login.metruyl.co - urlscan.io

Summary

This website contacted 7 IPs in 4 countries across 3 domains to perform 6 HTTP transactions. The main IP is 91.218.67.157, located in Germany and belongs to SYNLINQ synlinq.de, DE. The main domain is login.metruyl.co.
TLS certificate: Issued by R3 on July 22nd 2023. Valid for: 3 months.

This is the only time login.metruyl.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	194.71.130.193 194.71.130.193	5483 (MAGYAR-TE...) (MAGYAR-TELEKOM-MAIN-AS Magyar Telekom Nyrt.)
1	192.71.227.57 192.71.227.57	9009 (M247) (M247)
1	91.218.67.157 91.218.67.157	44486 (SYNLINQ s...) (SYNLINQ synlinq.de)
1 2	2606:4700:20:... 2606:4700:20::681a:51e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	163.181.92.237 163.181.92.237	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
1	2a04:4e42:400... 2a04:4e42:400::347	54113 (FASTLY) (FASTLY)
6	7

1 194.71.130.193 (Hungary)

ASN5483 (MAGYAR-TELEKOM-MAIN-AS Magyar Telekom Nyrt., HU)
PTR: 193.130.71.194.in-addr.arpa

194.71.130.193	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.71.227.57 (Montreal, Canada)

ASN9009 (M247, RO)
PTR: 57.227.71.192.in-addr.arpa

192.71.227.57	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.218.67.157 (Germany)

ASN44486 (SYNLINQ synlinq.de, DE)

login.metruyl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:51e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

picsum.photos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 163.181.92.237 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

cstaticdun.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::347 (United States)

ASN54113 (FASTLY, US)

fastly.picsum.photos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	picsum.photos 1 redirects picsum.photos — Cisco Umbrella Rank: 64254 fastly.picsum.photos — Cisco Umbrella Rank: 106941	10 KB
1	126.net cstaticdun.126.net — Cisco Umbrella Rank: 53354	12 KB
1	metruyl.co login.metruyl.co	11 KB
6	3

	Domain	Requested by
2	picsum.photos	1 redirects login.metruyl.co
1	fastly.picsum.photos	login.metruyl.co
1	cstaticdun.126.net	login.metruyl.co
1	login.metruyl.co
6	4

This site contains no links.

Subject Issuer	Validity	Valid
login.metruyl.co R3	`2023-07-22` - `2023-10-20`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-22` - `2024-04-21`	a year	crt.sh
*.126.net TrustAsia RSA OV TLS CA G2	`2022-11-28` - `2023-12-08`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login.metruyl.co/cUOujImV
Frame ID: 19991806A1285F55573594C45D8E04AD
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Captcha

Page URL History Show full URLs

http://194.71.130.193/544/3687474703a2f2f333232353933363639372f3330382f7368616e612e7665726d6569726... Page URL
https://login.metruyl.co/cUOujImV Page URL

Page Statistics

6
Requests

50 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

7
IPs

4
Countries

33 kB
Transfer

33 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://194.71.130.193/544/3687474703a2f2f333232353933363639372f3330382f7368616e612e7665726d656972656e40616f6e2e6265 Page URL
https://login.metruyl.co/cUOujImV Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://picsum.photos/300/150/?image=1048 HTTP 302
https://fastly.picsum.photos/id/1048/300/150.jpg?hmac=PXBVZlJz1NwQTyVdBgjd7SXZTwl7Mbn3O9LmES4eyIc

6 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK 3687474703a2f2f333232353933363639372f3330382f7368616e612e7665726d656972656e40616f6e2e6265
194.71.130.193/544/ 44 B
309 B 81ms
37ms Document
text/html 194.71.130.193
MAGYAR-TELEKOM-MA...

