urlscan.io logo urlscan.io
SecurityTrails logo

ubs-onlineapp-ouf3pqm37.dcfssh.cfd Open in urlscan Pro
161.35.231.220  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://zgodw-mjq.reignindustry.com/CUDYKffqtZHU9bWljJmVydD1jbUZqYUdWc0xuZHBiSE52YmtCMVluTXVZMjl0Jm10PTU=pthq
Effective URL: https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostH...
Submission: On March 10 via api from CH — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 8 domains to perform 16 HTTP transactions. The main IP is 161.35.231.220, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is ubs-onlineapp-ouf3pqm37.dcfssh.cfd.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on March 10th 2022. Valid for: 3 months.
This is the only time ubs-onlineapp-ouf3pqm37.dcfssh.cfd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 165.232.74.215 14061 (DIGITALOC...)
6 161.35.231.220 14061 (DIGITALOC...)
2 2001:4de0:ac1... 20446 (STACKPATH...)
2 2a02:26f0:fb:... 20940 (AKAMAI-ASN1)
1 192.229.221.185 15133 (EDGECAST)
1 2620:1ec:bdf::44 8068 (MICROSOFT...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
2 152.199.23.72 15133 (EDGECAST)
16 8
1    165.232.74.215 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)
zgodw-mjq.reignindustry.com
6    161.35.231.220 (Santa Clara, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
ubs-onlineapp-ouf3pqm37.dcfssh.cfd
iaaanq.tiwqvu.cfd
2    2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
2    2a02:26f0:fb:5b4::35c1 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
secure.aadcdn.microsoftonline-p.com
1    192.229.221.185 (United States)

ASN15133 (EDGECAST, US)
logincdn.msauth.net
1    2620:1ec:bdf::44 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msauth.net
2    2606:4700:3038::6815:ead5 (United States)

ASN13335 (CLOUDFLARENET, US)
iili.io
2    152.199.23.72 (United States)

ASN15133 (EDGECAST, US)
aadcdn.msauthimages.net
Apex Domain
Subdomains		 Transfer
5 tiwqvu.cfd
iaaanq.tiwqvu.cfd
33 KB
2 msauthimages.net
aadcdn.msauthimages.net — Cisco Umbrella Rank: 3813
181 KB
2 iili.io
iili.io — Cisco Umbrella Rank: 123503
8 KB
2 msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 2290
aadcdn.msauth.net — Cisco Umbrella Rank: 1253
2 KB
2 microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com — Cisco Umbrella Rank: 9244
2 KB
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 588
162 KB
1 dcfssh.cfd
ubs-onlineapp-ouf3pqm37.dcfssh.cfd
192 KB
1 reignindustry.com
zgodw-mjq.reignindustry.com
528 B
16 8
Domain Requested by
5 iaaanq.tiwqvu.cfd code.jquery.com
iaaanq.tiwqvu.cfd
2 aadcdn.msauthimages.net
2 iili.io
2 secure.aadcdn.microsoftonline-p.com iaaanq.tiwqvu.cfd
2 code.jquery.com ubs-onlineapp-ouf3pqm37.dcfssh.cfd
iaaanq.tiwqvu.cfd
1 aadcdn.msauth.net iaaanq.tiwqvu.cfd
1 logincdn.msauth.net iaaanq.tiwqvu.cfd
1 ubs-onlineapp-ouf3pqm37.dcfssh.cfd
1 zgodw-mjq.reignindustry.com 1 redirects
16 9

This site contains no links.

Subject Issuer Validity Valid
*.dcfssh.cfd
ZeroSSL RSA Domain Secure Site CA		 2022-03-10 -
2022-06-08		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
*.tiwqvu.cfd
ZeroSSL RSA Domain Secure Site CA		 2022-03-10 -
2022-06-08		 3 months crt.sh
secure.aadcdn.microsoftonline-p.com
Microsoft RSA TLS CA 02		 2021-11-18 -
2022-11-18		 a year crt.sh
identitycdn.msauth.net
DigiCert SHA2 Secure Server CA		 2021-05-13 -
2022-05-13		 a year crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2022-02-22 -
2023-02-22		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-14 -
2022-06-13		 a year crt.sh
aadcdn.msauthimages.net
Microsoft Azure TLS Issuing CA 02		 2021-06-08 -
2022-06-03		 a year crt.sh

This page contains 3 frames:

Primary Page: https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&id=irmeBT&rdir=true&mkt=en-US&psi=&elld=cmFjaGVsLndpbHNvbkB1YnMuY29t&lw=1
Frame ID: 6C79514ED2C14C9A69712E77AAF5CEB9
Requests: 2 HTTP requests in this frame

Frame: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Frame ID: 7342F791C0F0043F3708778E0650AABA
Requests: 14 HTTP requests in this frame

