Submitted URL: http://unikaradio.com/lite/swf/mine/source/?email=slittle@loyola.edu
Effective URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.125289...
Submission: On September 28 via manual from US

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 192.99.7.177, located in Montréal, Canada and belongs to OVH, FR. The main domain is unikaradio.com.
This is the only time unikaradio.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 6 192.99.7.177 16276 (OVH)
2 2a02:26f0:10c... 20940 (AKAMAI-ASN1)
7 2
Apex Domain
Subdomains
Transfer
6 unikaradio.com
unikaradio.com
118 KB
2 microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com
84 KB
7 2
Domain Requested by
6 unikaradio.com 1 redirects unikaradio.com
2 secure.aadcdn.microsoftonline-p.com unikaradio.com
7 2

This site contains no links.

Subject Issuer Validity Valid
secure.aadcdn.microsoftonline-p.com
Microsoft IT TLS CA 1
2017-08-15 -
2019-08-15
2 years crt.sh

This page contains 1 frames:

Primary Page: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 8259.1
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://unikaradio.com/lite/swf/mine/source/?email=slittle@loyola.edu HTTP 302
    http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.177... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

7
Requests

29 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

202 kB
Transfer

411 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://unikaradio.com/lite/swf/mine/source/?email=slittle@loyola.edu HTTP 302
    http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 8w8o2t6autzvjwf098lkm309.php
unikaradio.com/lite/swf/mine/source/
Redirect Chain
  • http://unikaradio.com/lite/swf/mine/source/?email=slittle@loyola.edu
  • http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&...
24 KB
24 KB
Document
General
Full URL
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
192.99.7.177 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
47c9ca88a6a15542ee83248ed4688d37bbe41558d343e53509c90045c9329aeb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
unikaradio.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Cookie
PHPSESSID=lk3ji7pnag0nqao0vp8gimt3t6
Connection
keep-alive
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Pragma
no-cache
Date
Thu, 28 Sep 2017 18:53:30 GMT
Server
Apache
Content-Type
text/html; charset=UTF-8
Location
8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Set-Cookie
PHPSESSID=lk3ji7pnag0nqao0vp8gimt3t6; path=/
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
0
Expires
Thu, 19 Nov 1981 08:52:00 GMT
converged.login.min.css
unikaradio.com/lite/swf/mine/source/files/
84 KB
84 KB
Stylesheet
General
Full URL
http://unikaradio.com/lite/swf/mine/source/files/converged.login.min.css
Requested by
Host: unikaradio.com
URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
192.99.7.177 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
unikaradio.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Cookie
PHPSESSID=lk3ji7pnag0nqao0vp8gimt3t6
Connection
keep-alive
Cache-Control
no-cache
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Last-Modified
Wed, 02 Aug 2017 15:43:32 GMT
Server
Apache
Content-Type
text/css
Cache-Control
max-age=2592000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
86425
Expires
Sat, 28 Oct 2017 18:53:31 GMT
convergedlogin_pcore.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/
284 KB
81 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedlogin_pcore.min.js
Requested by
Host: unikaradio.com
URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:10c:383::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
bb49aa69e795d9a4e6175a9373bef378615ead2fb7aebe00954c2111db5f5f2d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Pragma
no-cache
Origin
http://unikaradio.com
Accept-Encoding
gzip, deflate
Host
secure.aadcdn.microsoftonline-p.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin
http://unikaradio.com

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Content-Encoding
gzip
Last-Modified
Wed, 26 Jul 2017 22:42:16 GMT
Content-MD5
70JDX0xpFgO/0lUo3MXuxw==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=454588
Strict-Transport-Security
max-age=31536000
Content-Length
83081
convergedloginpaginatedstrings-en-gb.min.js
secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/
10 KB
3 KB
Script
General
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.6348.16/content/cdnbundles/convergedloginpaginatedstrings-en-gb.min.js
Requested by
Host: unikaradio.com
URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:10c:383::35c1 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
76a549b7b5bb871680b150cc933d79b0b12a5b6f58d19348ece542f5d7a4af4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Pragma
no-cache
Origin
http://unikaradio.com
Accept-Encoding
gzip, deflate
Host
secure.aadcdn.microsoftonline-p.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection
keep-alive
Cache-Control
no-cache
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin
http://unikaradio.com

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Content-Encoding
gzip
Last-Modified
Wed, 26 Jul 2017 22:41:35 GMT
Content-MD5
2aonJl133r+/GhKf7Kl2dw==
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=454588
Strict-Transport-Security
max-age=31536000
Content-Length
3442
bannerlogo
unikaradio.com/lite/swf/mine/source/files/
4 KB
4 KB
Image
General
Full URL
http://unikaradio.com/lite/swf/mine/source/files/bannerlogo?ts=635974776182591704
Requested by
Host: unikaradio.com
URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
192.99.7.177 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
unikaradio.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Cookie
PHPSESSID=lk3ji7pnag0nqao0vp8gimt3t6
Connection
keep-alive
Cache-Control
no-cache
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Last-Modified
Wed, 02 Aug 2017 15:25:24 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4585
microsoft_logo.svg
unikaradio.com/lite/swf/mine/source/files/
4 KB
4 KB
Image
General
Full URL
http://unikaradio.com/lite/swf/mine/source/files/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Requested by
Host: unikaradio.com
URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
192.99.7.177 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
unikaradio.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection
keep-alive
Cache-Control
no-cache
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Last-Modified
Wed, 02 Aug 2017 15:32:18 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3651
picker_account_aad.svg
unikaradio.com/lite/swf/mine/source/files/
756 B
756 B
Image
General
Full URL
http://unikaradio.com/lite/swf/mine/source/files/picker_account_aad.svg?x=9de70d1c5191d1852a0d5aac28b44a6c
Requested by
Host: unikaradio.com
URL: http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
192.99.7.177 Montréal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
unikaradio.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Connection
keep-alive
Cache-Control
no-cache
Referer
http://unikaradio.com/lite/swf/mine/source/8w8o2t6autzvjwf098lkm309.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=slittle@loyola.edu&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 28 Sep 2017 18:53:31 GMT
Last-Modified
Wed, 02 Aug 2017 15:37:40 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
756

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies