betterpools.mycustomerconnect.com

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 52.34.207.165, located in Boardman, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is betterpools.mycustomerconnect.com.
TLS certificate: Issued by Trustwave Organization Validation SHA... on June 25th 2019. Valid for: a year.

This is the only time betterpools.mycustomerconnect.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 2	152.9.170.16 152.9.170.16	81 (NCREN) (NCREN - MCNC)
1 1	43.242.215.229 43.242.215.229	18229 (CTRLS-AS-...) (CTRLS-AS-IN CtrlS Datacenters Ltd.)
3 4	52.34.207.165 52.34.207.165	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	2a02:26f0:6c0... 2a02:26f0:6c00:2bf::35c1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2

2 152.9.170.16 (Durham, United States) 2 redirects

ASN81 (NCREN - MCNC, US)
PTR: my.nccu.edu

nccu.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.nccu.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 43.242.215.229 (India) 1 redirects

ASN18229 (CTRLS-AS-IN CtrlS Datacenters Ltd., IN)
PTR: Server.aditlinux.com

aditlinux.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.34.207.165 (Boardman, United States) 3 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-34-207-165.us-west-2.compute.amazonaws.com

betterpools.mycustomerconnect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:6c00:2bf::35c1 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	301 KB
4	mycustomerconnect.com 3 redirects betterpools.mycustomerconnect.com	20 KB
2	nccu.edu 2 redirects nccu.edu www.nccu.edu	744 B
1	aditlinux.com 1 redirects aditlinux.com	293 B
6	4

	Domain	Requested by
5	secure.aadcdn.microsoftonline-p.com	betterpools.mycustomerconnect.com
4	betterpools.mycustomerconnect.com	3 redirects
1	aditlinux.com	1 redirects
1	www.nccu.edu	1 redirects
1	nccu.edu	1 redirects
6	5

This site contains no links.

Subject Issuer	Validity	Valid
*.mycustomerconnect.com Trustwave Organization Validation SHA256 CA, Level 1	`2019-06-25` - `2020-07-02`	a year	crt.sh
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 4	`2019-07-17` - `2021-07-17`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
Frame ID: 87D4610B3CDAE09BCCE4B54650FCE5C5
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://nccu.edu/leaving.cfm?destination=http%3A%2F%2Faditlinux%2Ecom%2Fal.decato%40henkel.com HTTP 302
http://www.nccu.edu/leaving.cfm?destination=http%3A%2F%2Faditlinux%2Ecom%2Fal.decato%40henkel.com HTTP 302
http://aditlinux.com/al.decato@henkel.com HTTP 301
https://betterpools.mycustomerconnect.com/owa/?4_5x=al.decato@henkel.com HTTP 302
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a?email=al.decato@henkel.com&?auth=2&home... HTTP 301
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/?email=al.decato@henkel.com&?auth=2&hom... HTTP 302
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y51... Page URL

Detected technologies

CFML (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.cfm(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

Adobe ColdFusion (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

url /\.cfm(?:$|\?)/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

2
IPs

3
Countries

320 kB
Transfer

401 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nccu.edu/leaving.cfm?destination=http%3A%2F%2Faditlinux%2Ecom%2Fal.decato%40henkel.com HTTP 302
http://www.nccu.edu/leaving.cfm?destination=http%3A%2F%2Faditlinux%2Ecom%2Fal.decato%40henkel.com HTTP 302
http://aditlinux.com/al.decato@henkel.com HTTP 301
https://betterpools.mycustomerconnect.com/owa/?4_5x=al.decato@henkel.com HTTP 302
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a?email=al.decato@henkel.com&?auth=2&home=1&from=PortalLanding&client-request-id=bcc7c79d-ad79-43ec-9c70-d12e378805d20cDovL3d3dy5hc@ HTTP 301
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/?email=al.decato@henkel.com&?auth=2&home=1&from=PortalLanding&client-request-id=bcc7c79d-ad79-43ec-9c70-d12e378805d20cDovL3d3dy5hc@ HTTP 302
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php Show response
betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/
Redirect Chain

http://nccu.edu/leaving.cfm?destination=http%3A%2F%2Faditlinux%2Ecom%2Fal.decato%40henkel.com
http://www.nccu.edu/leaving.cfm?destination=http%3A%2F%2Faditlinux%2Ecom%2Fal.decato%40henkel.com
http://aditlinux.com/al.decato@henkel.com
https://betterpools.mycustomerconnect.com/owa/?4_5x=al.decato@henkel.com
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a?email=al.decato@henkel.com&?auth=2&home=1&from=PortalLanding&client-request-id=bcc7c79d-ad79-43ec-9c70-d12e378805d20cD...
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/?email=al.decato@henkel.com&?auth=2&home=1&from=PortalLanding&client-request-id=bcc7c79d-ad79-43ec-9c70-d12e378805d20c...
https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel....

