mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com Open in urlscan Pro
31.131.27.146 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://grabify.link/63XQ7B
Effective URL:
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYX...
Submission: On September 03 via manual (September 3rd 2018, 5:57:12 am UTC) from SA

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 31.131.27.146, located in Atlanta, United States and belongs to VPS-UA-AS, UA. The main domain is mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on February 22nd 2018. Valid for: a year.

This is the only time mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.27.142.121 104.27.142.121	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 3	185.27.134.132 185.27.134.132	34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
2 6	31.131.27.146 31.131.27.146	56851 (VPS-UA-AS) (VPS-UA-AS)
6	3

1 104.27.142.121 (San Francisco, United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

grabify.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.27.134.132 (United Kingdom) 1 redirects

ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
PTR: 13213427185.ifastnet.org

webmail.mof-gov-sa.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 31.131.27.146 (Atlanta, United States) 2 redirects

ASN56851 (VPS-UA-AS, UA)

mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	connect-auth.com 2 redirects mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com	290 KB
3	mof-gov-sa.ga 1 redirects webmail.mof-gov-sa.ga	32 KB
1	grabify.link 1 redirects grabify.link	706 B
6	3

	Domain	Requested by
6	mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com	2 redirects webmail.mof-gov-sa.ga mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com
3	webmail.mof-gov-sa.ga	1 redirects webmail.mof-gov-sa.ga
1	grabify.link	1 redirects
6	3

This site contains no links.

Subject Issuer	Validity	Valid
webmail.mof-gov-sa.ga COMODO RSA Domain Validation Secure Server CA	`2018-06-11` - `2018-09-09`	3 months	crt.sh
*.connect-auth.com COMODO RSA Domain Validation Secure Server CA	`2018-02-22` - `2019-02-22`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU=
Frame ID: 48ED1E3E52B89AD1630FF2D36D837125
Requests: 8 HTTP requests in this frame

Frame: https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/chaptchaimg.php
Frame ID: BC25A9FF161803D3F1BC61AD0D92898C
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://grabify.link/63XQ7B HTTP 301
https://webmail.mof-gov-sa.ga/DPRUbiu Page URL
https://webmail.mof-gov-sa.ga/DPRUbiu?i=1 HTTP 302
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/?id=fK8mxT4kiiJ6dBe~5bg2PG0U4w7ttiD4QA7BFinRTO25MZbWohIaqWjQUAEkCA/DLUvNtqS2... HTTP 302
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?id=wEX2uuRV4rCERNRrgXN7pg&dt=9VkW7MCEH7aPQeBk6piO5Q&rd=I6qGOAu9svO... HTTP 302
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaG... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

320 kB
Transfer

385 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://grabify.link/63XQ7B HTTP 301
https://webmail.mof-gov-sa.ga/DPRUbiu Page URL
https://webmail.mof-gov-sa.ga/DPRUbiu?i=1 HTTP 302
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/?id=fK8mxT4kiiJ6dBe~5bg2PG0U4w7ttiD4QA7BFinRTO25MZbWohIaqWjQUAEkCA/DLUvNtqS21ZaS1D2saN9wRp1m8Mdfh9vyAzGWt2SUxI9jOAmwf0b7SMUKcW1jVLPkdQJmHaNMOMqUrxr5KMEgGBuPgnCteaEpOLKYU8OiTqU= HTTP 302
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?id=wEX2uuRV4rCERNRrgXN7pg&dt=9VkW7MCEH7aPQeBk6piO5Q&rd=I6qGOAu9svOOk2Qj0RMTVfZbhDTC51ybmKld3NJhaJRBLx3AiewlyHtWlnPP5jMa HTTP 302
https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://grabify.link/63XQ7B HTTP 301
https://webmail.mof-gov-sa.ga/DPRUbiu

