lyf-sa.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 69.49.244.223, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is lyf-sa.com.

This is the only time lyf-sa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	69.49.244.223 69.49.244.223	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	151.101.112.193 151.101.112.193	54113 (FASTLY) (FASTLY)
2	3

2 69.49.244.223 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-244-223.unifiedlayer.com

lyf-sa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	lyf-sa.com 1 redirects lyf-sa.com	30 KB
1	imgur.com i.imgur.com — Cisco Umbrella Rank: 5174	2 KB
2	2

	Domain	Requested by
2	lyf-sa.com	1 redirects
1	i.imgur.com	lyf-sa.com
2	2

This site contains no links.

Subject Issuer	Validity	Valid
*.imgur.com DigiCert SHA2 Secure Server CA	`2020-01-15` - `2022-03-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://lyf-sa.com/ow/App/
Frame ID: D04C2ACC026EFBB8E98A9FF44BE44A68
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web App

Page URL History Show full URLs

http://lyf-sa.com/ow/App HTTP 301
http://lyf-sa.com/ow/App/ Page URL

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

31 kB
Transfer

44 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://lyf-sa.com/ow/App HTTP 301
http://lyf-sa.com/ow/App/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
lyf-sa.com/ow/App/
Redirect Chain

http://lyf-sa.com/ow/App
http://lyf-sa.com/ow/App/

29 KB
29 KB

133ms
133ms

Document
text/html

69.49.244.223
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://lyf-sa.com/ow/App/
Protocol: HTTP/1.1
Server: 69.49.244.223 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 69-49-244-223.unifiedlayer.com
Software: Apache /
Resource Hash: fc41b8a6c8aebeec4749fddba59e8852dd5f747b540c2019575c79a9e498c302

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Wed, 02 Feb 2022 16:05:46 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Wed, 02 Feb 2022 16:05:46 GMT
Server: Apache
Location: http://lyf-sa.com/ow/App/
Content-Length: 233
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://lyf-sa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://lyf-sa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Y8NrZIF.png
i.imgur.com/ 1 KB
2 KB 36ms
9ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/Y8NrZIF.png

Requested by

Host: lyf-sa.com
URL: http://lyf-sa.com/ow/App/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

a4805cc1acb64a7a9b52fc73df9f1d856ce9cc0d98688df29ee2385fda348bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://lyf-sa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 16:05:47 GMT
x-content-type-options: nosniff
age: 1052532
x-cache: HIT, HIT
content-length: 1481
x-served-by: cache-iad-kjyo7100104-IAD, cache-hhn4021-HHN
last-modified: Tue, 26 May 2020 16:41:48 GMT
server: cat factory 1.0
x-timer: S1643817947.366018,VS0,VE2
etag: "8286f21159c4139f905e9667dadddc62"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://lyf-sa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://lyf-sa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
lyf-sa.com
151.101.112.193
69.49.244.223
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
a4805cc1acb64a7a9b52fc73df9f1d856ce9cc0d98688df29ee2385fda348bc7
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
fc41b8a6c8aebeec4749fddba59e8852dd5f747b540c2019575c79a9e498c302

lyf-sa.com Open in urlscan Pro 69.49.244.223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

31 kBTransfer

44 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

lyf-sa.com Open in urlscan Pro
69.49.244.223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

31 kB
Transfer

44 kB
Size

0
Cookies

2 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!