urlscan.io logo urlscan.io
SecurityTrails logo

khetibuddy.com Open in urlscan Pro
162.241.85.104  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdY...
Effective URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee03...
Submission: On October 06 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 10 HTTP transactions. The main IP is 162.241.85.104, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is khetibuddy.com.
TLS certificate: Issued by R3 on August 29th 2021. Valid for: 3 months.
This is the only time khetibuddy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 54.233.228.78 16509 (AMAZON-02)
1 144.217.158.133 16276 (OVH)
1 10 162.241.85.104 46606 (UNIFIEDLA...)
10 2
Apex Domain
Subdomains		 Transfer
10 khetibuddy.com
khetibuddy.com
391 KB
1 nucmaeirl.net
nucmaeirl.net
22 KB
1 embluemail.com
nt.embluemail.com
217 B
10 3
Domain Requested by
10 khetibuddy.com 1 redirects nucmaeirl.net
khetibuddy.com
1 nucmaeirl.net
1 nt.embluemail.com 1 redirects
10 3

This site contains no links.

Subject Issuer Validity Valid
nucmaeirl.net
R3		 2021-09-13 -
2021-12-12		 3 months crt.sh
www.khetibuddy.com
R3		 2021-08-29 -
2021-11-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Frame ID: CEE06321482EC350B3B43D4E79226B01
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to Outlook

Page URL History Show full URLs

  1. https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6a... HTTP 302
    https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Page URL
  2. https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... HTTP 302
    https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

413 kB
Transfer

603 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fjmartini%40camelbak.com HTTP 302
    https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Page URL
  2. https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$jmartini@camelbak.com HTTP 302
    https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fjmartini%40camelbak.com HTTP 302
  • https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
jmartini@camelbak.com
nucmaeirl.net/m7m/503c06a6/
Redirect Chain
  • https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net...
  • https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com
22 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
144.217.158.133 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
r3.a1center.net
Software
Apache / PHP/5.6.40
Resource Hash

Request headers

Host
nucmaeirl.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 06 Oct 2021 03:06:09 GMT
Server
Apache
X-Powered-By
PHP/5.6.40
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

date
Wed, 06 Oct 2021 03:06:08 GMT
content-type
application/json
content-length
0
location
https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com
x-amzn-requestid
d0d38569-b2ac-4d34-93de-0cb87f8d9883
x-amz-apigw-id
Gw_ZEFAhGjQFQVg=
x-amzn-trace-id
Root=1-615d12a0-1a5301e76af2d1136144cdc7;Sampled=0
Primary Request PS-615d12a9ab9fe
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/
Redirect Chain
  • https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$jmartini@camelbak.com
  • https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
37 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Requested by
Host: nucmaeirl.net
URL: https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
0045a4201d9202a770f0a9e12a531801478ad97e731e6eca44b87203f03f55ef

Request headers

:method
GET
:authority
khetibuddy.com
:scheme
https
:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://nucmaeirl.net/
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
3119
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
x-server-cache
false

Redirect headers

date
Wed, 06 Oct 2021 03:06:17 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
pragma
no-cache
location
./PS-615d12a9ab9fe
x-server-cache
false
set-cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73; path=/
efa9be41263b8da124234d282090ae4e86b965ea5cedb
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-6FDX88/ 		103 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-6FDX88/efa9be41263b8da124234d282090ae4e86b965ea5cedb
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-6FDX88/efa9be41263b8da124234d282090ae4e86b965ea5cedb
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 15:23:18 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public
accept-ranges
bytes
expires
max-age=A10368000, public
2a1cd6524fbd6642ee0e890ea4e8b395d1ba224839bea
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/2a1cd6524fbd6642ee0e890ea4e8b395d1ba224839bea
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/2a1cd6524fbd6642ee0e890ea4e8b395d1ba224839bea
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
content-encoding
gzip
last-modified
Sat, 23 Nov 2019 18:10:04 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=10368000
accept-ranges
bytes
content-length
1522
expires
max-age=A10368000, public
5c2d0a614ae1ee2d48bbea4a6eb296b935e248839fd20
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/ 		513 B
334 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/5c2d0a614ae1ee2d48bbea4a6eb296b935e248839fd20
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/5c2d0a614ae1ee2d48bbea4a6eb296b935e248839fd20
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
content-encoding
gzip
last-modified
Sun, 24 Nov 2019 01:44:20 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=10368000
accept-ranges
bytes
content-length
276
expires
max-age=A10368000, public
2a98ec1a243820239d2e51a490b5a6bdeeef8ebd464b6
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/ 		84 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/2a98ec1a243820239d2e51a490b5a6bdeeef8ebd464b6
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/2a98ec1a243820239d2e51a490b5a6bdeeef8ebd464b6
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 16:23:14 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
expires
max-age=A10368000, public
95e8dd9956262bbbf222b64884ad10ea4c34eea3e10ea
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/ 		50 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/95e8dd9956262bbbf222b64884ad10ea4c34eea3e10ea
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/95e8dd9956262bbbf222b64884ad10ea4c34eea3e10ea
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 16:23:24 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
expires
max-age=A10368000, public
9e1f3ce562d8b14eede3a49aab52204966b288d0bae24
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/9e1f3ce562d8b14eede3a49aab52204966b288d0bae24
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/9e1f3ce562d8b14eede3a49aab52204966b288d0bae24
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 03:06:18 GMT
content-encoding
gzip
last-modified
Fri, 03 Sep 2021 18:38:14 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
content-length
1433
expires
max-age=A10368000, public
api-bbea2dee8966de5ba1408bf39e544da12e6840922c3a2
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-bbea2dee8966de5ba1408bf39e544da12e6840922c3a2?email=jmartini@camelbak.com&data=logo
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
d3d67d692079e0bb899867eb683d3fa5195ed7b2d0ef84d288233e176d10b924

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-bbea2dee8966de5ba1408bf39e544da12e6840922c3a2?email=jmartini@camelbak.com&data=logo
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 03:06:19 GMT
content-encoding
gzip
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/jpeg;
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
content-length
7270
expires
Thu, 19 Nov 1981 08:52:00 GMT
api-644b09a6cfe2ea15eede29b05b1d3a28924b3d462a8e8
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ 		292 KB
294 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-644b09a6cfe2ea15eede29b05b1d3a28924b3d462a8e8?email=jmartini@camelbak.com&data=background
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
4e0892b685d57c0a9cf5da6d8ca4d71f36d6336f4dbefbdc8ff65e417edd0fdf

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-644b09a6cfe2ea15eede29b05b1d3a28924b3d462a8e8?email=jmartini@camelbak.com&data=background
pragma
no-cache
cookie
PHPSESSID=af32b0151f839d54397d5b208ac60b73
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d12a9ab9fe
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 03:06:19 GMT
content-encoding
gzip
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/jpeg;
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep

1 Cookies

Domain/Path Name / Value
khetibuddy.com/ Name: PHPSESSID
Value: af32b0151f839d54397d5b208ac60b73