collab.ms
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Submission Tags: https://sinking.yachts sinking-yachts phishing Search All
Submission: On July 03 via api from US — Scanned from NL
Summary
TLS certificate: Issued by E1 on June 28th 2023. Valid for: 3 months.
This is the only time collab.ms was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 198.251.82.65 198.251.82.65 | 53667 (PONYNET) (PONYNET) | |
| 2 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 1 |
lain.la
pomf2.lain.la — Cisco Umbrella Rank: 380467 |
155 KB |
| 1 |
collab.ms
collab.ms |
518 B |
| 2 | 2 |
| Domain | Requested by | |
|---|---|---|
| 1 | pomf2.lain.la |
collab.ms
|
| 1 | collab.ms | |
| 2 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| collab.ms E1 |
2023-06-28 - 2023-09-26 |
3 months | crt.sh |
| *.lain.la R3 |
2023-04-30 - 2023-07-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://collab.ms/
Frame ID: 49E53F615E26096B8D402A500659A7AB
Requests: 2 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
collab.ms/ |
82 B 518 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jdtol6p.jpeg
pomf2.lain.la/f/ |
155 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Malicious
task.url
Submitted on
July 3rd 2023, 2:38:23 pm
UTC —
From United States
Threats:
Phishing
Scam
Comment: This domain is present in the Sinking Yachts anti-phishing list. More Info: https://sinking.yachts
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
collab.ms
pomf2.lain.la
198.251.82.65
2a06:98c1:3120::3
3856ba06a269453337a237c8125a63bb77370fb19f32c7c96f1e60bba5f20677
5ad140c5bcfb4a7a14767dfc0f6126b0fbc12ab077235f2265b355cac25cb1ad