urlscan.io logo urlscan.io
SecurityTrails logo

kubasik.net Open in urlscan Pro
2606:4700:30::681c:1d20  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://kubasik.net/wp-includes/css/uni.htm
Submission: On September 11 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:30::681c:1d20, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is kubasik.net.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on September 1st 2019. Valid for: 6 months.
This is the only time kubasik.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
5 2606:4700:30:... 13335 (CLOUDFLAR...)
6 193.104.164.40 6461 (ZAYO-6461)
11 2
Apex Domain
Subdomains		 Transfer
6 hoganlovells.com
webmail.intl.hoganlovells.com
21 KB
5 kubasik.net
kubasik.net
9 KB
11 2
Domain Requested by
6 webmail.intl.hoganlovells.com kubasik.net
5 kubasik.net kubasik.net
11 2

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
Subject Issuer Validity Valid
sni151549.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2019-09-01 -
2020-03-09		 6 months crt.sh
webmail.intl.hoganlovells.com
DigiCert SHA2 Secure Server CA		 2019-03-27 -
2021-03-31		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://kubasik.net/wp-includes/css/uni.htm
Frame ID: 5F3D5ACB6B345172DF024E407BAF1C71
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

29 kB
Transfer

54 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request uni.htm
kubasik.net/wp-includes/css/ 		30 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kubasik.net/wp-includes/css/uni.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1d20 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27a0777e1c4c983b6ef1044ea706e68a75693c1aee1d98a7f0a34a0662843954

Request headers

:method
GET
:authority
kubasik.net
:scheme
https
:path
/wp-includes/css/uni.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
date
Wed, 11 Sep 2019 00:05:27 GMT
content-type
text/html
set-cookie
__cfduid=d961e40c2512d55f22bd13b666809c8e61568160327; expires=Thu, 10-Sep-20 00:05:27 GMT; path=/; domain=.kubasik.net; HttpOnly
last-modified
Tue, 10 Sep 2019 12:04:08 GMT
x-server-cache
false
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
514563df0b9959ee-VIE
content-encoding
br
session_check.js
webmail.intl.hoganlovells.com/public/include/js/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://webmail.intl.hoganlovells.com/public/include/js/session_check.js?v=13
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.104.164.40 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS
Software
HLINT /
Resource Hash
a5ea9b6d1aa661f4df9f86ec4cd271bff35c6c1f243b49ad3b9ee4986f9ac8ff
Security Headers
Name Value
Strict-Transport-Security
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 00:05:28 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Last-Modified
Fri, 23 Sep 2016 00:53:19 GMT
Server
HLINT
Age
1437
ETag
"180ac-1dd6-53d223449fdc0"
X-Frame-Options
DENY
Connection
Keep-Alive
Content-Type
text/javascript
Cache-Control
max-age=3600, must-revalidate
Strict-Transport-Security
Accept-Ranges
bytes
Content-Length
2128
image00_en.gif
webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image00_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.104.164.40 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS
Software
HLINT /
Resource Hash
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
Security Headers
Name Value
Strict-Transport-Security
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 00:05:28 GMT
Last-Modified
Sat, 17 Nov 2018 00:30:27 GMT
Server
HLINT
Age
28296
X-Frame-Options
DENY
ETag
"181ab-1167-57ad163f04ec0"
Strict-Transport-Security
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4455
image01_en.gif
webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		581 B
919 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image01_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.104.164.40 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS
Software
HLINT /
Resource Hash
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301
Security Headers
Name Value
Strict-Transport-Security
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 00:05:28 GMT
Vary
Accept-Encoding
Last-Modified
Sat, 17 Nov 2018 00:30:27 GMT
Server
HLINT
Age
78796
X-Frame-Options
DENY
ETag
"181ae-245-57ad163f04ec0"
Strict-Transport-Security
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
581
tr.gif
webmail.intl.hoganlovells.com/public/images/my/ 		43 B
426 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://webmail.intl.hoganlovells.com/public/images/my/tr.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.104.164.40 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS
Software
HLINT /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 00:05:28 GMT
Vary
Accept-Encoding
Last-Modified
Sat, 10 Mar 2007 05:11:20 GMT
Server
HLINT
Age
1440
X-Frame-Options
DENY
ETag
"18093-2b-42b4b92116e00"
Strict-Transport-Security
Content-Type
image/gif
Cache-Control
max-age=3600, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
43
image02_en.gif
webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image02_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.104.164.40 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS
Software
HLINT /
Resource Hash
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
Security Headers
Name Value
Strict-Transport-Security
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 00:05:28 GMT
Last-Modified
Sat, 17 Nov 2018 00:30:27 GMT
Server
HLINT
Age
25657
X-Frame-Options
DENY
ETag
"181a6-245f-57ad163f04ec0"
Strict-Transport-Security
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
9311
image03_en.gif
webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://webmail.intl.hoganlovells.com/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image03_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.104.164.40 , United Kingdom, ASN6461 (ZAYO-6461 - Zayo Bandwidth, US),
Reverse DNS
Software
HLINT /
Resource Hash
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
Security Headers
Name Value
Strict-Transport-Security
X-Frame-Options DENY