Frame: https://iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/prefetch(1).html
Frame ID: 3CE8A42B12ACD0F5E35D4CB8BD8F3F4A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

  1. https://zgodw-mjq.reignindustry.com/CUDYKffqtZHU9bWljJmVydD1jbUZqYUdWc0xuZHBiSE52YmtCMVluTXVZMjl0Jm10PTU=pthq HTTP 302
    https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

9
Subdomains

8
IPs

3
Countries

581 kB
Transfer

1078 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://zgodw-mjq.reignindustry.com/CUDYKffqtZHU9bWljJmVydD1jbUZqYUdWc0xuZHBiSE52YmtCMVluTXVZMjl0Jm10PTU=pthq HTTP 302
    https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&id=irmeBT&rdir=true&mkt=en-US&psi=&elld=cmFjaGVsLndpbHNvbkB1YnMuY29t&lw=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request f08MAZ7P
ubs-onlineapp-ouf3pqm37.dcfssh.cfd/
Redirect Chain
  • https://zgodw-mjq.reignindustry.com/CUDYKffqtZHU9bWljJmVydD1jbUZqYUdWc0xuZHBiSE52YmtCMVluTXVZMjl0Jm10PTU=pthq
  • https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&i...
192 KB
192 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&id=irmeBT&rdir=true&mkt=en-US&psi=&elld=cmFjaGVsLndpbHNvbkB1YnMuY29t&lw=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.35.231.220 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
01b8a9fa1511a7f31f2bcf95c774b66e91e62f85e637a1e991775ce3dd6e5552

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Thu, 10 Mar 2022 23:14:12 GMT
Server
Apache/2.4.29 (Ubuntu)
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Thu, 10 Mar 2022 23:14:12 GMT
Server
Apache/2.4.29 (Ubuntu)
Location
https://ubs-onlineapp-OuF3pqM37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&id=irmeBT&rdir=true&mkt=en-US&psi=&elld=cmFjaGVsLndpbHNvbkB1YnMuY29t&lw=1#cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1JiZtaWM=
Content-Length
0
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
jquery-3.4.1.js
code.jquery.com/ 		274 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.1.js
Requested by
Host: ubs-onlineapp-ouf3pqm37.dcfssh.cfd
URL: https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&id=irmeBT&rdir=true&mkt=en-US&psi=&elld=cmFjaGVsLndpbHNvbkB1YnMuY29t&lw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55

Request headers

Referer
https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/
Origin
https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 10 Mar 2022 23:14:15 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-4472c"
vary
Accept-Encoding
x-hw
1646954055.dop208.fr8.t,1646954055.cds224.fr8.hn,1646954055.cds288.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
82889
index-m.php
iaaanq.tiwqvu.cfd/common/ Frame 7342 		41 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.35.231.220 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
37078d22db2ac7dfba73628f6c587d46874075cc2419d3b0fae75145e9a832e8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/

Response headers

Date
Thu, 10 Mar 2022 23:14:16 GMT
Server
Apache/2.4.29 (Ubuntu)
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
13527
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
jquery-3.4.1.js
code.jquery.com/ Frame 7342 		274 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.1.js
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55

Request headers

Referer
https://iaaanq.tiwqvu.cfd/
Origin
https://iaaanq.tiwqvu.cfd
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 23:14:16 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-4472c"
vary
Accept-Encoding
x-hw
1646954056.dop208.fr8.t,1646954056.cds224.fr8.hn,1646954056.cds288.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
82889
style.css
iaaanq.tiwqvu.cfd/common/ Frame 7342 		98 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://iaaanq.tiwqvu.cfd/common/style.css
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.35.231.220 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
f47f03ee0e67aff8f795556d4b5e7724375fa1c25907e2e120677f4b512c5486