18 KB
18 KB

504ms
185ms

Document
text/html

52.34.207.165
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.34.207.165 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-34-207-165.us-west-2.compute.amazonaws.com
Software: Apache/2.4.18 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.6.20
Resource Hash: 5e1516f30eac32f8f83706d770f913fcf5fc9b53aa0fe38867b7cf8a32988ad8

Request headers

Host: betterpools.mycustomerconnect.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=511ec2f7a1b484b7ce07f5060861cc9c
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 04 Oct 2019 06:39:34 GMT
Server: Apache/2.4.18 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.6.20
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 04 Oct 2019 06:39:33 GMT
Server: Apache/2.4.18 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.6.20
Location: 3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126#module=welcome.WelcomeModule%7C%7B%7D=default&ltmplcache=2&emr=1&osid=1#identifier
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK converged.v2.login.min_b82b5b2o4zmoi2bapziquw2.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/cdnbundles/ 99 KB
19 KB 630ms
599ms Stylesheet
text/css 2a02:26f0:6c00:2bf::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/cdnbundles/converged.v2.login.min_b82b5b2o4zmoi2bapziquw2.css

Requested by

Host: betterpools.mycustomerconnect.com
URL: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2bf::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

73eed72889b1748c6d84dd900690340edecefad94bed142602b23d34b5a54d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Sec-Fetch-Mode: cors
Referer: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
Origin: https://betterpools.mycustomerconnect.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 04 Oct 2019 06:39:35 GMT
Content-Encoding: gzip
Last-Modified: Sun, 19 May 2019 03:12:47 GMT
Content-MD5: uGoiTyElzrQrjKf4w7w4gg==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Strict-Transport-Security: max-age=31536000
Content-Length: 18699

GET
H/1.1 200
OK microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/ 4 KB
2 KB 637ms
621ms Image
image/svg+xml 2a02:26f0:6c00:2bf::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg

Requested by

Host: betterpools.mycustomerconnect.com
URL: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2bf::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 04 Oct 2019 06:39:35 GMT
Content-Encoding: gzip
Last-Modified: Sun, 19 May 2019 03:13:05 GMT
Content-MD5: nzaLxFgP7ZB3dfMcaybWzw==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Strict-Transport-Security: max-age=31536000
Content-Length: 1435

GET
H/1.1 200
OK arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/ 513 B
654 B 213ms
197ms Image
image/svg+xml 2a02:26f0:6c00:2bf::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg

Requested by

Host: betterpools.mycustomerconnect.com
URL: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2bf::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 04 Oct 2019 06:39:35 GMT
Content-Encoding: gzip
Last-Modified: Sun, 19 May 2019 03:12:43 GMT
Content-MD5: TjUQkZ0p0Y7rbj6LJofS9Q==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Strict-Transport-Security: max-age=31536000
Content-Length: 276

GET
H/1.1 200
OK 0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/backgrounds/ 3 KB
3 KB 586ms
570ms Image
image/jpeg 2a02:26f0:6c00:2bf::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/backgrounds/0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg

Requested by

Host: betterpools.mycustomerconnect.com
URL: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2bf::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 04 Oct 2019 06:39:35 GMT
Last-Modified: Sun, 19 May 2019 03:13:02 GMT
Content-MD5: E4vO5iT6BO+bdehiEan+DQ==
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Connection: keep-alive
Content-Length: 3006

GET
H/1.1 200
OK 0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/backgrounds/ 277 KB
277 KB 570ms
554ms Image
image/jpeg 2a02:26f0:6c00:2bf::35c1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8358.18/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg

Requested by

Host: betterpools.mycustomerconnect.com
URL: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:2bf::35c1 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

/

Resource Hash

211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://betterpools.mycustomerconnect.com/owa/f36603b11be4ea2183ece34f50cc948a/3e2ep7xwa8pk6px60zk396epy897kz7y7981y518p010pp7pk0237zp437ky30paa3k88py3pw3kyaeaeppw8e4k0y.php?email=al.decato@henkel.com&.verify?service=mail&data:text/html;js6/main.jsp?sid=CAgbePXXjcVpfthPNgXXCcgDQZImqqTE&df=webmail126
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 04 Oct 2019 06:39:35 GMT
Last-Modified: Sun, 19 May 2019 03:12:50 GMT
Content-MD5: pdvUOT/2pyXH5ith335y8A==
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=604800
Connection: keep-alive
Content-Length: 283351

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			betterpools.mycustomerconnect.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 511ec2f7a1b484b7ce07f5060861cc9c

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aditlinux.com
betterpools.mycustomerconnect.com
nccu.edu
secure.aadcdn.microsoftonline-p.com
www.nccu.edu
152.9.170.16
2a02:26f0:6c00:2bf::35c1
43.242.215.229
52.34.207.165
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
5e1516f30eac32f8f83706d770f913fcf5fc9b53aa0fe38867b7cf8a32988ad8
73eed72889b1748c6d84dd900690340edecefad94bed142602b23d34b5a54d3b
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

betterpools.mycustomerconnect.com Open in urlscan Pro 52.34.207.165 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

25 %IPv6

4 Domains

5 Subdomains

2 IPs

3 Countries

320 kBTransfer

401 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

betterpools.mycustomerconnect.com Open in urlscan Pro
52.34.207.165 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

2
IPs

3
Countries

320 kB
Transfer

401 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!