maiban2.hizqui.com Open in urlscan Pro
104.203.241.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://maiban2.hizqui.com/indexx.htm
Submission: On March 16 via automatic, source openphish (March 16th 2017, 10:52:37 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 104.203.241.3, located in Los Angeles, United States and belongs to ENZUINC-US - Enzu Inc, US. The main domain is maiban2.hizqui.com.

This is the only time maiban2.hizqui.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
10	104.203.241.3 104.203.241.3	18978 (ENZUINC-US) (ENZUINC-US - Enzu Inc)
4	2a02:26f0:78:... 2a02:26f0:78:1a3::fb1	20940 (AKAMAI-ASN1 ) (AKAMAI-ASN1 )
17	3

10 104.203.241.3 (Los Angeles, United States)

ASN18978 (ENZUINC-US - Enzu Inc, US)
PTR: server.hzqserver10.info

maiban2.hizqui.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pinkmagazine.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:78:1a3::fb1 (European Union)

ASN20940 (AKAMAI-ASN1 , US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pinkmagazine.com.br pinkmagazine.com.br Failed	446 KB
4	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	207 KB
2	hizqui.com maiban2.hizqui.com	411 B
0	office.com Failed portal.office.com Failed
17	4

	Domain	Requested by
8	pinkmagazine.com.br	pinkmagazine.com.br
4	secure.aadcdn.microsoftonline-p.com	pinkmagazine.com.br maiban2.hizqui.com
2	maiban2.hizqui.com
0	portal.office.com Failed	pinkmagazine.com.br
17	4

This site contains no links.

Subject Issuer	Validity	Valid
secure.aadcdn.microsoftonline-p.com Symantec Class 3 Secure Server CA - G4	`2016-09-01` - `2017-09-01`	a year	crt.sh

This page contains 3 frames:

Frame: http://pinkmagazine.com.br/tty/365off/
Frame ID: 21638.1
Requests: 3 HTTP requests in this frame

Frame: http://pinkmagazine.com.br/tty/365off/
Frame ID: 21648.1
Requests: 13 HTTP requests in this frame

Frame: https://portal.office.com/Prefetch/Prefetch.aspx
Frame ID: 21648.2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

17
Requests

24 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

654 kB
Transfer

659 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request 12

https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
https://portal.office.com/Prefetch/Prefetch.aspx

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request indexx.htm Show response
maiban2.hizqui.com/ 83 B
83 B 403ms
117ms Document
text/html 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://maiban2.hizqui.com/indexx.htm
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: 9da347a906d2f7a016e76055a9c15f5d9a35f696a17f7e20f9d7dc777fd5de56

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: maiban2.hizqui.com
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:30 GMT
Last-Modified: Thu, 16 Mar 2017 22:22:05 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 83

GET /
pinkmagazine.com.br/tty/365off/ 0
0

GET
H/1.1 404
Not Found favicon.ico
maiban2.hizqui.com/ 328 B
328 B 117ms
117ms Other
text/html 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://maiban2.hizqui.com/favicon.ico
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: 6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: maiban2.hizqui.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://maiban2.hizqui.com/indexx.htm
Connection: keep-alive
Cache-Control: no-cache
Referer: http://maiban2.hizqui.com/indexx.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:30 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 328
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK / Show response
pinkmagazine.com.br/tty/365off/ Frame 2164 43 KB
43 KB 368ms
117ms Document
text/html 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: 1eb99e656294477b7608bddcc60ec0535a9909c7fecbed4c51f04a9d14042b59

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://maiban2.hizqui.com/indexx.htm
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: http://maiban2.hizqui.com/indexx.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:30 GMT
Last-Modified: Sat, 11 Mar 2017 11:11:20 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 44301

GET
H/1.1 200
OK login.css
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 21 KB
21 KB 235ms
117ms Stylesheet
text/css 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/login.css
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: b5ea0ffbe39f577651336a1aba7746881cf235b9f7ccc1c51b151162b3da4feb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:30 GMT
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 21545

