www.nanitosclan.com Open in urlscan Pro
94.23.0.86 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7C...
Effective URL:
https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln...
Submission: On March 25 via manual (March 25th 2018, 10:50:02 pm UTC) from AU

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 7 HTTP transactions. The main IP is 94.23.0.86, located in France and belongs to OVH, FR. The main domain is www.nanitosclan.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on April 17th 2017. Valid for: a year.

This is the only time www.nanitosclan.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.47.124.28 104.47.124.28	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 1	104.47.116.28 104.47.116.28	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER - Twitter Inc.)
1 4	94.23.0.86 94.23.0.86	16276 (OVH) (OVH)
1	172.217.22.42 172.217.22.42	15169 (GOOGLE) (GOOGLE - Google LLC)
2	151.101.113.194 151.101.113.194	54113 (FASTLY) (FASTLY - Fastly)
7	5

1 104.47.124.28 (Redmond, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

apac01.safelinks.protection.outlook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.47.116.28 (Melbourne, Australia) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

aus01.safelinks.protection.outlook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 94.23.0.86 (France) 1 redirects

ASN16276 (OVH, FR)
PTR: ns333646.ip-94-23-0.eu

aria.izee.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.nanitosclan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.42 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.113.194 (San Francisco, United States)

ASN54113 (FASTLY - Fastly, US)

sp-bootstrap.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	nanitosclan.com 1 redirects www.nanitosclan.com	47 KB
2	fastly.net sp-bootstrap.global.ssl.fastly.net	132 KB
2	outlook.com 2 redirects apac01.safelinks.protection.outlook.com aus01.safelinks.protection.outlook.com	1005 B
1	googleapis.com ajax.googleapis.com	33 KB
1	izee.es aria.izee.es	542 B
1	t.co t.co	569 B
7	6

	Domain	Requested by
3	www.nanitosclan.com	1 redirects www.nanitosclan.com
2	sp-bootstrap.global.ssl.fastly.net	ajax.googleapis.com
1	ajax.googleapis.com	www.nanitosclan.com
1	aria.izee.es
1	t.co
1	aus01.safelinks.protection.outlook.com	1 redirects
1	apac01.safelinks.protection.outlook.com	1 redirects
7	7

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 Extended Validation Server CA	`2017-07-25` - `2018-11-05`	a year	crt.sh
www.nanitosclan.com COMODO RSA Domain Validation Secure Server CA	`2017-04-17` - `2018-07-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463
Frame ID: 23B780A3D1D7E4D68C45D5316EA5180E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausn... HTTP 302
https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausn... HTTP 302
https://t.co/JyAJiI0U7L Page URL
http://aria.izee.es/app/ini.php Page URL
https://www.nanitosclan.com/spotify.com/index.php?spotify_sessionID=4s6q5d4654564fs6465ze12d32s1f54df465... HTTP 302
https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

7
Requests

43 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

5
IPs

3
Countries

212 kB
Transfer

502 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7Cecb08288a43a4a29284908d59291b619%7Ca394e41ccf8d458eac1bddae1aa15629%7C0%7C1%7C636576076922730771&sdata=9Gr3dNHIHyV6ro1pApK96nr8IjtwQPm2o7gC0yqzfU8%3D&reserved=0 HTTP 302
https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7Cecb08288a43a4a29284908d59291b619%7Ca394e41ccf8d458eac1bddae1aa15629%7C0%7C1%7C636576076922730771&sdata=9Gr3dNHIHyV6ro1pApK96nr8IjtwQPm2o7gC0yqzfU8%3D&reserved=0 HTTP 302
https://t.co/JyAJiI0U7L Page URL
http://aria.izee.es/app/ini.php Page URL
https://www.nanitosclan.com/spotify.com/index.php?spotify_sessionID=4s6q5d4654564fs6465ze12d32s1f54df465s4g654h6546h54j4u64641tj1321f31564f564th654t HTTP 302
https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7Cecb08288a43a4a29284908d59291b619%7Ca394e41ccf8d458eac1bddae1aa15629%7C0%7C1%7C636576076922730771&sdata=9Gr3dNHIHyV6ro1pApK96nr8IjtwQPm2o7gC0yqzfU8%3D&reserved=0 HTTP 302
https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7Cecb08288a43a4a29284908d59291b619%7Ca394e41ccf8d458eac1bddae1aa15629%7C0%7C1%7C636576076922730771&sdata=9Gr3dNHIHyV6ro1pApK96nr8IjtwQPm2o7gC0yqzfU8%3D&reserved=0 HTTP 302
https://t.co/JyAJiI0U7L

7 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

JyAJiI0U7L Show response
t.co/
Redirect Chain

https://apac01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7Cecb08288a43a4a29284908d59291b619%7Ca394e41ccf8d458eac...
https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ft.co%2FJyAJiI0U7L&data=02%7C01%7Csteven.whitehouse%40ausnetservices.com.au%7Cecb08288a43a4a29284908d59291b619%7Ca394e41ccf8d458eac1...
https://t.co/JyAJiI0U7L

