login.dynamicgiass.com

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 64.44.102.249, located in Chicago, United States and belongs to NEXEON, US. The main domain is login.dynamicgiass.com.
TLS certificate: Issued by R3 on May 29th 2023. Valid for: 3 months.

This is the only time login.dynamicgiass.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	64.44.102.249 64.44.102.249	20278 (NEXEON) (NEXEON)
1 2	2606:4700:20:... 2606:4700:20::681a:51e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	163.181.92.229 163.181.92.229	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
1	2a04:4e42::347 2a04:4e42::347	54113 (FASTLY) (FASTLY)
4	5

1 64.44.102.249 (Chicago, United States)

ASN20278 (NEXEON, US)
PTR: 249-102-44-64.reverse-dns

login.dynamicgiass.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:51e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

picsum.photos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.181.92.229 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

cstaticdun.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::347 (United States)

ASN54113 (FASTLY, US)

fastly.picsum.photos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	picsum.photos 1 redirects picsum.photos — Cisco Umbrella Rank: 69975 fastly.picsum.photos — Cisco Umbrella Rank: 117531	7 KB
1	126.net cstaticdun.126.net — Cisco Umbrella Rank: 56412	12 KB
1	dynamicgiass.com login.dynamicgiass.com	11 KB
4	3

	Domain	Requested by
2	picsum.photos	1 redirects login.dynamicgiass.com
1	fastly.picsum.photos	login.dynamicgiass.com
1	cstaticdun.126.net	login.dynamicgiass.com
1	login.dynamicgiass.com
4	4

This site contains no links.

Subject Issuer	Validity	Valid
login.dynamicgiass.com R3	`2023-05-29` - `2023-08-27`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-22` - `2024-04-21`	a year	crt.sh
*.126.net TrustAsia RSA OV TLS CA G2	`2022-11-28` - `2023-12-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login.dynamicgiass.com/SKciBEBH
Frame ID: ECF56DDCE25590294EED8D12FA6C910D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Captcha

Page Statistics

4
Requests

75 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

29 kB
Transfer

30 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://picsum.photos/300/150/?image=218 HTTP 302
https://fastly.picsum.photos/id/218/300/150.jpg?hmac=7lWrWUWyIgkD62e8IyngwoVgcqwkTpPGeXtfF3JFczM

4 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request SKciBEBH Show response
login.dynamicgiass.com/ 11 KB
11 KB 372ms
120ms Document
text/html 64.44.102.249
NEXEON

General

Check archive.org

Show headers Download Go to

Full URL: https://login.dynamicgiass.com/SKciBEBH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 64.44.102.249 Chicago, United States, ASN20278 (NEXEON, US),
Reverse DNS: 249-102-44-64.reverse-dns
Software: /
Resource Hash: afe48f8eec92ac7178f4288c99a9a8034dba315307c0c1f8be0bb8296cabb971

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Type: text/html
Transfer-Encoding: chunked

GET
H2 404 /
picsum.photos/300/150/ 21 B
21 B 150ms
62ms Image
text/plain 2606:4700:20::681a:51e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://picsum.photos/300/150/?image=1017

Requested by

Host: login.dynamicgiass.com
URL: https://login.dynamicgiass.com/SKciBEBH

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:51e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53f9ddc2ef530075a22d7bb9a9ce195145ad8b4361f6ab6dbad527cf7ff65801

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Referer: https://login.dynamicgiass.com/
Origin: https://login.dynamicgiass.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 21:10:23 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nqEcoXB339WHcqksg4ToNJS3OHm64qALysqzedhIixlQaz%2BYx5VG48nwYOQRQn%2BzUBtyjo5UK355HRN1gYbnowGn%2B3aVIKcfMyZ8zH9vSGRJD2mkPeHfwYS1SvixoH813lfbHUNXQOEnCDU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
cf-ray: 7daf3ceb2e6835df-FRA
alt-svc: h3=":443"; ma=86400
content-length: 21

