casagri-group.com Open in urlscan Pro
154.16.147.150  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request access.php Show response casagri-group.com/Admin_outlook.office.com/	18 KB 19 KB	954ms 277ms	Document text/html	154.16.147.150 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 154.16.147.150 Denver, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS server.inorlandodigitalmarketing.com Software Apache / Resource Hash 32d8bb7a1ba9a0a3787e53c78273b827ea213814dab216cb212e71478369fc90 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache content-type text/html; charset=UTF-8 date Tue, 09 Nov 2021 08:24:11 GMT server Apache
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 21 KB	36ms 24ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617, 617 age 13757545 cdn-cachedat 2021-06-02 21:47:40 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 8f78f9ccf8666657dc6ea817bdb4e6b7 cf-ray 6ab5a4af7b0e1f99-NRT cdn-requestcountrycode US cdn-requestpullsuccess True
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 14 KB	31ms 19ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 617, 617 age 13757544 cdn-cachedat 2021-06-02 21:50:43 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid d415ea90cc0b2e4d511fff2587c0511b cf-ray 6ab5a4af7b121f99-NRT cdn-requestcountrycode US cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/	85 KB 27 KB	28ms 12ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 4041470 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 27277 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-15283" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Is5aZLz1uwVPS8YB9jwEMerE%2Bt%2Fuuc80oopzDNh8%2F%2FyLGWClegANhvOT2h3NanXBTd3lEnq1g7CIpojq2NI11fSWv%2BR5oqpIEc3OmLkodT0TeVnQzRn198HWjr1NSB%2FplbZJyByw%2FdVQtfxaLDJEniQe"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6ab5a4af7f701d8f-NRT expires Sun, 30 Oct 2022 08:24:11 GMT
GET H2	200	api.js Show response www.google.com/recaptcha/	850 B 970 B	84ms 42ms	Script text/javascript	2404:6800:4004:822::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:822::2004 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 7efcab275e51aa6e9cc922e21ee3b718623130d872ba4a8275737752def952e4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin content-security-policy frame-ancestors 'self' alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 557 x-xss-protection 1; mode=block expires Tue, 09 Nov 2021 08:24:11 GMT
GET H2	200	jquery-2.1.0.min.js Show response code.jquery.com/	82 KB 29 KB	343ms 116ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-2.1.0.min.js Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT content-encoding gzip last-modified Fri, 24 Oct 2014 00:16:07 GMT server nginx etag W/"54499a47-1469f" vary Accept-Encoding x-hw 1636446251.dop207.sj3.t,1636446251.cds219.sj3.hn,1636446251.cds028.sj3.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 29288
GET H2	200	4H5AlEw.png casagri-group.com/Admin_outlook.office.com/	20 KB 20 KB	168ms 168ms	Image image/png	154.16.147.150 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://casagri-group.com/Admin_outlook.office.com/4H5AlEw.png Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 154.16.147.150 Denver, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS server.inorlandodigitalmarketing.com Software Apache / Resource Hash bd0174b3c52b95e3ecaf5ff14014775d9d76e296e123b4db9894ee1b9827a7cd Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT last-modified Fri, 12 Mar 2021 04:57:58 GMT server Apache accept-ranges bytes content-length 20510 content-type image/png
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/kcXVPRWG7fMILHmzon0--fD3/	343 KB 135 KB	71ms 14ms	Script text/javascript	2404:6800:4004:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/kcXVPRWG7fMILHmzon0--fD3/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:811::2003 , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 88e03f37d35232ca4b0f97e30ff63132372cc2235dbb60bc1141fa97a112c64d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://casagri-group.com/ Origin https://casagri-group.com Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 08 Nov 2021 23:59:19 GMT content-encoding gzip x-content-type-options nosniff age 30292 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 137623 x-xss-protection 0 last-modified Mon, 01 Nov 2021 18:13:57 GMT server sffe vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin-allow-popups; report-to="recaptcha" expires Tue, 08 Nov 2022 23:59:19 GMT
GET H2	200	main.js Show response casagri-group.com/Admin_outlook.office.com/	420 B 489 B	169ms 168ms	Script application/javascript	154.16.147.150 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://casagri-group.com/Admin_outlook.office.com/main.js Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 154.16.147.150 Denver, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS server.inorlandodigitalmarketing.com Software Apache / Resource Hash 80ef7516617ff991b8a7041543c4ab254c6e6d36d2fb45a426ee04c7c9308dd5 Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT last-modified Sat, 20 Mar 2021 00:08:48 GMT server Apache accept-ranges bytes content-length 420 content-type application/javascript
GET H2	200	bg.jpg casagri-group.com/Admin_outlook.office.com/	97 KB 97 KB	171ms 171ms	Image image/jpeg	154.16.147.150 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Show image Full URL https://casagri-group.com/Admin_outlook.office.com/bg.jpg Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 154.16.147.150 Denver, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS server.inorlandodigitalmarketing.com Software Apache / Resource Hash fb70fa941895363f2752367d1653dad687732bd052fef86b62c9d09f47b8fbad Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://casagri-group.com/Admin_outlook.office.com/access.php?cliente=733 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Tue, 09 Nov 2021 08:24:11 GMT last-modified Thu, 11 Mar 2021 02:07:24 GMT server Apache accept-ranges bytes content-length 98861 content-type image/jpeg
POST H/1.1	400 Bad Request	send Show response postmail.invotes.com/	36 B 390 B	506ms 145ms	Fetch text/plain	178.128.3.61 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://postmail.invotes.com/send Requested by Host: casagri-group.com URL: https://casagri-group.com/Admin_outlook.office.com/main.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 178.128.3.61 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash 606a7ecd98063824b39e8bd5588f027ed6c7d39f452a98675b58eda3572ce74f Request headers Referer https://casagri-group.com/ Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 content-type application/x-www-form-urlencoded Response headers Access-Control-Allow-Origin https://casagri-group.com Date Tue, 09 Nov 2021 08:24:12 GMT Access-Control-Allow-Headers Origin, Content-Type, Accept, Referer, Accept-Encoding, Accept-Language, Cache-Control, Connection, Content-Length, Cookie, Host, User-Agent Content-Length 36 Content-Type text/plain; charset=utf-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| bootstrap function| $ function| jQuery object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| toParams function| responsive_mobile object| recaptcha

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			casagri-group.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: pqiob64p9mpffg93kc4ul1l9t6

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://postmail.invotes.com/send Message: Failed to load resource: the server responded with a status of 400 (Bad Request)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

casagri-group.com
cdnjs.cloudflare.com
code.jquery.com
maxcdn.bootstrapcdn.com
postmail.invotes.com
www.google.com
www.gstatic.com
154.16.147.150
178.128.3.61
2001:4de0:ac18::1:a:3b
2404:6800:4004:811::2003
2404:6800:4004:822::2004
2606:4700::6810:135e
2606:4700::6812:bcf
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
32d8bb7a1ba9a0a3787e53c78273b827ea213814dab216cb212e71478369fc90
606a7ecd98063824b39e8bd5588f027ed6c7d39f452a98675b58eda3572ce74f
7efcab275e51aa6e9cc922e21ee3b718623130d872ba4a8275737752def952e4
80ef7516617ff991b8a7041543c4ab254c6e6d36d2fb45a426ee04c7c9308dd5
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
88e03f37d35232ca4b0f97e30ff63132372cc2235dbb60bc1141fa97a112c64d
bd0174b3c52b95e3ecaf5ff14014775d9d76e296e123b4db9894ee1b9827a7cd
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d
fb70fa941895363f2752367d1653dad687732bd052fef86b62c9d09f47b8fbad