notification-dvr.servehttp.com
Open in
urlscan Pro
209.141.37.237
Malicious Activity!
Public Scan
Effective URL: https://notification-dvr.servehttp.com/BZNGZwsju3Zgqt60769085f1d07/o3vrvy5ml15ed5a394876a1nq2lnv?s=def502002ce72bd7288bf0773bfc888e388d...
Submission: On April 14 via manual from SG
Summary
TLS certificate: Issued by R3 on April 11th 2021. Valid for: 3 months.
This is the only time notification-dvr.servehttp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 195.201.241.20 195.201.241.20 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 11 | 209.141.37.237 209.141.37.237 | 53667 (PONYNET) (PONYNET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
12 | 3 |
ASN24940 (HETZNER-AS, DE)
PTR: chromium.studio4web.com
exxonmobil.com.opcina-borovo.hr |
ASN53667 (PONYNET, US)
PTR: This-is-a-tor-exit.ignorelist.com
ctvpagt.reddifa.co.uk | |
notification-dvr.servehttp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
servehttp.com
notification-dvr.servehttp.com |
174 KB |
2 |
reddifa.co.uk
1 redirects
ctvpagt.reddifa.co.uk |
3 KB |
1 |
jquery.com
code.jquery.com |
29 KB |
1 |
opcina-borovo.hr
exxonmobil.com.opcina-borovo.hr |
535 B |
12 | 4 |
Domain | Requested by | |
---|---|---|
9 | notification-dvr.servehttp.com |
ctvpagt.reddifa.co.uk
notification-dvr.servehttp.com |
2 | ctvpagt.reddifa.co.uk |
1 redirects
exxonmobil.com.opcina-borovo.hr
|
1 | code.jquery.com |
notification-dvr.servehttp.com
|
1 | exxonmobil.com.opcina-borovo.hr | |
12 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ctvpagt.reddifa.co.uk R3 |
2021-04-11 - 2021-07-10 |
3 months | crt.sh |
notification-dvr.servehttp.com R3 |
2021-04-11 - 2021-07-10 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://notification-dvr.servehttp.com/BZNGZwsju3Zgqt60769085f1d07/o3vrvy5ml15ed5a394876a1nq2lnv?s=def502002ce72bd7288bf0773bfc888e388d3cf8023c0f71900b87fb44e7d6ab48ecf6c95402229073896d9089a4037a9c55c0af2ecf5198552070e9b549deeec58e635e3e105eed704ed4956db47d9ed38316e50843466e1565f5987c849d2fe7417d96c6a814defdab40fbf018857ef87f91bfb7d7045dbfbc5db241089153a4dab0c14423649bdd5dfecefa6c91bba2cdcdfaea39cf9386ebec6329016301b7bd80d33b472e934e9074e6a9e94fd0553d25d5912b4236ed1f4d87221c6f87d01179996e91e296175c02270ca5f21b254204d37ca1e98183e15b405def0ac7980bd3d70d6f193325bfde67f4fd545bb259e82bcf38db1071335b640fced3c404ea6e8271d0f594f389e31647a38b7bebf3f83abdddcdadd3349eb9da8af91fa4a9f537f30c4bd59b6a9139697db4ebf59d2b1c749f
Frame ID: 5DC705F464789407FDE4C104E043D052
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://exxonmobil.com.opcina-borovo.hr/ Page URL
-
https://ctvpagt.reddifa.co.uk/?gt=undefined
HTTP 302
https://ctvpagt.reddifa.co.uk/cps/o3vrvy5ml15ed5a394876a1?s=6465663530323030326365373262643732383862663037... Page URL
- https://notification-dvr.servehttp.com/BZNGZwsju3Zgqt60769085f1d07/o3vrvy5ml15ed5a394876a1nq2lnv?s=def502002ce72bd7... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://exxonmobil.com.opcina-borovo.hr/ Page URL
-
https://ctvpagt.reddifa.co.uk/?gt=undefined
HTTP 302
https://ctvpagt.reddifa.co.uk/cps/o3vrvy5ml15ed5a394876a1?s=6465663530323030326365373262643732383862663037373362666338383865333838643363663830323363306637313930306238376662343465376436616234386563663663393534303232323930373338393664393038396134303337613963353563306166326563663531393835353230373065396235343964656565633538653633356533653130356565643730346564343935366462343764396564333833313665353038343334363665313536356635393837633834396432666537343137643936633661383134646566646162343066626630313838353765663837663931626662376437303435646266626335646232343130383931353361346461623063313434323336343962646435646665636566613663393162626132636463646661656133396366393338366562656336333239303136333031623762643830643333623437326539333465393037346536613965393466643035353364323564353931326234323336656431663464383732323163366638376430313137393939366539316532393631373563303232373063613566323162323534323034643337636131653938313833653135623430356465663061633739383062643364373064366631393333323562666465363766346664353435626232353965383262636633386462313037313333356236343066636564336334303465613665383237316430663539346633383965333136343761333862376265626633663833616264646463646164643333343965623964613861663931666134613966353337663330633462643539623661393133393639376462346562663539643262316337343966 Page URL
