urlscan.io logo urlscan.io
SecurityTrails logo

invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud Open in urlscan Pro
158.177.118.97  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://meet.google.com/linkredirect?dest=https%3A%2F%2Fbdgteys834jdsgsjd.w3spaces.com%2F%3Fdg%3Dnelsonk%40claycorp.com
Effective URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexIN...
Submission Tags: falconsandbox
Submission: On July 13 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 158.177.118.97, located in United States and belongs to SOFTLAYER, US. The main domain is invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on November 23rd 2020. Valid for: a year.
This is the only time invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2600:9000:21f... 16509 (AMAZON-02)
1 158.177.118.97 36351 (SOFTLAYER)
3 104.219.250.234 22612 (NAMECHEAP...)
6 5
1    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
meet.google.com
1    2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2600:9000:21f3:fa00:b:df74:43c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
bdgteys834jdsgsjd.w3spaces.com
1    158.177.118.97 (United States)

ASN36351 (SOFTLAYER, US)
PTR: s3.eu-de.objectstorage.softlayer.net
invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud
3    104.219.250.234 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server1.dynamsat.com
activecitizensouthsudan.org
Domain Requested by
3 activecitizensouthsudan.org invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud
1 invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud bdgteys834jdsgsjd.w3spaces.com
1 bdgteys834jdsgsjd.w3spaces.com www.google.com
1 www.google.com
1 meet.google.com 1 redirects
6 5

This site contains no links.

Subject Issuer Validity Valid
www.google.com
GTS CA 1C3		 2021-06-22 -
2021-09-14		 3 months crt.sh
*.w3spaces.com
Amazon		 2020-12-21 -
2022-01-19		 a year crt.sh
*.s3.eu-de.cloud-object-storage.appdomain.cloud
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-23 -
2021-12-13		 a year crt.sh
activecitizensouthsudan.org
cPanel, Inc. Certification Authority		 2021-05-21 -
2021-08-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com
Frame ID: 6FC8B1DD2AE2E7101A761B0BEF94A347
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://meet.google.com/linkredirect?dest=https%3A%2F%2Fbdgteys834jdsgsjd.w3spaces.com%2F%3Fdg%3Dnel... HTTP 302
    https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp... Page URL
  2. https://bdgteys834jdsgsjd.w3spaces.com/?dg=nelsonk@claycorp.com Page URL
  3. https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204w... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /gws/i

Page Statistics

6
Requests

100 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

418 kB
Transfer

437 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://meet.google.com/linkredirect?dest=https%3A%2F%2Fbdgteys834jdsgsjd.w3spaces.com%2F%3Fdg%3Dnelsonk%40claycorp.com HTTP 302
    https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ Page URL
  2. https://bdgteys834jdsgsjd.w3spaces.com/?dg=nelsonk@claycorp.com Page URL
  3. https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://meet.google.com/linkredirect?dest=https%3A%2F%2Fbdgteys834jdsgsjd.w3spaces.com%2F%3Fdg%3Dnelsonk%40claycorp.com HTTP 302
  • https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
url
www.google.com/
Redirect Chain
  • https://meet.google.com/linkredirect?dest=https%3A%2F%2Fbdgteys834jdsgsjd.w3spaces.com%2F%3Fdg%3Dnelsonk%40claycorp.com
  • https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ
448 B
668 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
14113d1d3e52e3dd5636dcebc720b5a2c5fa76b32d8b1a60552241b51e986126
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=219=gXSMBlvKR7VrCyP_WXaCwyWQNQApDb1sfYVhVInnX-FVmG7-hBI8VHUCl1TzfXJGh1jYDEnmm1rSjcGqiAghA9OVq6fZ-1ZBl-0BXwtzjx7oWMjLbS8j-HKm1jT2o1EAxww7GDq8DiudqSFIroLYx9Q88J36cZkHBI8BOveTg0k
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

location
https://bdgteys834jdsgsjd.w3spaces.com/?dg=nelsonk@claycorp.com
cache-control
private
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=31536000
bfcache-opt-in
unload
date
Tue, 13 Jul 2021 21:43:29 GMT
server
gws
content-length
448
x-xss-protection
0
set-cookie
CONSENT=PENDING+506; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.com; Secure
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Tue, 13 Jul 2021 21:43:29 GMT

Redirect headers

content-type
application/binary
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Tue, 13 Jul 2021 21:43:29 GMT
location
https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
strict-transport-security
max-age=31536000
cross-origin-resource-policy
same-site
content-security-policy
script-src 'report-sample' 'nonce-cyf+X4UXF+iWJXufivUlYA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/MeetingsUi/cspreport;worker-src 'self' script-src 'nonce-cyf+X4UXF+iWJXufivUlYA' 'unsafe-eval' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://youtube.googleapis.com https://youtube.com https://s.ytimg.com https://www.youtube.googleapis.com https://payments.google.com/payments/v4/js/integrator.js https://payments.sandbox.google.com/payments/v4/js/integrator.js https://billing-ads-qa-devel.corp.google.com/payments/v4/js/integrator.js;report-uri /_/MeetingsUi/cspreport
server
ESF
content-length
0
x-xss-protection
0
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
set-cookie
NID=219=gXSMBlvKR7VrCyP_WXaCwyWQNQApDb1sfYVhVInnX-FVmG7-hBI8VHUCl1TzfXJGh1jYDEnmm1rSjcGqiAghA9OVq6fZ-1ZBl-0BXwtzjx7oWMjLbS8j-HKm1jT2o1EAxww7GDq8DiudqSFIroLYx9Q88J36cZkHBI8BOveTg0k; expires=Wed, 12-Jan-2022 21:43:29 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
bdgteys834jdsgsjd.w3spaces.com/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bdgteys834jdsgsjd.w3spaces.com/?dg=nelsonk@claycorp.com
Requested by
Host: www.google.com
URL: https://www.google.com/url?hl=en-US&q=https://bdgteys834jdsgsjd.w3spaces.com/?dg%3Dnelsonk@claycorp.com&sa=D&source=meet&ust=1626299009697000&usg=AFQjCNE5ifrcKj4TVP7F6PNLXc-GftfgWQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:fa00:b:df74:43c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c9245df822c8a9dc55f1049a38309d559a61455bde683280d4dc7d1924a2157c

