lmokjh.investmentinfoline.com
Open in
urlscan Pro
87.121.221.36
Malicious Activity!
Public Scan
Submitted URL: https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fobrutos.ru.com/%2FTFGH%2Fmamad...
Effective URL: https://lmokjh.investmentinfoline.com/?username=mamadou.tandian@swisslife-am.com
Submission: On May 31 via manual from CH — Scanned from DE
Effective URL: https://lmokjh.investmentinfoline.com/?username=mamadou.tandian@swisslife-am.com
Submission: On May 31 via manual from CH — Scanned from DE
Summary
This website contacted 3 IPs
in 1 countries
across 3 domains to perform 3 HTTP transactions.
The main IP is 87.121.221.36, located in
Reston, United States and
belongs to AS_DELIS, US.
The main domain is lmokjh.investmentinfoline.com.
TLS certificate: Issued by R3 on May 30th 2023. Valid for: 3 months.
This is the only time lmokjh.investmentinfoline.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 30th 2023. Valid for: 3 months.
This is the only time lmokjh.investmentinfoline.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 2600:9000:206... 2600:9000:206f:8a00:4:b4b9:d3c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 69.49.246.252 69.49.246.252 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
| 2 | 87.121.221.36 87.121.221.36 | 211252 (AS_DELIS) (AS_DELIS) | |
| 3 | 3 |
1
69.49.246.252
(United States)
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-246-252.webhostbox.net
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-246-252.webhostbox.net
| obrutos.ru.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
investmentinfoline.com
lmokjh.investmentinfoline.com |
164 KB |
| 1 |
ru.com
obrutos.ru.com |
298 B |
| 1 |
substackcdn.com
1 redirects
substackcdn.com — Cisco Umbrella Rank: 17902 |
308 B |
| 3 | 3 |
| Domain | Requested by | |
|---|---|---|
| 2 | lmokjh.investmentinfoline.com |
lmokjh.investmentinfoline.com
|
| 1 | obrutos.ru.com | |
| 1 | substackcdn.com | 1 redirects |
| 3 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| obrutos.ru.com R3 |
2023-05-27 - 2023-08-25 |
3 months | crt.sh |
| investmentinfoline.com R3 |
2023-05-30 - 2023-08-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lmokjh.investmentinfoline.com/?username=mamadou.tandian@swisslife-am.com
Frame ID: 1C08B8BBAE26365D06D9C2EBD8AE7635
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://substackcdn.com/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fobrutos.ru.com/%2FTFGH%2Fmamadou.tandian%2FbWFtYWRvdS50YW5kaWFuQHN3aXNzbGlmZS1hbS5jb20= HTTP 302
- https://obrutos.ru.com//TFGH/mamadou.tandian/bWFtYWRvdS50YW5kaWFuQHN3aXNzbGlmZS1hbS5jb20=
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
bWFtYWRvdS50YW5kaWFuQHN3aXNzbGlmZS1hbS5jb20=
obrutos.ru.com//TFGH/mamadou.tandian/ Redirect Chain
|
0 298 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
lmokjh.investmentinfoline.com/ |
416 KB 164 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
858 B 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
40 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H2 |
/
lmokjh.investmentinfoline.com/ |
209 B 348 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| a0_0x519b function| a0_0x2f1f function| setCookie function| onCheckBoxChange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
lmokjh.investmentinfoline.com
obrutos.ru.com
substackcdn.com
2600:9000:206f:8a00:4:b4b9:d3c0:93a1
69.49.246.252
87.121.221.36
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
53e8afdd9f5e2335d5872bff7dcdcb35b121812b1156cc4fe92491e994600b8c
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
8b123c77d836e4efbbd5602a288571555406f84a8e51801396eb7732ff541499
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855