agrorym.com Open in urlscan Pro
144.217.158.133  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request zSI9xSN3Ob0jM7dbxr4dBCQ5zD0fwTVfB70gO8A5B75eR7QCIqYpI7sdDEsMwDQCEqEIIaUhAEN8znRbNW9n Show response agrorym.com/assets/	286 KB 286 KB	75ms 20ms	Document text/html	144.217.158.133 OVH
General Check archive.org Show headers Download Go to Full URL https://agrorym.com/assets/zSI9xSN3Ob0jM7dbxr4dBCQ5zD0fwTVfB70gO8A5B75eR7QCIqYpI7sdDEsMwDQCEqEIIaUhAEN8znRbNW9n Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 144.217.158.133 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS r3.a1center.net Software Apache / Resource Hash 8f85b88f78c2fc71feb7c877eae2093c796c0f2e30ec94af138ce8bbd04a41f5 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 292737 Content-Type text/html Date Wed, 11 Sep 2024 07:00:52 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 20 Aug 2024 23:29:34 GMT Server Apache
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	108ms 27ms	Image image/svg+xml	2606:2800:11f:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: agrorym.com URL: https://agrorym.com/assets/zSI9xSN3Ob0jM7dbxr4dBCQ5zD0fwTVfB70gO8A5B75eR7QCIqYpI7sdDEsMwDQCEqEIIaUhAEN8znRbNW9n Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (nyd/D104) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer https://agrorym.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 11 Sep 2024 07:00:52 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 14674715 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (nyd/D104) etag 0x8D79A1B9F5E121A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 6a92840e-701e-00d0-12a1-7e6e40000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	404 Not Found	favicon.ico agrorym.com/	1 KB 2 KB	557ms 554ms	Other text/html	144.217.158.133 OVH
General Check archive.org Show headers Download Go to Full URL https://agrorym.com/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 144.217.158.133 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS r3.a1center.net Software Apache / PHP/7.1.33 Resource Hash 2b67da14e2725a72a8cccb22bb4913bcfca77c3f68caa39b912bf2567990cd94 Request headers Referer https://agrorym.com/assets/zSI9xSN3Ob0jM7dbxr4dBCQ5zD0fwTVfB70gO8A5B75eR7QCIqYpI7sdDEsMwDQCEqEIIaUhAEN8znRbNW9n User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Date Wed, 11 Sep 2024 07:00:53 GMT Server Apache X-Powered-By PHP/7.1.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, private Connection Keep-Alive Keep-Alive timeout=5, max=99

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x228b object| BOOKS function| _0x2ecc function| _0x150ffa function| _0x348cd9 function| _0x1d1ef5 function| _0x5165ea function| generateCaptcha function| customDecode function| getIconSVG function| _0x85374f function| lightenColor function| checkColor function| dAndR function| startCountdown function| _0x39e1e3 function| _0x1cb853 function| _0x8d8ab5 function| _0x2dc29c function| _0x1acca0 function| _0x54a934 function| _0x3da7 function| _0x464cf8 function| _0x1008 function| _0x5d72bc function| _0xaadf01 function| checkers function| _0x48596a function| redirectToshop function| _0x33ee23 function| _0x4a8d38

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://agrorym.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
agrorym.com
144.217.158.133
2606:2800:11f:1cb7:261b:1f9c:2074:3c
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
2b67da14e2725a72a8cccb22bb4913bcfca77c3f68caa39b912bf2567990cd94
8f85b88f78c2fc71feb7c877eae2093c796c0f2e30ec94af138ce8bbd04a41f5