URL: https://discordapp.net.mcas-gov.us/
Submission Tags: phishingrod
Submission: On January 24 via api from DE — Scanned from US

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 52.235.179.167, located in Boydton, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is discordapp.net.mcas-gov.us.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on January 4th 2024. Valid for: a year.
This is the only time discordapp.net.mcas-gov.us was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 52.235.179.167 8075 (MICROSOFT...)
3 2001:489a:340... 8070 (MICROSOFT...)
5 3
Apex Domain
Subdomains
Transfer
4 mcas-gov.us
discordapp.net.mcas-gov.us
mcasproxy.cdn.mcas-gov.us — Cisco Umbrella Rank: 362863
21 KB
0 discordapp.net Failed
discordapp.net Failed
5 2
Domain Requested by
3 mcasproxy.cdn.mcas-gov.us discordapp.net.mcas-gov.us
mcasproxy.cdn.mcas-gov.us
1 discordapp.net.mcas-gov.us
0 discordapp.net Failed
5 3

This site contains no links.

Subject Issuer Validity Valid
*.net.mcas-gov.us
DigiCert SHA2 Secure Server CA
2024-01-04 -
2025-01-04
a year crt.sh
mcasproxy.cdn.mcas-gov.us
DigiCert SHA2 Secure Server CA
2024-01-13 -
2025-01-13
a year crt.sh

This page contains 2 frames:

Frame: https://discordapp.net/
Frame ID: A5E427589033B18857221BDE349FE0A8
Requests: 3 HTTP requests in this frame

Frame: https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/html/session-context-restore.html
Frame ID: E90BECBAE0935A9BE4654EED957939F4
Requests: 2 HTTP requests in this frame

Screenshot


Page Statistics

5
Requests

80 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

21 kB
Transfer

93 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
discordapp.net.mcas-gov.us/
1 KB
895 B
Document
General
Full URL
https://discordapp.net.mcas-gov.us/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
52.235.179.167 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
openresty /
Resource Hash
140cd9b14735c06508305eb94e41cf19960e31adb1f78b05c64844483a292d67
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Wed, 24 Jan 2024 15:14:37 GMT
expires
Mon, 01-Jan-1990 00:00:00 GMT
pragma
no-cache
server
openresty
strict-transport-security
max-age=31536000
x-mcas-cache-status
MISS
x-mcas-processing-time
3
x-mcas-request-id
9bb23f254a6c8ec01a588c63aeed3b6b
x-mcas-upstream-time
n/a
session-context-store-helper.min.js
mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/js/
13 KB
4 KB
Script
General
Full URL
https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/js/session-context-store-helper.min.js
Requested by
Host: discordapp.net.mcas-gov.us
URL: https://discordapp.net.mcas-gov.us/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:489a:3403::5e2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
7bedf305584b902887ff5e38e0f80ee07bb9848670f69487657eb167020eb14b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://discordapp.net.mcas-gov.us/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Jan 2024 15:14:37 GMT
content-encoding
br
content-md5
B3fB8O9WZHMgW9Ki6TAE5g==
x-cache
TCP_HIT
x-ms-lease-status
unlocked
last-modified
Fri, 12 Jan 2024 22:53:28 GMT
server
Microsoft-IIS/10.0, Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8DC13C14B1656E3
x-azure-ref
0XSmxZQAAAABhQ3+VALJRQZ4o/uTk4ni8c24wMy1mZHYyLTZiNGJjZDZjNy13NWdrdABlMTVmZDVjMS02OTg3LTRkYzYtYjk1NS1kYWZiYWMxNWVjMzk=
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
fa11623a-401e-0032-40ec-4d2429000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
session-context-restore.html
mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/html/ Frame E90B
209 B
476 B
Document
General
Full URL
https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/html/session-context-restore.html
Requested by
Host: mcasproxy.cdn.mcas-gov.us
URL: https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/js/session-context-store-helper.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:489a:3403::5e2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a3c954e6d1422643abfe41e74b726918caa087460903ec4267bc4e5293132451

Request headers

Referer
https://discordapp.net.mcas-gov.us/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
content-length
209
content-md5
xcQ/+x+i42xZPwR88wJc4A==
content-type
text/html
date
Wed, 24 Jan 2024 15:14:37 GMT
etag
0x8DC13C156762FEC
last-modified
Fri, 12 Jan 2024 22:53:47 GMT
server
Microsoft-IIS/10.0 Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-azure-ref
0XSmxZQAAAAAzxBsF0T1YRYb55ZV6EIZrc24wMy1mZHYyLTZiNGJjZDZjNy13NWdrdABlMTVmZDVjMS02OTg3LTRkYzYtYjk1NS1kYWZiYWMxNWVjMzk=
x-cache
TCP_HIT
x-ms-blob-type
BlockBlob
x-ms-lease-status
unlocked
x-ms-request-id
fa1162c5-401e-0032-3fec-4d2429000000
x-ms-version
2009-09-19
session-context-restore.min.js
mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/js/ Frame E90B
79 KB
16 KB
Script
General
Full URL
https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/js/session-context-restore.min.js
Requested by
Host: mcasproxy.cdn.mcas-gov.us
URL: https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/html/session-context-restore.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:489a:3403::5e2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
68f251bbaad571e45af92e9dc76463cb9c898613edcc9a8023d15806311fe155

Request headers

accept-language
en-US,en;q=0.9
Referer
https://mcasproxy.cdn.mcas-gov.us/proxyweb/1.48.19-2-hf/html/session-context-restore.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Jan 2024 15:14:37 GMT
content-encoding
br
content-md5
HgAR4X+S3pqQ7ILPWJPi7Q==
x-cache
TCP_HIT
x-ms-lease-status
unlocked
last-modified
Fri, 12 Jan 2024 22:53:28 GMT
server
Microsoft-IIS/10.0, Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8DC13C14B0D0971
x-azure-ref
0XSmxZQAAAADX6Od2fwQWRoUwC7TfgcK6c24wMy1mZHYyLTZiNGJjZDZjNy13NWdrdABlMTVmZDVjMS02OTg3LTRkYzYtYjk1NS1kYWZiYWMxNWVjMzk=
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
8715fef2-e01e-0050-0dec-4d300f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
/
discordapp.net/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
discordapp.net
URL
https://discordapp.net/?

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000