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 23:14:17 GMT
Content-Encoding
gzip
Last-Modified
Wed, 23 Feb 2022 11:06:40 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"188f5-5d8ad75bfd000-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
18570
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ Frame 7342 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:fb:5b4::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 23:14:17 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 May 2019 23:35:05 GMT
Content-MD5
nzaLxFgP7ZB3dfMcaybWzw==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=382851
Strict-Transport-Security
max-age=31536000
Content-Length
1435
arrow_left.svg
logincdn.msauth.net/16.000.28345.6/images/ Frame 7342 		513 B
752 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://logincdn.msauth.net/16.000.28345.6/images/arrow_left.svg?x=a9cc2824ef3517b6c4160dcf8ff7d410
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F46) /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 10 Mar 2022 23:14:16 GMT
content-encoding
gzip
content-md5
TjUQkZ0p0Y7rbj6LJofS9Q==
age
4884689
x-cache
HIT
content-length
276
x-ms-lease-status
unlocked
last-modified
Sat, 28 Sep 2019 22:18:30 GMT
server
ECAcc (frc/8F46)
etag
0x8D74461CAF84494
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
f806c21e-c01e-004f-8067-081dc4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
aadcdn.msauth.net/shared/1.0/content/images/ Frame 7342 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 10 Mar 2022 23:14:17 GMT
content-encoding
gzip
x-azure-ref-originshield
0lQUnYgAAAADCxfbvLENlSpIkIYCLNk28QU1TMDRFREdFMTgxMQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
6dTbAT1RVL9d6geobv3IJg==
x-cache
TCP_HIT
content-length
606
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jan 2020 19:28:37 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D79B837336B35C
x-azure-ref
0SYYqYgAAAADEPQ9JWuU/QZc+lKGh4mmgRlJBRURHRTEwMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
1564bb71-a01e-0035-631a-329168000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
ellipsis_white.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ Frame 7342 		915 B
640 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.svg?x=5ac590ee72bfe06a7cecfd75b588ad73
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:fb:5b4::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 23:14:17 GMT
Content-Encoding
gzip
Last-Modified
Sat, 18 May 2019 23:34:22 GMT
Content-MD5
HMwsHhNXdtrfirQDkzcqMA==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=45975
Strict-Transport-Security
max-age=31536000
Content-Length
263
ellipsis_grey.svg
iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/ Frame 7342 		127 B
127 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/ellipsis_grey.svg
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.35.231.220 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
0bbad1e771dace3b565cf8605aa20811bb35a075ba4375071d242972d5b59a08

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Thu, 10 Mar 2022 23:14:17 GMT
Server
Apache/2.4.29 (Ubuntu)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
127
Content-Type
text/html; charset=UTF-8
truncated
/ Frame 7342 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9dd254f7263118ecf4f83030e36c3f95a728d3eabfe708f8c423243a9cb9a765

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type
image/png
prefetch(1).html
iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/ Frame 3CE8 		127 B
339 B 		Document
General
Check archive.org
Download Go to
Full URL
https://iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/prefetch(1).html
Requested by
Host: iaaanq.tiwqvu.cfd
URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.35.231.220 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
0bbad1e771dace3b565cf8605aa20811bb35a075ba4375071d242972d5b59a08

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1

Response headers

Date
Thu, 10 Mar 2022 23:14:17 GMT
Server
Apache/2.4.29 (Ubuntu)
Content-Length
127
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
bck.php
iaaanq.tiwqvu.cfd/tools/ Frame 7342 		537 B
596 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://iaaanq.tiwqvu.cfd/tools/bck.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.1.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
161.35.231.220 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
2e743e5b41fa4179a765b65cdcf29a6d3de160bfed5cd55afbecb79dfb050348

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Thu, 10 Mar 2022 23:14:17 GMT
Content-Encoding
gzip
Server
Apache/2.4.29 (Ubuntu)
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
312
1WNx5X.jpg
iili.io/ Frame 7342 		901 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://iili.io/1WNx5X.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ead5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a433a4f7b50f670f4d2ec4f9813cc4216265a3104d6dd4e256eefb7fcb87518e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 23:14:17 GMT
access-control-allow-methods
GET, OPTIONS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
306717
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
901
last-modified
Wed, 23 Feb 2022 11:02:48 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mci5DEOkImniGKKhIBjC6IlagPQmd9%2B4XaYAB0%2B5sRZT1eWV%2BV6YyBRdPsh%2FTR%2BLiKWxeI1ipGz0N2aXwYkgQD26yCiV7S4vwwPO%2B4hp4j7GhwncoYIJQ6qS2sQq3x8fZ0Ok%2F5Zc"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
6e9fbeecc99f913c-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
1WNzen.md.jpg
iili.io/ Frame 7342 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://iili.io/1WNzen.md.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3038::6815:ead5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36bcfd452caf72c27d4b05f4dcd128361930e982ac174907b011bb26a293504c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Thu, 10 Mar 2022 23:14:17 GMT
access-control-allow-methods
GET, OPTIONS
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
306717
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6536
last-modified
Wed, 23 Feb 2022 11:02:48 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oC5c1g3VVNzOQGx0b8UO3Zrt%2BMryuqw5PrlsJwzmFrhfzsevaln1G03oSlmE%2FEl2zh81CMa6awV%2BBcnmUIT%2FaAHCivrT3glgo4O3PwNpbL4fHZq7I819OLnIyNtgqghZexu%2B0RJa"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
6e9fbeecc9a0913c-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
illustration
aadcdn.msauthimages.net/c1c6b6c8-3ryhipbfkhxxwptmyqh8tcus4iat4acfnhdjhttbkbi/logintenantbranding/0/ Frame 7342 		177 KB
177 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauthimages.net/c1c6b6c8-3ryhipbfkhxxwptmyqh8tcus4iat4acfnhdjhttbkbi/logintenantbranding/0/illustration?ts=637058688689463941
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.72 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8EA4) /
Resource Hash
211e89dcc5460b0c293778b55b17083ad9746f6cf6933d2ee6cb3e3e02510f74

