urlscan.io logo urlscan.io
SecurityTrails logo

khetibuddy.com Open in urlscan Pro
162.241.85.104  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdY...
Effective URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee03...
Submission: On October 06 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 10 HTTP transactions. The main IP is 162.241.85.104, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is khetibuddy.com.
TLS certificate: Issued by R3 on August 29th 2021. Valid for: 3 months.
This is the only time khetibuddy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 54.233.228.78 16509 (AMAZON-02)
1 144.217.158.133 16276 (OVH)
1 10 162.241.85.104 46606 (UNIFIEDLA...)
10 2
Apex Domain
Subdomains		 Transfer
10 khetibuddy.com
khetibuddy.com
211 KB
1 nucmaeirl.net
nucmaeirl.net
22 KB
1 embluemail.com
nt.embluemail.com
225 B
10 3
Domain Requested by
10 khetibuddy.com 1 redirects nucmaeirl.net
khetibuddy.com
1 nucmaeirl.net
1 nt.embluemail.com 1 redirects
10 3

This site contains no links.

Subject Issuer Validity Valid
nucmaeirl.net
R3		 2021-09-13 -
2021-12-12		 3 months crt.sh
www.khetibuddy.com
R3		 2021-08-29 -
2021-11-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Frame ID: F00F654F34F6086B594F9F007C7B0173
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to Outlook

Page URL History Show full URLs

  1. https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6a... HTTP 302
    https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com Page URL
  2. https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... HTTP 302
    https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

233 kB
Transfer

447 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fterry.mulvanerton%40mheducation.com HTTP 302
    https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com Page URL
  2. https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$terry.mulvanerton@mheducation.com HTTP 302
    https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fterry.mulvanerton%40mheducation.com HTTP 302
  • https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
terry.mulvanerton@mheducation.com
nucmaeirl.net/m7m/503c06a6/
Redirect Chain
  • https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net...
  • https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com
22 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
144.217.158.133 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
r3.a1center.net
Software
Apache / PHP/5.6.40
Resource Hash

Request headers

Host
nucmaeirl.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 06 Oct 2021 14:01:55 GMT
Server
Apache
X-Powered-By
PHP/5.6.40
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

date
Wed, 06 Oct 2021 14:01:55 GMT
content-type
application/json
content-length
0
location
https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com
x-amzn-requestid
4d76426a-e2dc-4c4a-991a-dded0285c379
x-amz-apigw-id
GyfdEH4-GjQFYRw=
x-amzn-trace-id
Root=1-615dac53-277ec4d05c4851ba19c998c1;Sampled=0
Primary Request PS-615dac6f2ecb2
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/
Redirect Chain
  • https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$terry.mulvanerton@mheducation.com
  • https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
38 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Requested by
Host: nucmaeirl.net
URL: https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
1ae29e24598bbef0fba24053d43bfcba8c7afa32b91a9e9953d7d2392d8debe8

Request headers

:method
GET
:authority
khetibuddy.com
:scheme
https
:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://nucmaeirl.net/
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://nucmaeirl.net/m7m/503c06a6/terry.mulvanerton@mheducation.com

Response headers

date
Wed, 06 Oct 2021 14:02:23 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
3152
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
x-server-cache
false

Redirect headers

date
Wed, 06 Oct 2021 14:02:23 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
pragma
no-cache
location
./PS-615dac6f2ecb2
x-server-cache
false
set-cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810; path=/
70051afad23aa3dcd66d6b79ca5cdf4a4cc7fd9f0654c
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-WWY4IF/ 		103 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-WWY4IF/70051afad23aa3dcd66d6b79ca5cdf4a4cc7fd9f0654c
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-WWY4IF/70051afad23aa3dcd66d6b79ca5cdf4a4cc7fd9f0654c
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 14:02:24 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 15:23:18 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public
accept-ranges
bytes
expires
max-age=A10368000, public
dd5ac9afc9ab1d0aa4c7646af5763d5c30dffc0cd4726
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/dd5ac9afc9ab1d0aa4c7646af5763d5c30dffc0cd4726
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/dd5ac9afc9ab1d0aa4c7646af5763d5c30dffc0cd4726
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 14:02:24 GMT
content-encoding
gzip
last-modified
Sat, 23 Nov 2019 18:10:04 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=10368000
accept-ranges
bytes
content-length
1522
expires
max-age=A10368000, public
d96aca3750fcb510ca3fc46f2d74d0fa5d6a4c69a7ddc
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/ 		513 B
406 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/d96aca3750fcb510ca3fc46f2d74d0fa5d6a4c69a7ddc
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/d96aca3750fcb510ca3fc46f2d74d0fa5d6a4c69a7ddc
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 14:02:24 GMT
content-encoding
gzip
last-modified
Sun, 24 Nov 2019 01:44:20 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=10368000
accept-ranges
bytes
content-length
276
expires
max-age=A10368000, public
37fc5a6dcd40fcfa3bddcaa62d0467c5af609a9dc5174
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/ 		84 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/37fc5a6dcd40fcfa3bddcaa62d0467c5af609a9dc5174
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/37fc5a6dcd40fcfa3bddcaa62d0467c5af609a9dc5174
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 14:02:24 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 16:23:14 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
expires
max-age=A10368000, public
c41d65da099546fa7356d7cdc6cca70df2adbfaa3c0f4
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/ 		50 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/c41d65da099546fa7356d7cdc6cca70df2adbfaa3c0f4
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/c41d65da099546fa7356d7cdc6cca70df2adbfaa3c0f4
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 14:02:24 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 16:23:24 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
expires
max-age=A10368000, public
ba903dcdac5dafa7466fc6f36947fd15dc2d700cc4aa5
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/ba903dcdac5dafa7466fc6f36947fd15dc2d700cc4aa5
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/ba903dcdac5dafa7466fc6f36947fd15dc2d700cc4aa5
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 14:02:24 GMT
content-encoding
gzip
last-modified
Fri, 03 Sep 2021 18:38:14 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
content-length
1433
expires
max-age=A10368000, public
api-dab4f3dd0ccfa757c791cd0a3dc6ff6adc9546a26a450
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-dab4f3dd0ccfa757c791cd0a3dc6ff6adc9546a26a450?email=terry.mulvanerton@mheducation.com&data=logo
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
175986272200fb72da9a598d30016bbda9ddcaa9e6e3f07eb94bc74196d4b805

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-dab4f3dd0ccfa757c791cd0a3dc6ff6adc9546a26a450?email=terry.mulvanerton@mheducation.com&data=logo
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 14:02:25 GMT
content-encoding
gzip
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/jpeg;
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
content-length
1262
expires
Thu, 19 Nov 1981 08:52:00 GMT
api-d7acc612d96dd00dcc4a6cf70f5a539acf5f74ba3d4a6
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ 		140 KB
119 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-d7acc612d96dd00dcc4a6cf70f5a539acf5f74ba3d4a6?email=terry.mulvanerton@mheducation.com&data=background
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
90b1d4166ef3e4b2e8d608de2ef4e37ac2245e0a964fc36f7cfd1ec2715f662d

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-d7acc612d96dd00dcc4a6cf70f5a539acf5f74ba3d4a6?email=terry.mulvanerton@mheducation.com&data=background
pragma
no-cache
cookie
PHPSESSID=f3804f3febe2bfd7a5b6749b610c7810
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615dac6f2ecb2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 14:02:26 GMT
content-encoding
gzip
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/jpeg;
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep

1 Cookies

Domain/Path Name / Value
khetibuddy.com/ Name: PHPSESSID
Value: f3804f3febe2bfd7a5b6749b610c7810