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 11 Sep 2019 00:05:28 GMT
Last-Modified
Sat, 17 Nov 2018 00:30:27 GMT
Server
HLINT
Age
25657
X-Frame-Options
DENY
ETag
"181a8-958-57ad163f04ec0"
Strict-Transport-Security
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2392
image07_en.gif
kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		10 B
70 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image07_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1d20 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 00:05:29 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
x-server-cache
false
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
status
200
cache-control
public, max-age=14400
cf-ray
514563e46c7159ee-VIE
expires
Wed, 11 Sep 2019 04:05:29 GMT
image04_en.gif
kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		10 B
116 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image04_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1d20 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 00:05:30 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
x-server-cache
false
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
status
200
cache-control
public, max-age=14400
cf-ray
514563e46c7259ee-VIE
expires
Wed, 11 Sep 2019 04:05:30 GMT
image05_en.gif
kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		10 B
70 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image05_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1d20 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 00:05:29 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
x-server-cache
false
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
status
200
cache-control
public, max-age=14400
cf-ray
514563e47c7459ee-VIE
expires
Wed, 11 Sep 2019 04:05:29 GMT
image08_en.gif
kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/ 		10 B
164 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kubasik.net/public/images/customization/Common/lon_exchange_live_ext_act_logon_page_ag/image08_en.gif
Requested by
Host: kubasik.net
URL: https://kubasik.net/wp-includes/css/uni.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681c:1d20 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://kubasik.net/wp-includes/css/uni.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 11 Sep 2019 00:05:29 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
x-server-cache
false
vary
Accept-Encoding
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html
status
200
cache-control
public, max-age=14400
cf-ray
514563e47c7559ee-VIE
expires
Wed, 11 Sep 2019 04:05:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getHTTPRequestObject function| APMSessionTimeout function| SessionExpired_CustomizedScreenGet boolean| globalRestartOnSubmit function| sessionTimedOut boolean| doNotAutoSubmit string| globalFormId string| globalTableId string| globalSubmitTrId object| globalSavePasswordCheckbox object| globalInputs function| getFormCompatibility function| OnLoad function| checkExternalAddCheckbox function| disableSubmit function| OnSubmit function| verifyNewPassword function| masterSubmit function| initLogon function| redir function| shw function| hd function| clkExp function| clkSec function| clkBsc function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker function| dontChangePasswordClick object| sessionTimeout function| F5_include_JS undefined| f5VirtualKeyboardMove undefined| f5VirtualKeyboardForceBlur undefined| f5VirtualKeyboardMessageText undefined| f5VirtualKeyboardHideText undefined| VirtualKeyboard_CustomizedMessageTextGet undefined| VirtualKeyboard_CustomizedHideTextGet

1 Cookies

Domain/Path Name / Value
.kubasik.net/ Name: __cfduid
Value: d961e40c2512d55f22bd13b666809c8e61568160327