Request headers

:method
GET
:authority
bdgteys834jdsgsjd.w3spaces.com
:scheme
https
:path
/?dg=nelsonk@claycorp.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://www.google.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.google.com/

Response headers

content-type
text/html
content-length
1652
x-amz-id-2
v6eADMLVuTorKoiz+MPEsZhAPXwdeTMqc4ASX4DR171YlIqPup7vZHlch/vKYNO6Mi63IiD0Xyw=
x-amz-request-id
31WT0X5NGFZPJ0V9
last-modified
Tue, 13 Jul 2021 09:38:14 GMT
accept-ranges
bytes
server
AmazonS3
date
Tue, 13 Jul 2021 21:43:31 GMT
etag
"88c56b256add78f10f008260aab8335c"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 c7015d60d4f8f2170aaaa75e69e40618.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
lRZyBru99NB_iXgwkmepa7NNOu1AlzeeR7CpnMsXd1DDRqIkwrmz2A==
Primary Request index.html
invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/ 		403 KB
403 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com
Requested by
Host: bdgteys834jdsgsjd.w3spaces.com
URL: https://bdgteys834jdsgsjd.w3spaces.com/?dg=nelsonk@claycorp.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
158.177.118.97 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
s3.eu-de.objectstorage.softlayer.net
Software
Cleversafe /
Resource Hash
4f3a1262dddb983c41eee8e7260dc93c78695978c01889269329f408efa78b90

Request headers

Host
invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
document
Referer
https://bdgteys834jdsgsjd.w3spaces.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://bdgteys834jdsgsjd.w3spaces.com/

Response headers

Date
Tue, 13 Jul 2021 21:43:30 GMT
X-Clv-Request-Id
e77d9bde-a8ce-4af9-922c-72493e0a69e2
Server
Cleversafe
X-Clv-S3-Version
2.5
Accept-Ranges
bytes
x-amz-request-id
e77d9bde-a8ce-4af9-922c-72493e0a69e2
ETag
"cab789513d745f96d772da4a8d1d3343"
Content-Type
text/html
Last-Modified
Tue, 13 Jul 2021 09:50:43 GMT
Content-Length
412708
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		756 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		899 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		222 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		513 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		915 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a39b1946b7e6064c5c7594067ada4d9785fba941756b0be27eab6b76d9682c55

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/jpeg
call.php
activecitizensouthsudan.org/ 		849 B
873 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://activecitizensouthsudan.org/call.php?u=nelsonk@claycorp.com
Requested by
Host: invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud
URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.219.250.234 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server1.dynamsat.com
Software
Apache /
Resource Hash
fa2bbd367eac3af2bf11598d184dad7b18320c0a52d42b8c44a17df6c35dc486

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Jul 2021 21:43:31 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
602
clearbit.php
activecitizensouthsudan.org/ 		5 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://activecitizensouthsudan.org/clearbit.php?d=claycorp.com
Requested by
Host: invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud
URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.219.250.234 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server1.dynamsat.com
Software
Apache /
Resource Hash
da1c65a2db7df15e57abf8a65478477fa77e11619f8f94928b00710c8829b465

Request headers

Accept
text/plain, */*; q=0.01
Referer
https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Jul 2021 21:43:31 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
5150
clearbit.php
activecitizensouthsudan.org/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://activecitizensouthsudan.org/clearbit.php?d=claycorp.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.219.250.234 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server1.dynamsat.com
Software
Apache /
Resource Hash
ea6f4d867a8b6b877676ec26d6f47bae8494af81bbe48817fb75bd4a31c5b16d

Request headers

Referer
https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 13 Jul 2021 21:43:32 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding,User-Agent
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
5150
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dde1acefe23281e3715bdee565cf1fd7064370d4bb751ab92c4add7d42932bbe

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash string| urll

0 Cookies

5 Console Messages

Source Level URL
Text
console-api log URL: https://bdgteys834jdsgsjd.w3spaces.com/?dg=nelsonk@claycorp.com(Line 17)
Message:
https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com
console-api log URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com(Line 10727)
Message:
PARAM CAME===>> nelsonk@claycorp.com
console-api log URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com(Line 10736)
Message:
PARAM CAME 2===>> nelsonk@claycorp.com
console-api log URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com(Line 10904)
Message:
domain ===> claycorp.com
console-api log URL: https://invoic-hejiu-message.s3.eu-de.cloud-object-storage.appdomain.cloud/index.html?sesid=BLtiVlsrSZfK0l9KPeXtUfHVJUsRjRhjRZyjwNXbbyjogAQXX3zfq38204wQH4GyMObbX33fIuLexINCGgIe1LJE7KRdxXFo7GcN13b3lL5Zm9ogP8OGTDvo0cS5JSibLFXvSnLEp7u3m6pLzhbFzwds80MGLXqEgW4ov0zdRTwJffLmVVlMqWBq62joPRbhlbofAiI9?dg=nelsonk@claycorp.com(Line 10767)
Message:
PARAM CAME 3===>> nelsonk@claycorp.com

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 0