288 B
569 B

134ms
115ms

Document
text/html

104.244.42.5
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/JyAJiI0U7L

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

d814bd0ea2f4428e8eb73dee60ebc8ddfe84e41e89ba7810a5f59ee1f7d1a293

Security Headers

Name	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

:path: /JyAJiI0U7L
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: t.co
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

content-security-policy: referrer always;
content-encoding: gzip
status: 200
x-connection-hash: 7d68a2cdde8c0100c9030be11c12fa02
strict-transport-security: max-age=0
content-length: 200
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 108
referrer-policy: unsafe-url
server: tsa_o
date: Sun, 25 Mar 2018 22:49:50 GMT
vary: Origin
content-type: text/html; charset=utf-8
cache-control: private,max-age=300
set-cookie: muc=7035489d-a919-439a-ac16-f67e16e28bb5; Expires=Tue, 24 Mar 2020 22:49:50 UTC; Domain=t.co
expires: Sun, 25 Mar 2018 22:54:50 GMT

Redirect headers

Date: Sun, 25 Mar 2018 22:49:49 GMT
X-Content-Type-Options: nosniff
X-AspNetMvc-Version: 4.0
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Content-Type: text/html; charset=utf-8
Location: https://t.co/JyAJiI0U7L
Cache-Control: private
Connection: close
Content-Length: 140
X-UA-Compatible: IE=Edge

GET
H/1.1 200
OK ini.php Show response
aria.izee.es/app/ 321 B
542 B 808ms
16ms Document
text/html 94.23.0.86
OVH

General

Check archive.org

Show headers Download Go to

Full URL

http://aria.izee.es/app/ini.php

Protocol

HTTP/1.1

Server

94.23.0.86 , France, ASN16276 (OVH, FR),

Reverse DNS

ns333646.ip-94-23-0.eu

Software

nginx /

Resource Hash

6003328c09edd609277360862a3528e1cee27eb680a21aaf19749620afabe5eb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: aria.izee.es
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://t.co/JyAJiI0U7L
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: https://t.co/JyAJiI0U7L
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 22:49:56 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H/1.1

200
OK

Primary Request index.php Show response
www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/
Redirect Chain

https://www.nanitosclan.com/spotify.com/index.php?spotify_sessionID=4s6q5d4654564fs6465ze12d32s1f54df465s4g654h6546h54j4u64641tj1321f31564f564th654t
https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02v...

7 KB
3 KB

17ms
16ms

Document
text/html

94.23.0.86
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

94.23.0.86 , France, ASN16276 (OVH, FR),

Reverse DNS

ns333646.ip-94-23-0.eu

Software

nginx /

Resource Hash

09e9625cce9cd0049d04cad169b28111381613ddb57ba1ad9ffeff50e724d1ca

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.nanitosclan.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://aria.izee.es/app/ini.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://aria.izee.es/app/ini.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

X-Page-Speed: 1.9.32.10-7423
Date: Sun, 25 Mar 2018 22:49:56 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=0, no-cache
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

Redirect headers

X-Page-Speed: 1.9.32.10-7423
Date: Sun, 25 Mar 2018 22:49:56 GMT
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
location: c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463
Cache-Control: max-age=0, no-cache
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK index.css
www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/files/ 268 KB
43 KB 35ms
34ms Stylesheet
text/css 94.23.0.86
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/files/index.css
Requested by: Host: www.nanitosclan.com
URL: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 94.23.0.86 , France, ASN16276 (OVH, FR),
Reverse DNS: ns333646.ip-94-23-0.eu
Software: nginx /
Resource Hash: 1afa510c4c985733bc3e90c194ee0caa5a58629971258dd2a636c587e16b25b5

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.nanitosclan.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Sun, 25 Mar 2018 22:49:56 GMT
Content-Encoding: gzip
Last-Modified: Sun, 25 Mar 2018 22:49:56 GMT
Server: nginx
ETag: W/"5ab82794-43125"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=15552000 public
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Fri, 21 Sep 2018 22:49:56 GMT

GET
S 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.7.1/ 92 KB
33 KB 29ms
7ms Script
text/javascript 172.217.22.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js

Requested by

Host: www.nanitosclan.com
URL: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463

Protocol

SPDY

Server

172.217.22.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f10.1e100.net

Software

sffe /

Resource Hash

88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/index.php?spotify_sessionID=8p8jfkc4h42d45sdd5m08ln58mvmfvkob80a8i10ti522hmpnrtjtso7sk37pixp24aqvafl6ng8xrobnm9n9r6y75kcj02vmoonqv73czgavqnvf8arpdbsuumbgmdi94tnobgjwtgw3nvym5cmtxswatgixsnddf4mlf5hkp3arwb9znxr6yg7awcv90z4cldzvx4ei8g12doh6chmu6phbv7vxzrwjju6rfn346j4ynnvb8i1y9jkqftr7hkfvj80rnly4hzircpio7qjiu77aeic7vtrvfyozqfxcdjwyv8p6l09450u4wbddz4d8fm558qgz1fk2ol6zbzhb50iklzg936ja9w7rzjpyblyce19bc3yg3xogxzsnlw04iwuwmtv0fv2hi14166m48wfq9oznr2tt1kdx3p7vzusm2w9dyj47jfqy1b2elfp8690m1vslviypc1wwtppzqczll03fib4byt47g85rz6emhfp0yqnx9dd1mrah3sxqo0kx27xk9nok02iwvzqksdqea3ezdqfvy41vlzs1djd89f69eebpbaxbmu6361yvsdpe2otguwg98n1x3jy0463
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Mon, 12 Feb 2018 20:39:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3550205
status: 200
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length: 33333
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Feb 2019 20:39:47 GMT