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK icon_light.f13cff3.png
cstaticdun.126.net//2.6.3/images/ 11 KB
12 KB 1687ms
283ms Image
image/png 163.181.92.229
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png
Requested by: Host: login.dynamicgiass.com
URL: https://login.dynamicgiass.com/SKciBEBH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.181.92.229 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login.dynamicgiass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Wed, 21 Jun 2023 21:10:24 GMT
Via: cache53.l2nu20-8[36,35,304-0,H], cache5.l2nu20-8[36,0], cache20.l2hk2[65,65,304-0,H], cache17.l2hk2[66,0], cache11.l2de2[248,247,304-0,H], cache7.l2de2[250,0], ens-cache6.de5[251,250,200-0,H], ens-cache5.de5[253,0]
Age: 0
X-Swift-CacheTime: 60
X-Cache: HIT TCP_REFRESH_HIT dirn:13:201005077
Connection: keep-alive
X-Swift-SaveTime: Wed, 21 Jun 2023 21:10:24 GMT
Content-Length: 11413
Last-Modified: Mon, 07 Nov 2022 05:53:30 GMT
Server: Tengine
Ali-Swift-Global-Savetime: 1687381824
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS,HEAD
Access-Control-Expose-Headers: *
Cache-Control: max-age=43200
Accept-Ranges: bytes
Timing-Allow-Origin: *, *
EagleId: a3b55c9916873818245353805e
Expires: Tue, 06 Jun 2023 00:55:01 GMT

GET
H2

200

150.jpg
fastly.picsum.photos/id/218/300/
Redirect Chain

https://picsum.photos/300/150/?image=218
https://fastly.picsum.photos/id/218/300/150.jpg?hmac=7lWrWUWyIgkD62e8IyngwoVgcqwkTpPGeXtfF3JFczM

6 KB
6 KB

118ms
34ms

Image
image/jpeg

2a04:4e42::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fastly.picsum.photos/id/218/300/150.jpg?hmac=7lWrWUWyIgkD62e8IyngwoVgcqwkTpPGeXtfF3JFczM
Requested by: Host: login.dynamicgiass.com
URL: https://login.dynamicgiass.com/SKciBEBH
Protocol: H2
Server: 2a04:4e42::347 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 30f0815fbea540ba63e65e214615a0a472bbf549218a5360194bec29f85945f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login.dynamicgiass.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits: 1
date: Wed, 21 Jun 2023 21:10:23 GMT
via: 1.1 varnish
age: 1162645
x-cache: HIT
content-disposition: inline; filename="218-300x150.jpg"
content-length: 5982
x-served-by: cache-fra-eddf8230128-FRA
x-timer: S1687381823.422006,VS0,VE6
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Picsum-Id
cache-control: public, max-age=2592000, stale-while-revalidate=60, stale-if-error=43200, immutable
accept-ranges: bytes
timing-allow-origin: *
picsum-id: 218

Redirect headers

date: Wed, 21 Jun 2023 21:10:23 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9qoTQOvf3GIgsCipqtRb3vxnmjrpoMNJrt7XXwh%2FY%2BqMd%2F%2FSLkH5zYR4BEw10m5%2FXUi3K5C2yDd%2BRJfL8GN%2F0hWe2WsaqegJAizHnca6FwIeS4y4Wkf5gvP3aiKP5F4B6liQN6comILMTRQ%3D"}],"group":"cf-nel","max_age":604800}
location: https://fastly.picsum.photos/id/218/300/150.jpg?hmac=7lWrWUWyIgkD62e8IyngwoVgcqwkTpPGeXtfF3JFczM
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
cf-ray: 7daf3ceb8ee335df-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dynamicgiass.com/	1970-01-20 12:43:05	Name: lHKU Value: 751bc0d4a1bebd643123de4483dfda82a3268a4a308c2f2a67bedb614c2062ad

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://picsum.photos/300/150/?image=1017 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cstaticdun.126.net
fastly.picsum.photos
login.dynamicgiass.com
picsum.photos
163.181.92.229
2606:4700:20::681a:51e
2a04:4e42::347
64.44.102.249
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
30f0815fbea540ba63e65e214615a0a472bbf549218a5360194bec29f85945f0
53f9ddc2ef530075a22d7bb9a9ce195145ad8b4361f6ab6dbad527cf7ff65801
5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401
afe48f8eec92ac7178f4288c99a9a8034dba315307c0c1f8be0bb8296cabb971

login.dynamicgiass.com Open in urlscan Pro 64.44.102.249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

75 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

5 IPs

2 Countries

29 kBTransfer

30 kBSize

1 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

login.dynamicgiass.com Open in urlscan Pro
64.44.102.249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

5
IPs

2
Countries

29 kB
Transfer

30 kB
Size

1
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!