sxbnlt5xzx.famils.tech
Open in
urlscan Pro
162.0.219.35
Malicious Activity!
Public Scan
Effective URL: https://sxbnlt5xzx.famils.tech/m/9a427ce772c91a4d35ee47de6c656ce3.html
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On September 21 via api from CA — Scanned from CH
Summary
TLS certificate: Issued by R3 on September 21st 2023. Valid for: 3 months.
This is the only time sxbnlt5xzx.famils.tech was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 7 | 162.0.219.35 162.0.219.35 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 216.24.57.253 216.24.57.253 | 397273 (RENDER) (RENDER) | |
1 | 104.237.62.212 104.237.62.212 | 18450 (WEBNX) (WEBNX) | |
1 | 199.192.19.136 199.192.19.136 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
10 | 5 |
ASN22612 (NAMECHEAP-NET, US)
PTR: svr.mainhostpage.tech
sxbnlt5xzx.famils.tech |
ASN18450 (WEBNX, US)
PTR: hosted-by.racknerd.com
api.ipify.org |
ASN22612 (NAMECHEAP-NET, US)
PTR: svr4.dkshostcook.host
qax7neercj.othelen.pics |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
famils.tech
2 redirects
sxbnlt5xzx.famils.tech |
26 KB |
2 |
onrender.com
x1outhy.onrender.com |
223 KB |
1 |
othelen.pics
qax7neercj.othelen.pics |
5 KB |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2769 |
224 B |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 720 |
30 KB |
10 | 5 |
Domain | Requested by | |
---|---|---|
7 | sxbnlt5xzx.famils.tech |
2 redirects
sxbnlt5xzx.famils.tech
|
2 | x1outhy.onrender.com |
sxbnlt5xzx.famils.tech
|
1 | qax7neercj.othelen.pics |
ajax.googleapis.com
|
1 | api.ipify.org |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
sxbnlt5xzx.famils.tech
|
10 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.sxbnlt5xzx.famils.tech R3 |
2023-09-21 - 2023-12-20 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-09-04 - 2023-11-27 |
3 months | crt.sh |
onrender.com Cloudflare Inc ECC CA-3 |
2023-09-17 - 2024-09-16 |
a year | crt.sh |
*.ipify.org Sectigo RSA Domain Validation Secure Server CA |
2023-02-07 - 2024-02-18 |
a year | crt.sh |
www.qax7neercj.othelen.pics R3 |
2023-08-28 - 2023-11-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sxbnlt5xzx.famils.tech/m/9a427ce772c91a4d35ee47de6c656ce3.html
Frame ID: BEC4A6351431F1C3B0567FB7306B2FFD
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
HI1TRKO7DPM35MZYHJHSPage URL History Show full URLs
-
http://sxbnlt5xzx.famils.tech/
HTTP 301
https://sxbnlt5xzx.famils.tech/ HTTP 302
https://sxbnlt5xzx.famils.tech/m/9a427ce772c91a4d35ee47de6c656ce3.html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://sxbnlt5xzx.famils.tech/
HTTP 301
https://sxbnlt5xzx.famils.tech/ HTTP 302
https://sxbnlt5xzx.famils.tech/m/9a427ce772c91a4d35ee47de6c656ce3.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
9a427ce772c91a4d35ee47de6c656ce3.html
sxbnlt5xzx.famils.tech/m/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
RXHP5PF1C2PS7Y35DO2EB1XEP
sxbnlt5xzx.famils.tech/m/sm/ |
106 KB 18 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.0/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mlg.svg
sxbnlt5xzx.famils.tech/m/mxl/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sig_op.svg
sxbnlt5xzx.famils.tech/m/mxl/ |
2 KB 990 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
authy.js
x1outhy.onrender.com/ |
402 KB 152 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
encrytCode.js
x1outhy.onrender.com/ |
195 KB 72 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
B1P6U07G79R80ACDVBQJFD6IQ
sxbnlt5xzx.famils.tech/m/bxg/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
24 B 224 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
qax7neercj.othelen.pics/ |
5 KB 5 KB |
XHR
application/php |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)105 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery string| pagemsg string| semail string| urlx string| lmode function| _0x520f22 function| _0x4e6c8e function| _0x405819 function| _0x3425e3 function| _0x3ff22b object| _0x3a3d6e object| Errs string| email function| _0x505539 string| epass string| phone object| dVal function| _0x49937e object| lVal object| pages string| Key string| randomNum number| skip undefined| myInterval undefined| Proofs undefined| Timeout string| IP undefined| GetCredential number| mhost string| pgtype function| getpage function| isEmail function| nextto function| select_account function| back function| cancel number| count number| lcount function| redlogin function| _0x15ef function| setCookie function| auth function| auth_live function| _0x1e2f63 function| getproof function| SendCodeLive function| ihacode function| _0xa80e77 function| VerifyCodeLive function| GotoAuth function| authback function| GotoType function| AuthEdata function| verifyOTC function| beginAuth number| PollCount function| endAuth function| processAuth function| _0x9cad function| startEndath function| _0x324c37 function| stopEndath function| datetoiso function| dec2hex function| generateId string| SesIN function| _0x3aa737 function| _0x42684f function| _0x1a4ce1 function| _0x8de6f3 function| _0xc2195 function| _0x508af5 function| _0x660f function| Encrypt function| PackageSADataForProof function| parseRSAKeyFromString function| hexStringToMP function| JSMPnumber function| applyPKCSv2Padding function| SHA1 function| PadSHA1Input function| SHA1RoundFunction function| rotateLeft function| wordToBytes function| MGF function| duplicateMP function| modularMultiply function| multiplyMP function| removeLeadingZeroes function| mpToByteArray function| multiplyAndSubtract function| normalizeJSMP function| divideMP function| _0x4e53 function| modularExp function| byteArrayToMP function| XORarrays function| RSAEncrypt function| mapByteToBase64 function| base64Encode function| byteArrayToBase64 function| RSAEncryptBlock function| _0x540dfa2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sxbnlt5xzx.famils.tech/ | Name: PHPSESSID Value: 9b749c9a90999ec2c2df3a0b3f5daf05 |
|
sxbnlt5xzx.famils.tech/ | Name: rt Value: 9a427ce772c91a4d35ee47de6c656ce3.html |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipify.org
qax7neercj.othelen.pics
sxbnlt5xzx.famils.tech
x1outhy.onrender.com
104.237.62.212
162.0.219.35
199.192.19.136
216.24.57.253
2a00:1450:4001:811::200a
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1af8ef15b35929f095bc09b5ca982ed85312388a5f74e716a77d8857d4f26fc3
48edb323cd0ea984bb3c4679e3a4280fd99274631c7398820f84325992f95e25
624d62ff5695d29cf6df6e04563ba0ac761857d985ba2ecce2ebb7bd5aaa51b3
74e6acf80fff7c4e7906dbbb51f353be2cf435d48bac6c30d7fff54acf32a279
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
932974a2d9966e2e6e45882d3d4b8e81293c79934a0ab235e112bffcea506ce9
b294d339f709a0620968800517ed512f5ea76a8d06959ff59f6f2ec6f3fdcdb7
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855