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Thu, 10 Mar 2022 23:14:18 GMT
last-modified
Sat, 05 Oct 2019 10:41:09 GMT
server
ECAcc (frc/8EA4)
content-md5
UIlniE3ZQkM/ZJvFqIb9sA==
age
37545
etag
0x8D7498088AF4773
x-cache
HIT
content-type
image/*
x-ms-request-id
afa9537b-a01e-0009-557d-3436bc000000
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
181357
bannerlogo
aadcdn.msauthimages.net/c1c6b6c8-3ryhipbfkhxxwptmyqh8tcus4iat4acfnhdjhttbkbi/logintenantbranding/0/ Frame 7342 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauthimages.net/c1c6b6c8-3ryhipbfkhxxwptmyqh8tcus4iat4acfnhdjhttbkbi/logintenantbranding/0/bannerlogo?ts=637058688700493492
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.23.72 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FF9) /
Resource Hash
1f837abaddb5c3e023bc239d100dbacdd0b4c54ac42856eccfd6843455b54c7e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iaaanq.tiwqvu.cfd/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Thu, 10 Mar 2022 23:14:18 GMT
last-modified
Sat, 05 Oct 2019 10:41:10 GMT
server
ECAcc (frc/8FF9)
content-md5
3cnBSoPF3gnuynqpMMTYdQ==
age
37545
etag
0x8D74980893A6B62
x-cache
HIT
content-type
image/*
x-ms-request-id
868dc870-d01e-0006-1f7d-34db4a000000
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
2952

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored string| crypt_data function| cryptor function| $ function| jQuery function| makeid function| action

0 Cookies

6 Console Messages

Source Level URL
Text
network error URL: https://ubs-onlineapp-ouf3pqm37.dcfssh.cfd/f08MAZ7P?wreply=/web/login?en=signin?client_id=wlSQf3&redirect_uri=https%3A%2F%2F%2FAuth%2FPostHandler&state=5Rn7qNvM-0Vk4-n7Wb-v2ly-IRq30NJuAx1n&lc=&lc&id=irmeBT&rdir=true&mkt=en-US&psi=&elld=cmFjaGVsLndpbHNvbkB1YnMuY29t&lw=1#cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1JiZtaWM=
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.4.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.4.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
security error URL: https://iaaanq.tiwqvu.cfd/common/index-m.php?ijbgtrf=cmFjaGVsLndpbHNvbkB1YnMuY29tOjo1(Line 250)
Message:
Blocked autofocusing on a <input> element in a cross-origin subframe.
network error URL: https://iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/ellipsis_grey.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://iaaanq.tiwqvu.cfd/common/Sign%20in%20to%20your%20account_files/prefetch(1).html
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msauthimages.net
code.jquery.com
iaaanq.tiwqvu.cfd
iili.io
logincdn.msauth.net
secure.aadcdn.microsoftonline-p.com
ubs-onlineapp-ouf3pqm37.dcfssh.cfd
zgodw-mjq.reignindustry.com
152.199.23.72
161.35.231.220
165.232.74.215
192.229.221.185
2001:4de0:ac18::1:a:3b
2606:4700:3038::6815:ead5
2620:1ec:bdf::44
2a02:26f0:fb:5b4::35c1
01b8a9fa1511a7f31f2bcf95c774b66e91e62f85e637a1e991775ce3dd6e5552
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0bbad1e771dace3b565cf8605aa20811bb35a075ba4375071d242972d5b59a08
1f837abaddb5c3e023bc239d100dbacdd0b4c54ac42856eccfd6843455b54c7e
211e89dcc5460b0c293778b55b17083ad9746f6cf6933d2ee6cb3e3e02510f74
2e743e5b41fa4179a765b65cdcf29a6d3de160bfed5cd55afbecb79dfb050348
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36bcfd452caf72c27d4b05f4dcd128361930e982ac174907b011bb26a293504c
37078d22db2ac7dfba73628f6c587d46874075cc2419d3b0fae75145e9a832e8
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
9dd254f7263118ecf4f83030e36c3f95a728d3eabfe708f8c423243a9cb9a765
a433a4f7b50f670f4d2ec4f9813cc4216265a3104d6dd4e256eefb7fcb87518e
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
f47f03ee0e67aff8f795556d4b5e7724375fa1c25907e2e120677f4b512c5486