- https://notification-dvr.servehttp.com/BZNGZwsju3Zgqt60769085f1d07/o3vrvy5ml15ed5a394876a1nq2lnv?s=def502002ce72bd7288bf0773bfc888e388d3cf8023c0f71900b87fb44e7d6ab48ecf6c95402229073896d9089a4037a9c55c0af2ecf5198552070e9b549deeec58e635e3e105eed704ed4956db47d9ed38316e50843466e1565f5987c849d2fe7417d96c6a814defdab40fbf018857ef87f91bfb7d7045dbfbc5db241089153a4dab0c14423649bdd5dfecefa6c91bba2cdcdfaea39cf9386ebec6329016301b7bd80d33b472e934e9074e6a9e94fd0553d25d5912b4236ed1f4d87221c6f87d01179996e91e296175c02270ca5f21b254204d37ca1e98183e15b405def0ac7980bd3d70d6f193325bfde67f4fd545bb259e82bcf38db1071335b640fced3c404ea6e8271d0f594f389e31647a38b7bebf3f83abdddcdadd3349eb9da8af91fa4a9f537f30c4bd59b6a9139697db4ebf59d2b1c749f Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://ctvpagt.reddifa.co.uk/?gt=undefined HTTP 302
- https://ctvpagt.reddifa.co.uk/cps/o3vrvy5ml15ed5a394876a1?s=6465663530323030326365373262643732383862663037373362666338383865333838643363663830323363306637313930306238376662343465376436616234386563663663393534303232323930373338393664393038396134303337613963353563306166326563663531393835353230373065396235343964656565633538653633356533653130356565643730346564343935366462343764396564333833313665353038343334363665313536356635393837633834396432666537343137643936633661383134646566646162343066626630313838353765663837663931626662376437303435646266626335646232343130383931353361346461623063313434323336343962646435646665636566613663393162626132636463646661656133396366393338366562656336333239303136333031623762643830643333623437326539333465393037346536613965393466643035353364323564353931326234323336656431663464383732323163366638376430313137393939366539316532393631373563303232373063613566323162323534323034643337636131653938313833653135623430356465663061633739383062643364373064366631393333323562666465363766346664353435626232353965383262636633386462313037313333356236343066636564336334303465613665383237316430663539346633383965333136343761333862376265626633663833616264646463646164643333343965623964613861663931666134613966353337663330633462643539623661393133393639376462346562663539643262316337343966
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
exxonmobil.com.opcina-borovo.hr/ |
257 B 535 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
o3vrvy5ml15ed5a394876a1
ctvpagt.reddifa.co.uk/cps/ Redirect Chain
|
762 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
o3vrvy5ml15ed5a394876a1nq2lnv
notification-dvr.servehttp.com/BZNGZwsju3Zgqt60769085f1d07/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
found.css
notification-dvr.servehttp.com/pr/ms/ |
142 KB 142 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
z.css
notification-dvr.servehttp.com/pr/ms/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.4.min.js
code.jquery.com/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
j.js
notification-dvr.servehttp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
outlook.png
notification-dvr.servehttp.com/pr/ms/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chronlogo.svg
notification-dvr.servehttp.com/pr/ms/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
left.svg
notification-dvr.servehttp.com/pr/ms/ |
513 B 755 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
j.js
notification-dvr.servehttp.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg2.jpg
notification-dvr.servehttp.com/pr/ms/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| _0x5011 function| _0x51880 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
ctvpagt.reddifa.co.uk
exxonmobil.com.opcina-borovo.hr
notification-dvr.servehttp.com
195.201.241.20
2001:4de0:ac18::1:a:1b
209.141.37.237
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
541713eaf7ddbdc2507d3ff005f333be2259c7c07d0d0657f19d61413bdb26ff
620059b102655bb3dc0907d6ae2b71d421758930167d0e6d15d8711967afb391
c070ed1b81c2d1c1010302e4fe4feb696b4d8390e6eeddc1cdc44a4bf70639b1
cdd2e4119111fc5cf47d596a6391997a6e88f8ee48da506d477a06b5a2ea6a66
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898
fbae9f3251e29759c84af1912d1de2afa7319a1f1e30eb4e243f97a553e3d319