khetibuddy.com Open in urlscan Pro
162.241.85.104 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdY...
Effective URL:
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee03...
Submission: On October 06 via api (October 6th 2021, 3:04:56 am UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 10 HTTP transactions. The main IP is 162.241.85.104, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is khetibuddy.com.
TLS certificate: Issued by R3 on August 29th 2021. Valid for: 3 months.

This is the only time khetibuddy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.233.228.78 54.233.228.78	16509 (AMAZON-02) (AMAZON-02)
1	144.217.158.133 144.217.158.133	16276 (OVH) (OVH)
1 10	162.241.85.104 162.241.85.104	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
10	2

1 54.233.228.78 (São Paulo, Brazil) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-233-228-78.sa-east-1.compute.amazonaws.com

nt.embluemail.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.217.158.133 (Beauharnois, Canada)

ASN16276 (OVH, FR)
PTR: r3.a1center.net

nucmaeirl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 162.241.85.104 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-85-104.unifiedlayer.com

khetibuddy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	khetibuddy.com 1 redirects khetibuddy.com	391 KB
1	nucmaeirl.net nucmaeirl.net	22 KB
1	embluemail.com 1 redirects nt.embluemail.com	217 B
10	3

	Domain	Requested by
10	khetibuddy.com	1 redirects nucmaeirl.net khetibuddy.com
1	nucmaeirl.net
1	nt.embluemail.com	1 redirects
10	3

This site contains no links.

Subject Issuer	Validity	Valid
nucmaeirl.net R3	`2021-09-13` - `2021-12-12`	3 months	crt.sh
www.khetibuddy.com R3	`2021-08-29` - `2021-11-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc
Frame ID: 568CB1C2B8C5A2A18203D0E158681749
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to Outlook

Page URL History Show full URLs

https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6a... HTTP 302
https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Page URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... HTTP 302
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