GET
H/1.1 200
OK circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/ 63 KB
64 KB 30ms
5ms Font
application/font-woff 151.101.113.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-book.woff2
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
Protocol: HTTP/1.1
Server: 151.101.113.194 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 16f860a080d405f412750f83c4ee2168302cd1f3347416b5b3ae50bae3571b28

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/files/index.css
Origin: https://www.nanitosclan.com

Response headers

x-amz-version-id: uk_BB9oobL1KrkS6Nqt6_9wKZXILdN7q
Via: 1.1 varnish, 1.1 varnish
ETag: "0c0dfc4df72c07c84b15651ab6f951a6"
Age: 16471666
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 64512
x-amz-id-2: 6P+452QnRxD+LnU6KzzI8D1Val83afLPmVc1jU9/pbLltYPPiWmMmPhKCgIoMxJeYka32+LoFok=
X-Served-By: cache-iad2134-IAD, cache-hhn1525-HHN
Last-Modified: Thu, 07 Sep 2017 19:31:01 GMT
Server: AmazonS3
X-Timer: S1522018192.104904,VS0,VE0
Date: Sun, 25 Mar 2018 22:49:52 GMT
x-amz-request-id: 703767A603445268
Access-Control-Allow-Origin: *
Expires: Fri, 07 Sep 2018 19:30:57 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: application/font-woff
X-Cache-Hits: 1, 7573

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7cd549fde0242f32cac05b1f4b9f2abd3d8a585bb71c8a4cade6bbb09c792333

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml;charset=utf-8

GET
H/1.1 200
OK circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/ 68 KB
68 KB 27ms
6ms Font
application/font-woff 151.101.113.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-bold.woff2
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js
Protocol: HTTP/1.1
Server: 151.101.113.194 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0e1e4f36fc8076dd1b5f30ac8aeaeed4b5927e475d0d4e7b8d63a33beb2fd0b5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://www.nanitosclan.com/spotify.com/c35e96af2f9e2abf49256f104ad06f9c/files/index.css
Origin: https://www.nanitosclan.com

Response headers

x-amz-version-id: lv2cUiXWh9.bj.nXkNtlic0Fy4DS6vib
Via: 1.1 varnish, 1.1 varnish
ETag: "14bfce9501e5a5dc0adbe559dd630bc6"
Age: 16035876
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 69140
x-amz-id-2: rNce7dCOO32hyrQXyH2FCzeWwtDg5CSctxL2gbijGW288PoyKXDlSdaCgsAFUUFZr0jDnfiu6Ug=
X-Served-By: cache-iad2146-IAD, cache-hhn1529-HHN
Last-Modified: Thu, 07 Sep 2017 19:31:01 GMT
Server: AmazonS3
X-Timer: S1522018192.105142,VS0,VE0
Date: Sun, 25 Mar 2018 22:49:52 GMT
x-amz-request-id: 78244A3519109E01
Access-Control-Allow-Origin: *
Expires: Fri, 07 Sep 2018 19:30:57 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
Content-Type: application/font-woff
X-Cache-Hits: 1, 5328

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| removeWarning

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
apac01.safelinks.protection.outlook.com
aria.izee.es
aus01.safelinks.protection.outlook.com
sp-bootstrap.global.ssl.fastly.net
t.co
www.nanitosclan.com
104.244.42.5
104.47.116.28
104.47.124.28
151.101.113.194
172.217.22.42
94.23.0.86
09e9625cce9cd0049d04cad169b28111381613ddb57ba1ad9ffeff50e724d1ca
0e1e4f36fc8076dd1b5f30ac8aeaeed4b5927e475d0d4e7b8d63a33beb2fd0b5
16f860a080d405f412750f83c4ee2168302cd1f3347416b5b3ae50bae3571b28
1afa510c4c985733bc3e90c194ee0caa5a58629971258dd2a636c587e16b25b5
6003328c09edd609277360862a3528e1cee27eb680a21aaf19749620afabe5eb
7cd549fde0242f32cac05b1f4b9f2abd3d8a585bb71c8a4cade6bbb09c792333
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
d814bd0ea2f4428e8eb73dee60ebc8ddfe84e41e89ba7810a5f59ee1f7d1a293

www.nanitosclan.com Open in urlscan Pro 94.23.0.86 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

43 %HTTPS

0 %IPv6

6 Domains

7 Subdomains

5 IPs

3 Countries

212 kBTransfer

502 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.nanitosclan.com Open in urlscan Pro
94.23.0.86 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

43 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

5
IPs

3
Countries

212 kB
Transfer

502 kB
Size

0
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!