GET
H/1.1 200
OK login_hover.css
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 89 B
89 B 824ms
702ms Stylesheet
text/css 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/login_hover.css
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: 91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:31 GMT
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 89

GET
H/1.1 200
OK jquery.js Show response
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 108 KB
108 KB 244ms
122ms Script
application/javascript 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/jquery.js
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: 2003c45a664c537bff032215f50510bf29a11df99a130960e19d2e2036205850

Request headers

Pragma: no-cache
Origin: http://pinkmagazine.com.br
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: http://pinkmagazine.com.br/tty/365off/
Origin: http://pinkmagazine.com.br

Response headers

Date: Thu, 16 Mar 2017 22:52:30 GMT
X-Pad: avoid browser bug
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 110160

GET
H/1.1 200
OK aad.js Show response
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 174 KB
174 KB 825ms
704ms Script
application/javascript 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/aad.js
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: d422d055fc7e99b9a2356023659180e91ee818697425f9f488a103a9c10b38e6

Request headers

Pragma: no-cache
Origin: http://pinkmagazine.com.br
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: http://pinkmagazine.com.br/tty/365off/
Origin: http://pinkmagazine.com.br

Response headers

Date: Thu, 16 Mar 2017 22:52:31 GMT
X-Pad: avoid browser bug
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 178303

GET
H/1.1 200
OK heroillustration.jpg
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 95 KB
95 KB 122ms
121ms Image
image/jpeg 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/heroillustration.jpg
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:31 GMT
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 203294

GET
H/1.1 200
OK bannerlogo.png
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 4 KB
4 KB 122ms
122ms Image
image/png 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/bannerlogo.png
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://pinkmagazine.com.br/tty/365off/
Cookie: testcookie=testcookie
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:31 GMT
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4585

GET
H/1.1 200
OK microsoft_logo.png
pinkmagazine.com.br/tty/365off/index_files/ Frame 2164 1 KB
1 KB 123ms
122ms Image
image/png 104.203.241.3
Enzu Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pinkmagazine.com.br/tty/365off/index_files/microsoft_logo.png
Requested by: Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/
Protocol: HTTP/1.1
Server: 104.203.241.3 Los Angeles, United States, ASN18978 (ENZUINC-US - Enzu Inc, US),
Reverse DNS: server.hzqserver10.info
Software: Apache /
Resource Hash: 988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: pinkmagazine.com.br
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://pinkmagazine.com.br/tty/365off/
Cookie: testcookie=testcookie
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:31 GMT
Last-Modified: Sat, 11 Mar 2017 10:45:10 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1040

GET
H/1.1 200
OK login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5623.13/content/cdnbundles/ Frame 2164 89 B
82 B 46ms
6ms Stylesheet
text/css 2a02:26f0:78:1a3::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5623.13/content/cdnbundles/login_hover.min.css

Requested by

Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:78:1a3::fb1 , European Union, ASN20940 (AKAMAI-ASN1 , US),

Reverse DNS

Software

Resource Hash

91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: secure.aadcdn.microsoftonline-p.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:31 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Mar 2017 23:08:14 GMT
Content-MD5: k+LdzPr5J17LuCAOBMVTBQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=13663
Strict-Transport-Security: max-age=31536000
Content-Length: 82

GET
H/1.1 200
OK watson.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.5623.13/content/cdnbundles/ Frame 2164 9 KB
4 KB 192ms
192ms Script
application/x-javascript 2a02:26f0:78:1a3::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5623.13/content/cdnbundles/watson.min.js

Requested by

Host: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:78:1a3::fb1 , European Union, ASN20940 (AKAMAI-ASN1 , US),

Reverse DNS

Software

Resource Hash

9b5900571285ad0f6198cbf9fe92d81e9c5ed6f49cfd816d2a762d64d6ab6e14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: secure.aadcdn.microsoftonline-p.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:32 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Mar 2017 23:08:28 GMT
Content-MD5: 2Gsh6ZEsKdg5iZrrjTfhqA==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Strict-Transport-Security: max-age=31536000
Content-Length: 4076

