a932a9200775e7c0c87f89c1a6abd42c2c2d15731f6be0fc9a6574fe8d0b46
3f2e29d6e4c9b6817cc4e3ffe11cfe3a65119002ec63cfffd84ae3b124727e93
4068f2441ef1e7b31cf1b2f3136f35587b019b03e7e654c7dd0f830296eee8c7
50c7ff69872c51c23a5a9a56e8d3605822f954bc91905a0c4e1e6679bf160cb4
5a7bc56acb4d5312cf65f8dca1addad3401e7716b709354810ee15cc9bba838f
66931e0018716a290916fc0dd8c0b27f61bc9ebf7af61fd1c9ccd85f8334b72b
7fe51ab5d31f3289b932e58f90106e925c804437440b11e956e180b4a93aa568
bef4a86a0b251bdd22f59e356f0a5732985dd02e964a3a4a7dc6fafb91e4b8f3
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d8747ec2f7f2781e5544af558f8a56bd18bbe9f50579d7efba243d109d66f31c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e456cba289904cea6ea89793a97250299e3d1f1610577659174f299149fa598b
fcacbe9443312a9ae8d582068921b00a14781c675024452286f2a14b0373b12d