securemail-inbox-proofpoint-main-notification.com
Open in
urlscan Pro
104.168.141.112
Malicious Activity!
Public Scan
Submission: On October 07 via manual from MY — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 17th 2022. Valid for: 3 months.
This is the only time securemail-inbox-proofpoint-main-notification.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.168.141.112 104.168.141.112 | 54290 (HOSTWINDS) (HOSTWINDS) | |
4 | 2a00:1450:400... 2a00:1450:4001:806::2004 | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a00:1450:400... 2a00:1450:4001:803::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::2003 | 15169 (GOOGLE) (GOOGLE) | |
12 | 5 |
ASN54290 (HOSTWINDS, US)
PTR: hwsrv-985683.hostwindsdns.com
securemail-inbox-proofpoint-main-notification.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
539 KB |
4 |
google.com
www.google.com — Cisco Umbrella Rank: 19 |
25 KB |
1 |
securemail-inbox-proofpoint-main-notification.com
securemail-inbox-proofpoint-main-notification.com |
3 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
6 | www.gstatic.com |
www.google.com
www.gstatic.com |
4 | www.google.com |
securemail-inbox-proofpoint-main-notification.com
www.gstatic.com www.google.com |
1 | fonts.gstatic.com |
www.google.com
|
1 | securemail-inbox-proofpoint-main-notification.com | |
12 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
securemail-inbox-proofpoint-main-notification.com cPanel, Inc. Certification Authority |
2022-08-17 - 2022-11-15 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://securemail-inbox-proofpoint-main-notification.com/css/5a491276f443366bfb03fbc229614b6ada7a046c0185021301550162c2abbaf847be6e3ab61b7c98ba465793dd165c5b0185021301550162812659610d0919702c1463b2daf5c4d55691866d0185021301550162dcc52029ce51bcdbab3be928c23800160ebba5800185021301550162/capt?L2Nzcy81YTQ5MTI3NmY0NDMzNjZiZmIwM2ZiYzIyOTYxNGI2YWRhN2EwNDZjMDE4NTAyMTMwMTU1MDE2MmMyYWJiYWY4NDdiZTZlM2FiNjFiN2M5OGJhNDY1NzkzZGQxNjVjNWIwMTg1MDIxMzAxNTUwMTYyODEyNjU5NjEwZDA5MTk3MDJjMTQ2M2IyZGFmNWM0ZDU1NjkxODY2ZDAxODUwMjEzMDE1NTAxNjJkY2M1MjAyOWNlNTFiY2RiYWIzYmU5MjhjMjM4MDAxNjBlYmJhNTgwMDE4NTAyMTMwMTU1MDE2Mi9pbmRleA==LomTBfab-T8ge-Ha96-Hxs1-Gr75iTDMukLl_9J3czotayrnkVsjpwZ6NfRmGD2MIT5vhWd4qYKEeOHAblQgFUindV0xSGr5gzF2DRlZhtUTqmb78wIJXBCkPsp3Nc4EfQM19oW6Hhj37bOKwspl4M9AzmS8fnIQyoUGBTErtN2iZxeWvkgLVD6RF5q
Frame ID: 4266F24B91842EB875E07C1BAE8A2193
Requests: 3 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=%0A6Lcf2-EhAAAAAAb4lCjGZLljSQMQ9lL7LxhkWGBN&co=aHR0cHM6Ly9zZWN1cmVtYWlsLWluYm94LXByb29mcG9pbnQtbWFpbi1ub3RpZmljYXRpb24uY29tOjQ0Mw..&hl=de&v=vP4jQKq0YJFzU6e21-BGy3GP&size=normal&cb=5o954jnkp6u9
Frame ID: BF92359C2E010C9147E2DB4D994F1051
Requests: 8 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=de&v=vP4jQKq0YJFzU6e21-BGy3GP&k=6Lcf2-EhAAAAAAb4lCjGZLljSQMQ9lL7LxhkWGBN
Frame ID: 1F86FD06A66F4F40BB0E364C79CF9FA7
Requests: 3 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
capt
securemail-inbox-proofpoint-main-notification.com/css/5a491276f443366bfb03fbc229614b6ada7a046c0185021301550162c2abbaf847be6e3ab61b7c98ba465793dd165c5b0185021301550162812659610d0919702c1463b2daf5c4d... |
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
850 B 968 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/ |
396 KB 158 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame BF92 |
43 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/ Frame BF92 |
52 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/ Frame BF92 |
396 KB 158 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame BF92 |
14 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame BF92 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame BF92 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame BF92 |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webworker.js
www.google.com/recaptcha/api2/ Frame BF92 |
102 B 134 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 1F86 |
7 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/ Frame 1F86 |
52 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/vP4jQKq0YJFzU6e21-BGy3GP/ Frame 1F86 |
396 KB 158 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| _0x2030 function| isBot function| _0x322d object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| correctCaptcha object| recaptcha object| closure_lm_4722301 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
securemail-inbox-proofpoint-main-notification.com/ | Name: PHPSESSID Value: c2a46e5ede4108eedd218728e7e14dc2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
securemail-inbox-proofpoint-main-notification.com
www.google.com
www.gstatic.com
104.168.141.112
2a00:1450:4001:803::2003
2a00:1450:4001:806::2004
2a00:1450:4001:811::2003
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
4a59bb42cb945084820cd1eb370a22a68fa9451b9e57abb1daada408d2ff64e1
5121f8b69fe9d947df423f0abe6561e7da40b5a94a618abfc07b62edebcacdf1
581da8d68c56b4eb643424de40b4de62616adc687df6fd1f6089a17528eb542b
6e5d7aedf8dd6a60522d9fc1addd35898214f54ab20394d58eb19d21f36ef5ec
b52b34cf452e92654dd04036ab4a81c81e0b9a6958539752b050f0433f4b1ddd
dbf1818d8b1397e676767b2fa0352f57b18f4066eede2460f730308f1303ded7
deaf5a4d4987d3198c038ffa6ebfb7b3aefc084c71d8f02805e918d25096412a