phja81vt4zm2753xe960gybd.z13.web.core.windows.net
Open in
urlscan Pro
52.239.221.231
Malicious Activity!
Public Scan
Submission: On September 11 via manual from CA — Scanned from CA
Summary
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 04 on August 23rd 2024. Valid for: a year.
This is the only time phja81vt4zm2753xe960gybd.z13.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 52.239.221.231 52.239.221.231 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 142.251.35.168 142.251.35.168 | 15169 (GOOGLE) (GOOGLE) | |
16 | 154.41.250.108 154.41.250.108 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
1 | 142.250.80.110 142.250.80.110 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.67.208.186 172.67.208.186 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
25 | 6 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
phja81vt4zm2753xe960gybd.z13.web.core.windows.net |
ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f14.1e100.net
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
nerdinthebrain.com
nerdinthebrain.com |
200 KB |
4 |
windows.net
phja81vt4zm2753xe960gybd.z13.web.core.windows.net |
24 KB |
1 |
userstatics.com
userstatics.com — Cisco Umbrella Rank: 303208 |
675 B |
1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 104 |
|
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 112 |
103 KB |
0 |
microsoft.com
Failed
support.microsoft.com Failed |
|
25 | 6 |
Domain | Requested by | |
---|---|---|
16 | nerdinthebrain.com |
phja81vt4zm2753xe960gybd.z13.web.core.windows.net
|
4 | phja81vt4zm2753xe960gybd.z13.web.core.windows.net |
phja81vt4zm2753xe960gybd.z13.web.core.windows.net
|
1 | userstatics.com |
nerdinthebrain.com
|
1 | www.google-analytics.com |
www.googletagmanager.com
|
1 | www.googletagmanager.com |
phja81vt4zm2753xe960gybd.z13.web.core.windows.net
|
0 | support.microsoft.com Failed |
phja81vt4zm2753xe960gybd.z13.web.core.windows.net
|
25 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft Azure RSA TLS Issuing CA 04 |
2024-08-23 - 2025-08-18 |
a year | crt.sh |
*.google-analytics.com WR2 |
2024-08-12 - 2024-11-04 |
3 months | crt.sh |
nerdinthebrain.com R10 |
2024-07-27 - 2024-10-25 |
3 months | crt.sh |
userstatics.com WE1 |
2024-07-24 - 2024-10-22 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://phja81vt4zm2753xe960gybd.z13.web.core.windows.net/?msclkid=3cf2f4b4cf621fbc99a192552b2902d1
Frame ID: AA95CF253A37F34BFF1D086A6A7A4691
Requests: 25 HTTP requests in this frame
Frame:
https://support.microsoft.com/contactus
Frame ID: 6C10D1B4971E1DB5EA2A46C7C89C098B
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Microsoft Security center AlertDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Analytics (Analytics) Expand
Detected patterns
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ |
22 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
309 KB 103 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tapa.css
nerdinthebrain.com/itez/bb/css/ |
20 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
nerdinthebrain.com/itez/bb/css/ |
216 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
nerdinthebrain.com/itez/bb/js/ |
83 KB 29 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
bootstrap.min.js
nerdinthebrain.com/itez/bb/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
nerdinthebrain.com/itez/bb/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
esc.js
nerdinthebrain.com/itez/bb/js/ |
99 B 479 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flscn.js
nerdinthebrain.com/itez/bb/js/ |
269 B 530 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
nerdinthebrain.com/itez/bb/js/ |
2 KB 1009 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mnc.png
nerdinthebrain.com/itez/bb/images/ |
484 B 721 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
msmm.png
nerdinthebrain.com/itez/bb/images/ |
474 B 712 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
set.png
