app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com
Open in
urlscan Pro
199.127.61.19
Malicious Activity!
Public Scan
URL:
http://app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/en/3/cfcd208495d565ef66e7dff9f98764da/d41d8cd98f00b204e9800998ecf8427e/7b57ce86b6cb5ae1d1241f1cc...
Submission Tags: @jcybersec_
Submission: On May 28 via api from GB
Submission Tags: @jcybersec_
Submission: On May 28 via api from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 199.127.61.19, located in
Las Vegas, United States and
belongs to RELIABLESITE, US.
The main domain is app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com.
This is the only time app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com was scanned on urlscan.io!
This is the only time app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Mailgun (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 199.127.61.19 199.127.61.19 | 23470 (RELIABLESITE) (RELIABLESITE) | |
| 7 | 1 |
7
199.127.61.19
(Las Vegas, United States)
ASN23470 (RELIABLESITE, US)
ASN23470 (RELIABLESITE, US)
| app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
meteorainversiones.com
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com |
171 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com |
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com
|
| 7 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| login.mailgun.com |
| signup.mailgun.com |
| www.mailgun.com |
| help.mailgun.com |
| twitter.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/en/3/cfcd208495d565ef66e7dff9f98764da/d41d8cd98f00b204e9800998ecf8427e/7b57ce86b6cb5ae1d1241f1cc6eac99f
Frame ID: 500E47909D2449CD3E7CE8B8A39C5968
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
CentOS
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /CentOS/i
animate.css (Web Frameworks) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
URL: https://login.mailgun.com/recovery/new
Title: Forgot password?
Title: Forgot password?
Search URL Search Domain Scan URL
URL: https://signup.mailgun.com/
Title: Sign up Here
Title: Sign up Here
Search URL Search Domain Scan URL
URL: https://www.mailgun.com/terms
Title: Terms of service
Title: Terms of service
Search URL Search Domain Scan URL
URL: https://www.mailgun.com/privacy-policy
Title: Privacy policy
Title: Privacy policy
Search URL Search Domain Scan URL
URL: https://www.mailgun.com/jobs
Title: Jobs
Title: Jobs
Search URL Search Domain Scan URL
URL: http://help.mailgun.com/
Title: Help center
Title: Help center
Search URL Search Domain Scan URL
URL: https://www.mailgun.com/blog
Title: Blog
Title: Blog
Search URL Search Domain Scan URL
URL: https://www.mailgun.com/team
Title: Team
Title: Team
Search URL Search Domain Scan URL
URL: http://twitter.com/Mail_Gun
Title: Twitter
Title: Twitter
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
7b57ce86b6cb5ae1d1241f1cc6eac99f
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/en/3/cfcd208495d565ef66e7dff9f98764da/d41d8cd98f00b204e9800998ecf8427e/ |
10 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
animate.min.css
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/mailgun.com/com/assets/ |
57 KB 57 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/mailgun.com/com/assets/ |
6 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.svg
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/mailgun.com/com/assets/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/mailgun.com/com/assets/ |
94 KB 94 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
blue_bg.png
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/mailgun.com/com/assets/ |
362 B 362 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
inter.woff
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com/mailgun.com/com/assets/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Mailgun (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| showMessage object| date string| currentStepSelector function| qriousOpts function| nextStep function| showError function| next function| currentStep function| checkUsername function| checkPassword function| getSecretFromOTP function| complete2fa function| check2fa function| confirm2fa function| post0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.mailgun.com.new-session.onswixx.41348.meteorainversiones.com
199.127.61.19
0cb6073e831562296a2e8f3d1d7ce806012be39c2110dd42fa213d86d65c65c9
100a135d8e7d5ebf1fe83b0b16da1d8d8b2321acdc4d5c24a1f9a7df53b23cf1
3c770e90f98eb21b0c042fafb49755af93306fbaf42e449524f94fae9fc83295
824f0244a925128825fb4b73920ffc4edf9f02db39520db886ff1886455f023b
a03a4b6ba063a2891eb73cf71498374aaad6c634e021a58fa6a8a70ef5d08757
a9e04a1710d386a3d640ed22285784007b4c3da63f7c91bb3aabdf0f33af8d00