metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz
Open in
urlscan Pro
139.59.255.208
Malicious Activity!
Public Scan
Effective URL: https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142e56b03f52
Submission: On September 16 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 2nd 2021. Valid for: 3 months.
This is the only time metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.207.148.143 54.207.148.143 | 16509 (AMAZON-02) (AMAZON-02) | |
1 11 | 139.59.255.208 139.59.255.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
10 | 1 |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-207-148-143.sa-east-1.compute.amazonaws.com
nt.embluemail.com |
ASN14061 (DIGITALOCEAN-ASN, US)
ansley.farazbamgostar.com | |
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
cloudns.nz
1 redirects
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
361 KB |
1 |
farazbamgostar.com
ansley.farazbamgostar.com |
23 KB |
1 |
embluemail.com
1 redirects
nt.embluemail.com |
226 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
1 redirects
ansley.farazbamgostar.com
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
1 | ansley.farazbamgostar.com | |
1 | nt.embluemail.com | 1 redirects |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ansley.farazbamgostar.com R3 |
2021-09-16 - 2021-12-15 |
3 months | crt.sh |
www.metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz R3 |
2021-09-02 - 2021-12-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142e56b03f52
Frame ID: F6A2EA7FD405DE9D80FEFA88B5ED0D61
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
C400E2D6DF7588FC366A532B0CE30AC16142E56B34ED3Page URL History Show full URLs
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2...
HTTP 302
https://ansley.farazbamgostar.com/bWFya3VzLmJpZXJsQGZyYW5rZS5jb20= Page URL
-
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/$&YlisKrROe2J4ipmfM6GY5yU...
HTTP 302
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142e56b03f52 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fansley.farazbamgostar.com%2FbWFya3VzLmJpZXJsQGZyYW5rZS5jb20=
HTTP 302
https://ansley.farazbamgostar.com/bWFya3VzLmJpZXJsQGZyYW5rZS5jb20= Page URL
-
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/$&YlisKrROe2J4ipmfM6GY5yUoey07qFK6tcpsPqcCiAtCCmFZTnuzfffvt3k2944r3dOb9xQAKhKTRPv9bGIPcW1QjeTaaQ6a4917NhRA0hiomKGdctWorGxltuzpyFvAhw3Cj86v0Rct84khxPQsAoJenXBqdMX7WXDcAKca8YCKvigK5FvVOG4V4OLosydWk54h8Gm9?client=bWFya3VzLmJpZXJsQGZyYW5rZS5jb20=
HTTP 302
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142e56b03f52 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fansley.farazbamgostar.com%2FbWFya3VzLmJpZXJsQGZyYW5rZS5jb20= HTTP 302
- https://ansley.farazbamgostar.com/bWFya3VzLmJpZXJsQGZyYW5rZS5jb20=
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
bWFya3VzLmJpZXJsQGZyYW5rZS5jb20=
ansley.farazbamgostar.com/ Redirect Chain
|
23 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
PS-6142e56b03f52
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ Redirect Chain
|
37 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
31a2380c6e75e603518c20de64b6cd5fc4343e6f20dab
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/APP-RW0HAN/ |
103 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3c26d5ce43e1a80460467c33c53fe20eb1dd58f662a0b
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/o/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
528365313b23ac4fd34be08206c7ed0c6665eac014dfe
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/e/ |
513 B 635 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ab20f0c8d3a6e2303d3dcc5e85c4616204b5f31ee4676
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/jq/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e336bf040728ee1d34bc18260e665d6f55c2ad34cac30
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/boot/ |
50 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1c68d5470ef3c02d064bab6c08e2636e531a523fd43ce
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/jm/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-5ef3360e6e437e8cf3081dad420a26cb0246b6cd35c15
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-3a316666c80d54ec0de7230cba5251842ff364eedcb03
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ |
290 KB 288 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/ | Name: PHPSESSID Value: k3v4b6k58chrsn627bc1dfqu8t |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ansley.farazbamgostar.com
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz
nt.embluemail.com
139.59.255.208
54.207.148.143
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
4f45f5ec5ff7fec8959778454be8bbcdb9148eb4517bb14c2d797db73c43e86b
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
960ce04dedf17a623df35429e8173e2300fcde1664002248d3f45071134c92b3
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
b04a0a8104d33e418b7e1f52fef9716ec9dd06c3a1492fae4e7e2bc9a4b65788
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7