nerdinthebrain.com/itez/bb/images/ |
360 B 588 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vsc.png
nerdinthebrain.com/itez/bb/images/ |
992 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
scn.png
nerdinthebrain.com/itez/bb/images/ |
3 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg1.png
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/images/ |
321 B 321 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bel.png
nerdinthebrain.com/itez/bb/images/ |
364 B 592 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1.webp
nerdinthebrain.com/itez/bb/images/ |
10 KB 10 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 0 |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
contactus
support.microsoft.com/ Frame 6C10 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
349 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
beep.mp3
nerdinthebrain.com/itez/bb/media/ |
8 KB 9 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
eng.mp3
nerdinthebrain.com/itez/bb/media/ |
108 KB 108 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
userstatics.com/get/ |
133 B 675 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
w3.html
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ |
321 B 629 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
w1.html
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ |
321 B 629 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- nerdinthebrain.com
- URL
- https://nerdinthebrain.com/itez/bb/js/bootstrap.min.js
- Domain
- support.microsoft.com
- URL
- https://support.microsoft.com/contactus
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal function| $ function| jQuery function| chat function| vhdydjwhcnfyhecnfheucncevi function| showd2 function| beep1 number| isNS function| mischandler function| mousehandler function| win_onkeydown_handler function| addEvent3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.windows.net/ | Name: _ga_F9ZFHN0DV3 Value: GS1.1.1726082858.1.0.1726082858.0.0.0 |
|
.windows.net/ | Name: _ga Value: GA1.1.199059336.1726082859 |
|
phja81vt4zm2753xe960gybd.z13.web.core.windows.net/ | Name: PHPREFS Value: full |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nerdinthebrain.com
phja81vt4zm2753xe960gybd.z13.web.core.windows.net
support.microsoft.com
userstatics.com
www.google-analytics.com
www.googletagmanager.com
nerdinthebrain.com
support.microsoft.com
142.250.80.110
142.251.35.168
154.41.250.108
172.67.208.186
52.239.221.231
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
09cf97bd2bb28c6402f40943be1134b171626c5006d795be3e99b92957255659
0b2ec8ec8e4677ed296b07891de45bbb1fb301eaa2840968462fb704f216bd07
2595e57e581712bacbbb36e04af8eca3911068fc15fe527fd048ee5562ebc61e
33ccd8e22b64f8375988afca456e153a82a1f27d601b7bd40261edb4ae2a4c7d
34ccdb50687c38ca7f6f04c46aaba862b1e93f6bd1ab158915a4ae1034f2e65e
3616cf46b53ecac41813d66874380a99715b0b31baf1c27c5db0ba320b9369c8
36c93ecca4ea10ed850a8b04465a4141f6afc135419d644181e63a98da87a376
436ecc90fab5ed1034b68a4a0e924e0132d93d9e7fb59b4fe23018eb7d9242c1
44f752b0bd2e48052d538bc6aca5379f3630ca64da945f794690ddf47e8eaef7
458065441358714a3d8d72dbb55b98de5f274a030d44cc117eea1fb038c08299
48ff940e394fb1968b729c29a719aac4e64c6943e32a77d74f0ddd84db8ccfba
71bfb296313c3c1a5055e979377ad542d9d956b4d776327bfc960406670dd725
94938f012d4be173e3e8b11506268736d896fbca6cffde2c720ca6643e589637
9ae576d046412fe6c21a1e0d4944f24bd5644fa152df968b1bdfb5dcf1585279
9fa4f2ad709ff397d792afa42087c38ac2d13ac10ee104e557f594ffbf93a603
a7f0e4544075c15917ec572b96858df8d706288c67005eac4f4477447e9e8f65
b1098c75a9bc4839db72b8a943c233f1f1cc8f1aa9baa3a768fd69b027514de5
b42cb5cd1ea79aac70cc6bde05beb4602a511bfd21b9fdd4cbfa8c974dd042b9
ce26d1b76dae2f3b5d0ccc8d0ecd88d2edb411101b8a4c5edc4d9aa7008c9b04
df9690fea031319de38a437cb6d393026c4aae70642ed394c4254ed64f035b26
f0cea24a9aa91f2a46a2b70f8f34d2837f57377d618dab0e4e08df8743016934
f3b1fd5811eabd05f9c80b3bdbe115c557cfb42c62110ebce22e4d3cddd8465f