General

Check archive.org

Show headers Download Go to

Full URL: http://194.71.130.193/544/3687474703a2f2f333232353933363639372f3330382f7368616e612e7665726d656972656e40616f6e2e6265
Protocol: HTTP/1.1
Server: 194.71.130.193 , Hungary, ASN5483 (MAGYAR-TELEKOM-MAIN-AS Magyar Telekom Nyrt., HU),
Reverse DNS: 193.130.71.194.in-addr.arpa
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 44
Content-Type: text/html; charset=UTF-8
Date: Wed, 26 Jul 2023 07:02:16 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.41 (Ubuntu)
refresh: 0;url=http://3225936697/308/shana.vermeiren@aon.be

GET
H/1.1 200
OK shana.vermeiren@aon.be
192.71.227.57/308/ 0
276 B 219ms
108ms Document
text/html 192.71.227.57
M247

General

Check archive.org

Show headers Download Go to

Full URL: http://192.71.227.57/308/shana.vermeiren@aon.be
Protocol: HTTP/1.1
Server: 192.71.227.57 Montreal, Canada, ASN9009 (M247, RO),
Reverse DNS: 57.227.71.192.in-addr.arpa
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash

Request headers

Referer: http://194.71.130.193/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Wed, 26 Jul 2023 07:02:16 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.41 (Ubuntu)
refresh: 0;url=https://login.metruyl.co/cUOujImV#shana.vermeiren@aon.be

GET
H/1.1 200
OK Primary Request cUOujImV Show response
login.metruyl.co/ 11 KB
11 KB 133ms
34ms Document
text/html 91.218.67.157
SYNLINQ synlinq.de

General

Check archive.org

Show headers Download Go to

Full URL: https://login.metruyl.co/cUOujImV
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 91.218.67.157 , Germany, ASN44486 (SYNLINQ synlinq.de, DE),
Reverse DNS
Software: /
Resource Hash: 6ad62a453a452989ec407fd0b6faa2e4d4c1ce16b34b62ac5718ee99e765da55

Request headers

Referer: http://192.71.227.57/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Type: text/html
Transfer-Encoding: chunked

GET
H2 404 /
picsum.photos/300/150/ 21 B
21 B 133ms
56ms Image
text/plain 2606:4700:20::681a:51e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://picsum.photos/300/150/?image=624

Requested by

Host: login.metruyl.co
URL: https://login.metruyl.co/cUOujImV

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:51e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53f9ddc2ef530075a22d7bb9a9ce195145ad8b4361f6ab6dbad527cf7ff65801

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Referer: https://login.metruyl.co/
Origin: https://login.metruyl.co
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Wed, 26 Jul 2023 07:02:16 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SvsNOkgOf6n7DmZLsQMgTIN5IN29tLJCjVtztWAhTGw7gRR787iJcew%2BKxYvwe7Y3X%2FkBVKkH30Jp3%2F7FT0qbVg7zpscMLkNZs7rULDD7VDg8dcFt5H8E4h6UJGFxpUpLp0tcoPo3Gz3ZzA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
cf-ray: 7ecac6b19a3f361e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 21

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK icon_light.f13cff3.png
cstaticdun.126.net//2.6.3/images/ 11 KB
12 KB 1088ms
250ms Image
image/png 163.181.92.237
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png
Requested by: Host: login.metruyl.co
URL: https://login.metruyl.co/cUOujImV
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 163.181.92.237 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash: 5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login.metruyl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Date: Wed, 26 Jul 2023 07:01:44 GMT
Via: cache53.l2nu20-8[0,0,304-0,H], cache20.l2nu20-8[1,0], cache20.l2hk2[33,33,304-0,H], cache38.l2hk2[34,0], cache11.l2de2[223,223,304-0,H], cache15.l2de2[224,0], ens-cache1.de5[226,225,200-0,H], ens-cache3.de5[228,0]
Age: 33
X-Swift-CacheTime: 27
X-Cache: HIT TCP_REFRESH_HIT dirn:12:151411585
Connection: keep-alive
X-Swift-SaveTime: Wed, 26 Jul 2023 07:02:17 GMT
Content-Length: 11413
Last-Modified: Mon, 07 Nov 2022 05:53:30 GMT
Server: Tengine
Ali-Swift-Global-Savetime: 1690354904
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST,OPTIONS,HEAD
Access-Control-Expose-Headers: *
Cache-Control: max-age=43200
Accept-Ranges: bytes
Timing-Allow-Origin: *, *
EagleId: a3b55c9716903549373398706e
Expires: Tue, 06 Jun 2023 00:55:01 GMT