6 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	DPRUbiu Show response webmail.mof-gov-sa.ga/ Redirect Chain https://grabify.link/63XQ7B https://webmail.mof-gov-sa.ga/DPRUbiu	840 B 704 B	28ms 28ms	Document text/html	185.27.134.132 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL https://webmail.mof-gov-sa.ga/DPRUbiu Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.134.132 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS 13213427185.ifastnet.org Software nginx / Resource Hash `1029d92da3628431eb450130b9b4425110edd54046b0119a2b120631ca9717a5` Request headers :method GET :authority webmail.mof-gov-sa.ga :scheme https :path /DPRUbiu pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 accept-encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 48ED1E3E52B89AD1630FF2D36D837125 Response headers status 200 server nginx date Mon, 03 Sep 2018 05:56:59 GMT content-type text/html vary Accept-Encoding expires Thu, 01 Jan 1970 00:00:01 GMT cache-control no-cache content-encoding gzip Redirect headers status 301 date Mon, 03 Sep 2018 05:57:01 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=da3722052716b08040e8291a8d7e037501535954221; expires=Tue, 03-Sep-19 05:57:01 GMT; path=/; domain=.grabify.link; HttpOnly XSRF-TOKEN=eyJpdiI6IjlzM3BZcnVvNVpxVWV0YW5VXC9YZEZ3PT0iLCJ2YWx1ZSI6Imk5elJaZFZZTm56elg4TXhmXC9cL0ZHVzhYVzhFQ1ZhZlB0Qkw2NzM0MEVVK2hvOWFmWXNVd1c4MGU2WnFhUVlaaSIsIm1hYyI6ImEyMzE3ZTBlOTk1OTk1YWViNWIzMWUyNjc4MDAyNDQ1ZmRkZTRlODUyYmYyZWNjNTA3MTFhYzRjNGMzN2IyOTMifQ%3D%3D; expires=Mon, 03-Sep-2018 07:57:01 GMT; Max-Age=7200; path=/ grabify_ip_logger_session=eyJpdiI6InBzdWlNRzFWWXpmdHJ5Mkk2amxmSlE9PSIsInZhbHVlIjoiMHJCZEkxM0liVkJFdTFkSGYzem9YdjN2UittT0tOSWFNaXZsd2VVTmVVQWpZdFZKaVN2STdvVnNzbThraW5zRiIsIm1hYyI6IjhlZGEzMjZmM2U4MTcyNWNmZTUzMzQwMTBiMjYxMzZjODYwYzlhMTI0NGQyNjk3MDg0MzE3Y2E3Mzk4ZjdkMTUifQ%3D%3D; expires=Mon, 03-Sep-2018 07:57:01 GMT; Max-Age=7200; path=/; httponly cache-control no-cache, private location https://webmail.mof-gov-sa.ga/DPRUbiu x-robots-tag noindex, nofollow x-content-type-options nosniff x-abuse abuse@darkn3ss.com x-ratelimit-limit 15 x-ratelimit-remaining 14 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4545f9fbbd0a96fa-FRA
GET H2	200	aes.js Show response webmail.mof-gov-sa.ga/	30 KB 31 KB	29ms 29ms	Script application/javascript	185.27.134.132 WILDCARD-AS Wildc...
General Check archive.org Show headers Download Go to Full URL https://webmail.mof-gov-sa.ga/aes.js Requested by Host: webmail.mof-gov-sa.ga URL: https://webmail.mof-gov-sa.ga/DPRUbiu Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.27.134.132 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB), Reverse DNS 13213427185.ifastnet.org Software nginx / Resource Hash `d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc` Request headers :path /aes.js pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept / cache-control no-cache :authority webmail.mof-gov-sa.ga referer https://webmail.mof-gov-sa.ga/DPRUbiu :scheme https :method GET Referer https://webmail.mof-gov-sa.ga/DPRUbiu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Mon, 03 Sep 2018 05:56:59 GMT last-modified Sat, 08 Aug 2015 08:14:31 GMT server nginx etag "55c5ba67-79e6" content-type application/javascript status 200 accept-ranges bytes content-length 31206
GET H/1.1	200 OK	Primary Request index.php Show response mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/ Redirect Chain https://webmail.mof-gov-sa.ga/DPRUbiu?i=1 https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/?id=fK8mxT4kiiJ6dBe~5bg2PG0U4w7ttiD4QA7BFinRTO25MZbWohIaqWjQUAEkCA/DLUvNtqS21ZaS1D2saN9wRp1m8Mdfh9vyAzGWt2SU... https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?id=wEX2uuRV4rCERNRrgXN7pg&dt=9VkW7MCEH7aPQeBk6piO5Q&rd=I6qGOAu9svOOk2Qj0RMTVfZbhDTC51ybmKld3NJhaJR... https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2...	102 KB 102 KB	61ms 60ms	Document text/html	31.131.27.146 VPS-UA-AS
General Check archive.org Show headers Download Go to Full URL https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Requested by Host: webmail.mof-gov-sa.ga URL: https://webmail.mof-gov-sa.ga/DPRUbiu Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.131.27.146 Atlanta, United States, ASN56851 (VPS-UA-AS, UA), Reverse DNS Software Apache / Resource Hash `8c7d09a3c89d77814f291c24d6135f0f174f4377592f87738d4a1dd965522086` Request headers Host mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer https://webmail.mof-gov-sa.ga/DPRUbiu Accept-Encoding gzip, deflate Cookie PHPSESSID=a8083s559d617obganal4fks73 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 48ED1E3E52B89AD1630FF2D36D837125 Referer https://webmail.mof-gov-sa.ga/DPRUbiu Response headers Date Mon, 03 Sep 2018 05:59:07 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Mon, 03 Sep 2018 05:59:07 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Location