GET

Prefetch.aspx
portal.office.com/Prefetch/ Frame 2164
Redirect Chain

https://portal.microsoftonline.com/Prefetch/Prefetch.aspx
https://portal.office.com/Prefetch/Prefetch.aspx

0
0

GET
H/1.1 200
OK bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ Frame 2164 4 KB
4 KB 19ms
6ms Image
image/png 2a02:26f0:78:1a3::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/bannerlogo?ts=635974776182591704

Requested by

Host: maiban2.hizqui.com
URL: http://maiban2.hizqui.com/indexx.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:78:1a3::fb1 , European Union, ASN20940 (AKAMAI-ASN1 , US),

Reverse DNS

Software

Resource Hash

fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: secure.aadcdn.microsoftonline-p.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:32 GMT
Last-Modified: Thu, 28 Apr 2016 22:00:18 GMT
Content-MD5: nwmifU9ps1V8dDNXSinXJg==
x-ms-write-protection: false
Connection: keep-alive
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14969
Strict-Transport-Security: max-age=31536000
Content-Length: 4585

GET
H/1.1 200
OK heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/ Frame 2164 199 KB
199 KB 20ms
7ms Image
image/jpeg 2a02:26f0:78:1a3::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-6ybrougjmflxqw910ieyohr7wb4x4-yvoixrlaidmz4/appbranding/askzfdsqe20i-bcjwporaywega7vbt4acqnn1hiliiw/0/heroillustration?ts=635974776187911809

Requested by

Host: maiban2.hizqui.com
URL: http://maiban2.hizqui.com/indexx.htm

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:78:1a3::fb1 , European Union, ASN20940 (AKAMAI-ASN1 , US),

Reverse DNS

Software

Resource Hash

7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: secure.aadcdn.microsoftonline-p.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://pinkmagazine.com.br/tty/365off/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://pinkmagazine.com.br/tty/365off/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Thu, 16 Mar 2017 22:52:32 GMT
Last-Modified: Thu, 28 Apr 2016 22:00:18 GMT
Content-MD5: ZSg7Ej6yNeYXaumMAqxbHA==
x-ms-write-protection: false
Connection: keep-alive
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=14969
Strict-Transport-Security: max-age=31536000
Content-Length: 203294

POST watson
pinkmagazine.com.br/common/handlers/ Frame 2164 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/tty/365off/

Domain: portal.office.com
URL: https://portal.office.com/Prefetch/Prefetch.aspx

Domain: pinkmagazine.com.br
URL: http://pinkmagazine.com.br/common/handlers/watson

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

maiban2.hizqui.com
pinkmagazine.com.br
portal.office.com
secure.aadcdn.microsoftonline-p.com
pinkmagazine.com.br
portal.office.com
104.203.241.3
2a02:26f0:78:1a3::fb1
1eb99e656294477b7608bddcc60ec0535a9909c7fecbed4c51f04a9d14042b59
2003c45a664c537bff032215f50510bf29a11df99a130960e19d2e2036205850
6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
9b5900571285ad0f6198cbf9fe92d81e9c5ed6f49cfd816d2a762d64d6ab6e14
9da347a906d2f7a016e76055a9c15f5d9a35f696a17f7e20f9d7dc777fd5de56
b5ea0ffbe39f577651336a1aba7746881cf235b9f7ccc1c51b151162b3da4feb
d422d055fc7e99b9a2356023659180e91ee818697425f9f488a103a9c10b38e6
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

maiban2.hizqui.com Open in urlscan Pro 104.203.241.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

17 Requests

24 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

654 kBTransfer

659 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

maiban2.hizqui.com Open in urlscan Pro
104.203.241.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

24 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

654 kB
Transfer

659 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!