GET
H2

200

150.jpg
fastly.picsum.photos/id/1048/300/
Redirect Chain

https://picsum.photos/300/150/?image=1048
https://fastly.picsum.photos/id/1048/300/150.jpg?hmac=PXBVZlJz1NwQTyVdBgjd7SXZTwl7Mbn3O9LmES4eyIc

9 KB
9 KB

162ms
93ms

Image
image/jpeg

2a04:4e42:400::347
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fastly.picsum.photos/id/1048/300/150.jpg?hmac=PXBVZlJz1NwQTyVdBgjd7SXZTwl7Mbn3O9LmES4eyIc
Requested by: Host: login.metruyl.co
URL: https://login.metruyl.co/cUOujImV
Protocol: H2
Server: 2a04:4e42:400::347 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: da49f23aec97f550123c2b9ae698652f306af95274d9719e5ca10945cdc478ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login.metruyl.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

x-cache-hits: 0
date: Wed, 26 Jul 2023 07:02:16 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
content-disposition: inline; filename="1048-300x150.jpg"
content-length: 9354
x-served-by: cache-fra-eddf8230029-FRA
x-timer: S1690354937.749738,VS0,VE72
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Picsum-Id
cache-control: public, max-age=2592000, stale-while-revalidate=60, stale-if-error=43200, immutable
accept-ranges: bytes
timing-allow-origin: *
picsum-id: 1048

Redirect headers

date: Wed, 26 Jul 2023 07:02:16 GMT
strict-transport-security: max-age=15552000
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nefb0PkS3BKsVZs75TIHXAI5aOJt6U8ej%2F5KEFNcZiuGMv%2B87HW9OLngLZoUw3G6qAIcZ6zyfOReD8WH8xzDu0Wq82kuQ3ps0U9u2sUHV4ImIzWljyXhZxSH6epVp1pJCasHkJI%2BNCNbhDo%3D"}],"group":"cf-nel","max_age":604800}
location: https://fastly.picsum.photos/id/1048/300/150.jpg?hmac=PXBVZlJz1NwQTyVdBgjd7SXZTwl7Mbn3O9LmES4eyIc
access-control-allow-origin: *
cache-control: private, no-cache, no-store, must-revalidate
cf-ray: 7ecac6b1faad361e-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _createClass function| _classCallCheck function| cleanMsg object| jigsaw

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.metruyl.co/	1970-01-20 13:32:38	Name: ouuy Value: 56d760dc574ab4cb8064f18b820cfeeb762c1bf4e71195a4a32250431333caf6

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://picsum.photos/300/150/?image=624 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cstaticdun.126.net
fastly.picsum.photos
login.metruyl.co
picsum.photos
163.181.92.237
192.71.227.57
194.71.130.193
2606:4700:20::681a:51e
2a04:4e42:400::347
91.218.67.157
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
53f9ddc2ef530075a22d7bb9a9ce195145ad8b4361f6ab6dbad527cf7ff65801
5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401
6ad62a453a452989ec407fd0b6faa2e4d4c1ce16b34b62ac5718ee99e765da55
da49f23aec97f550123c2b9ae698652f306af95274d9719e5ca10945cdc478ec

login.metruyl.co Open in urlscan Pro 91.218.67.157 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

50 %HTTPS

33 %IPv6

3 Domains

4 Subdomains

7 IPs

4 Countries

33 kBTransfer

33 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

login.metruyl.co Open in urlscan Pro
91.218.67.157 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

7
IPs

4
Countries

33 kB
Transfer

33 kB
Size

1
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!