413 kB
Transfer

603 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fjmartini%40camelbak.com HTTP 302
https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Page URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$jmartini@camelbak.com HTTP 302
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fjmartini%40camelbak.com HTTP 302
https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	jmartini@camelbak.com nucmaeirl.net/m7m/503c06a6/ Redirect Chain https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net... https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com	22 KB 22 KB	1820ms 1631ms	Document text/html	144.217.158.133 OVH
General Check archive.org Show headers Download Go to Full URL https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 144.217.158.133 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS r3.a1center.net Software Apache / PHP/5.6.40 Resource Hash Request headers Host nucmaeirl.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Wed, 06 Oct 2021 03:04:40 GMT Server Apache X-Powered-By PHP/5.6.40 Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers date Wed, 06 Oct 2021 03:04:40 GMT content-type application/json content-length 0 location https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com x-amzn-requestid e7c09a6e-09d2-4ab3-9582-5f34a9738e61 x-amz-apigw-id Gw_LRGDJGjQFaag= x-amzn-trace-id Root=1-615d1247-1e17eaf844a871a534e61fb3;Sampled=0
GET H2	200	Primary Request PS-615d1250c3cfc Show response khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ Redirect Chain https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$jmartini@camelbak.com https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc	37 KB 3 KB	487ms 486ms	Document text/html	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Requested by Host: nucmaeirl.net URL: https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `0d0039c23be60511930604482cc75e752a78dc29d5e088ef8ec67e5002196465` Request headers :method GET :authority khetibuddy.com :scheme https :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://nucmaeirl.net/ accept-encoding gzip, deflate, br cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://nucmaeirl.net/m7m/503c06a6/jmartini@camelbak.com Response headers date Wed, 06 Oct 2021 03:04:49 GMT server nginx/1.19.10 content-type text/html; charset=UTF-8 content-length 3128 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate pragma no-cache vary Accept-Encoding content-encoding gzip x-server-cache false Redirect headers date Wed, 06 Oct 2021 03:04:48 GMT server nginx/1.19.10 content-type text/html; charset=UTF-8 content-length 0 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate pragma no-cache location ./PS-615d1250c3cfc x-server-cache false set-cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7; path=/
GET H2	200	8f29526dd400d4544f951cfd5521f5799198404e14c51 khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-HIOHOB/	103 KB 26 KB	412ms 408ms	Stylesheet text/css	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-HIOHOB/8f29526dd400d4544f951cfd5521f5799198404e14c51 Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-HIOHOB/8f29526dd400d4544f951cfd5521f5799198404e14c51 pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,/;q=0.1 cache-control no-cache sec-fetch-dest style :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 03:04:49 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 15:23:18 GMT server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control public accept-ranges bytes expires max-age=A10368000, public
GET H2	200	9d40f1d8545f44195e54216505f799c8940d22dfc1451 khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/	4 KB 2 KB	281ms 278ms	Image image/svg+xml	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/9d40f1d8545f44195e54216505f799c8940d22dfc1451 Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/9d40f1d8545f44195e54216505f799c8940d22dfc1451 pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 03:04:49 GMT content-encoding gzip last-modified Sat, 23 Nov 2019 18:10:04 GMT server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type image/svg+xml cache-control max-age=10368000 accept-ranges bytes content-length 1522 expires max-age=A10368000, public
GET H2	200	0574d1f549225190918ddf4f46928c5fc154549140d5e khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/	513 B 334 B	671ms 669ms	Image image/svg+xml	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/0574d1f549225190918ddf4f46928c5fc154549140d5e Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/0574d1f549225190918ddf4f46928c5fc154549140d5e pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 03:04:49 GMT content-encoding gzip last-modified Sun, 24 Nov 2019 01:44:20 GMT server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type image/svg+xml cache-control max-age=10368000 accept-ranges bytes content-length 276 expires max-age=A10368000, public
GET H2	200	cd1921590f9fd0595dce551488fd76154142f05494442 Show response khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/	84 KB 37 KB	411ms 407ms	Script application/javascript	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/cd1921590f9fd0595dce551488fd76154142f05494442 Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/cd1921590f9fd0595dce551488fd76154142f05494442 pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 03:04:49 GMT content-encoding gzip last-modified Mon, 17 May 2021 16:23:14 GMT server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private accept-ranges bytes expires max-age=A10368000, public
GET H2	200	fd55197f5c9149dc0e885410145202451df492695d44f Show response khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/	50 KB 21 KB	409ms 407ms	Script application/javascript	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/fd55197f5c9149dc0e885410145202451df492695d44f Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/fd55197f5c9149dc0e885410145202451df492695d44f pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 03:04:49 GMT content-encoding gzip last-modified Mon, 17 May 2021 16:23:24 GMT server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private accept-ranges bytes expires max-age=A10368000, public
GET H2	200	445e55ffc9444719d9dff1d58280249140c15d6505921 Show response khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/	5 KB 1 KB	672ms 671ms	Script application/javascript	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/445e55ffc9444719d9dff1d58280249140c15d6505921 Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/445e55ffc9444719d9dff1d58280249140c15d6505921 pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept / cache-control no-cache sec-fetch-dest script :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 06 Oct 2021 03:04:49 GMT content-encoding gzip last-modified Fri, 03 Sep 2021 18:38:14 GMT server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private accept-ranges bytes content-length 1433 expires max-age=A10368000, public
GET H2	200	api-9f51d09f58dc4e484751f52192f1500494425dd4c9516 khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/	7 KB 7 KB	1359ms 1358ms	Image image/jpeg	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-9f51d09f58dc4e484751f52192f1500494425dd4c9516?email=jmartini@camelbak.com&data=logo Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `d3d67d692079e0bb899867eb683d3fa5195ed7b2d0ef84d288233e176d10b924` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-9f51d09f58dc4e484751f52192f1500494425dd4c9516?email=jmartini@camelbak.com&data=logo pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 06 Oct 2021 03:04:51 GMT content-encoding gzip server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type image/jpeg; cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate content-length 7270 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	api-6240c4811019f4f914c5975451dd5208fd59f2d549e54 khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/	292 KB 294 KB	995ms 994ms	Image image/jpeg	162.241.85.104 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-6240c4811019f4f914c5975451dd5208fd59f2d549e54?email=jmartini@camelbak.com&data=background Requested by Host: khetibuddy.com URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-104.unifiedlayer.com Software nginx/1.19.10 / Resource Hash `4e0892b685d57c0a9cf5da6d8ca4d71f36d6336f4dbefbdc8ff65e417edd0fdf` Request headers :path /m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-6240c4811019f4f914c5975451dd5208fd59f2d549e54?email=jmartini@camelbak.com&data=background pragma no-cache cookie PHPSESSID=dca71113177216d2071e958cfcaf3ed7 accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 cache-control* no-cache sec-fetch-dest image :authority khetibuddy.com referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d1250c3cfc User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Wed, 06 Oct 2021 03:04:50 GMT content-encoding gzip server nginx/1.19.10 x-server-cache false vary Accept-Encoding content-type image/jpeg; cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			khetibuddy.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: dca71113177216d2071e958cfcaf3ed7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

khetibuddy.com
nt.embluemail.com
nucmaeirl.net
144.217.158.133
162.241.85.104
54.233.228.78
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0d0039c23be60511930604482cc75e752a78dc29d5e088ef8ec67e5002196465
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
4e0892b685d57c0a9cf5da6d8ca4d71f36d6336f4dbefbdc8ff65e417edd0fdf
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
d3d67d692079e0bb899867eb683d3fa5195ed7b2d0ef84d288233e176d10b924
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7

khetibuddy.com Open in urlscan Pro 162.241.85.104 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

413 kBTransfer

603 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

1 Cookies

Indicators

khetibuddy.com Open in urlscan Pro
162.241.85.104 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

413 kB
Transfer

603 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!