index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bgdladbuwdliuagwidugawugd.jpg mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/MOFskajhdlaiuwhdiuhwd/	169 KB 169 KB	14ms 14ms	Image image/jpeg	31.131.27.146 VPS-UA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/MOFskajhdlaiuwhdiuhwd/bgdladbuwdliuagwidugawugd.jpg Requested by Host: mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com URL: https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.131.27.146 Atlanta, United States, ASN56851 (VPS-UA-AS, UA), Reverse DNS Software Apache / Resource Hash `96a8fe6a4fea4ffe83417c6b09a2fef8a9a3894115a488ece0bb94b6f96c21d4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Connection keep-alive Cache-Control no-cache Referer https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 03 Sep 2018 05:59:07 GMT Last-Modified Thu, 31 May 2018 04:33:22 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 172690
GET DATA	200 OK	truncated /	33 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e531092fa4ba0e2d54e9335617621369d4c7047a349c6540cbca7b0a37fa99d2` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H/1.1	200 OK	chaptchaimg.php Show response mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/ Frame BC25	366 B 573 B	65ms 64ms	Document text/html	31.131.27.146 VPS-UA-AS
General Check archive.org Show headers Download Go to Full URL https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/chaptchaimg.php Requested by Host: mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com URL: https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.131.27.146 Atlanta, United States, ASN56851 (VPS-UA-AS, UA), Reverse DNS Software Apache / Resource Hash `9be40526591da5673bc89b6e389b8fbb16e1005a8bf43983fa7f10188f45d421` Request headers Host mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 48ED1E3E52B89AD1630FF2D36D837125 Referer https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/index.php?key=aXVxd3llaXVod2xpdWVobGlzYWx1aWRnYWxzaWR1aHNqa3piYyxqaHh6YmNqaGJ6eCxqaGNidWFnZGxpYXVnc2RsaXVnc2FsaXVkZ2Fsc3VpZGdsaXVhc2dkaWF1bHNnZGxpdWFzZ2RsaXVhZ2RsaXVzYWdkbGl1YXNnZGxpdWFzZGdhaWxzdWRnYWp&uy=zZGdqYXNkZ2FzamRnamFrc2Rna3Vhd3lnb3VkZ2FvdXlkZ2x3dWdkdWxnYXd1ZGdhd2xpdWRnYWxpdXdnZGxpYXV3Z2RsdWdhd2xkaXVnYXdsaXU= Response headers Date Mon, 03 Sep 2018 05:59:08 GMT Server Apache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0cc9dfaafe08a92392434ef9b39743585e4c975770e4ae43d91769615ebac428` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H/1.1	200 OK	captchahdsagdkhasd.PNG mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/MOFskajhdlaiuwhdiuhwd/ Frame BC25	16 KB 17 KB	14ms 13ms	Image image/png	31.131.27.146 VPS-UA-AS
General Check archive.org Show headers Download Go to Show image Full URL https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/MOFskajhdlaiuwhdiuhwd/captchahdsagdkhasd.PNG Requested by Host: mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com URL: https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/chaptchaimg.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.131.27.146 Atlanta, United States, ASN56851 (VPS-UA-AS, UA), Reverse DNS Software Apache / Resource Hash `b44833d3cbcf28fc87ebdeae91ad251ce4016247e474083a949399d914fa86bf` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/chaptchaimg.php Connection keep-alive Cache-Control no-cache Referer https://mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com/chaptchaimg.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Mon, 03 Sep 2018 05:59:08 GMT Last-Modified Sun, 03 Jun 2018 23:50:10 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 16660

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

grabify.link
mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com
webmail.mof-gov-sa.ga
104.27.142.121
185.27.134.132
31.131.27.146
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
0cc9dfaafe08a92392434ef9b39743585e4c975770e4ae43d91769615ebac428
1029d92da3628431eb450130b9b4425110edd54046b0119a2b120631ca9717a5
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
8c7d09a3c89d77814f291c24d6135f0f174f4377592f87738d4a1dd965522086
96a8fe6a4fea4ffe83417c6b09a2fef8a9a3894115a488ece0bb94b6f96c21d4
9be40526591da5673bc89b6e389b8fbb16e1005a8bf43983fa7f10188f45d421
b44833d3cbcf28fc87ebdeae91ad251ce4016247e474083a949399d914fa86bf
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
e531092fa4ba0e2d54e9335617621369d4c7047a349c6540cbca7b0a37fa99d2

mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com Open in urlscan Pro 31.131.27.146 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

320 kBTransfer

385 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

mail-mof-gov-sa-connect-auth-servr-asmx347347-update-cookie-ssl.connect-auth.com Open in urlscan Pro
31.131.27.146 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

320 kB
Transfer

385 kB
Size

0
Cookies

6 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!