158924-apple.com Open in urlscan Pro
104.194.134.237 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://158924-apple.com/
Effective URL:
https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f7...
Submission Tags: @phishunt_io
Submission: On December 09 via api (December 9th 2024, 3:09:47 am UTC) from DE — Scanned from NL

Summary HTTP 6 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 104.194.134.237, located in Zaandam, Netherlands and belongs to ROUTERHOSTING, US. The main domain is 158924-apple.com.
TLS certificate: Issued by E5 on December 6th 2024. Valid for: 3 months.

This is the only time 158924-apple.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 4	104.194.134.237 104.194.134.237	14956 (ROUTERHOS...) (ROUTERHOSTING)
1	34.117.59.81 34.117.59.81	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2001:67c:4e8:... 2001:67c:4e8:f004::9	62041 (Telegram ...) (Telegram Telegram Messenger Inc)
6	4

4 104.194.134.237 (Zaandam, Netherlands) 1 redirects

ASN14956 (ROUTERHOSTING, US)
PTR: 237.134.194.104.static.cloudzy.com

158924-apple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com

ipinfo.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:67c:4e8:f004::9 (Amsterdam, Netherlands)

ASN62041 (Telegram Telegram Messenger Inc, VG)

api.telegram.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	158924-apple.com 1 redirects 158924-apple.com	3 MB
2	telegram.org api.telegram.org — Cisco Umbrella Rank: 47163	618 B
1	ipinfo.io ipinfo.io — Cisco Umbrella Rank: 7599	434 B
6	3

	Domain	Requested by
4	158924-apple.com	1 redirects 158924-apple.com
2	api.telegram.org	158924-apple.com
1	ipinfo.io	158924-apple.com
6	3

This site contains links to these domains. Also see Links.

Domain
www.apple.com

Subject Issuer	Validity	Valid
158924-apple.com E5	`2024-12-06` - `2025-03-06`	3 months	crt.sh
ipinfo.io R11	`2024-11-15` - `2025-02-13`	3 months	crt.sh
api.telegram.org Go Daddy Secure Certificate Authority - G2	`2024-03-24` - `2025-04-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e
Frame ID: 458280C445F91C5102149F5F453162A6
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

iCloud

Page URL History Show full URLs

http://158924-apple.com/ HTTP 307
https://158924-apple.com/ HTTP 302
https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oau... Page URL

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

2619 kB
Transfer

10107 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.apple.com/support/systemstatus/
Title: System Status

Search URL Search Domain Scan URL

URL: https://www.apple.com/legal/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.apple.com/legal/internet-services/icloud/
Title: Terms & Conditions

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://158924-apple.com/ HTTP 307
https://158924-apple.com/ HTTP 302
https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request signin Show response
158924-apple.com/
Redirect Chain

http://158924-apple.com/
https://158924-apple.com/
https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e

6 MB
3 MB

46ms
46ms

Document
text/html

104.194.134.237
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.194.134.237 Zaandam, Netherlands, ASN14956 (ROUTERHOSTING, US),
Reverse DNS: 237.134.194.104.static.cloudzy.com
Software: Apache/2.4.58 (Ubuntu) /
Resource Hash: a29d0ae263087365ae9034fe4fce375bb0880971fe03a7a7eeb98bdd993560c5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 09 Dec 2024 03:09:42 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache/2.4.58 (Ubuntu)
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Mon, 09 Dec 2024 03:09:42 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Location: /signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e
Pragma: no-cache
Server: Apache/2.4.58 (Ubuntu)

GET
DATA 200
OK truncated
/ 3 MB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 16f2e7c01400ae4a9bd4e5bf9ef641379791abc3fad1047beffd6cbf2546ee24

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/css

GET
DATA 200
OK truncated
/ 988 B
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 37bc0ee575f127443b0431d76250321864056e2895d833da2863ef0b6dd4c756

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/css

GET
DATA 200
OK truncated
/ 620 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a167d6a30d776e0ccd9c02d58323aaf30a8274d6e04c41127aec107349684cb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/css

GET
DATA 200
OK truncated
/ 759 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cead36e8a1b79612ef7d1a4cf924e5c5ca27c4a12d616517c54f06a703e3eaba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: text/css

GET
DATA 200
OK truncated
/ 16 KB
16 KB Font
font/ttf

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b28292cd7fb89caf6051ad0eb4e464c1ea4f83062842aa95cc697152a135d48

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://158924-apple.com
Referer

Response headers

Content-Type: font/ttf

GET
DATA 200
OK truncated
/ 661 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 446c4fde5ecf439bfed24e9704de915bdc7b0d06b4e8a6c5c7eb6493e06f4a37

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK heartbeat.js Show response
158924-apple.com/static/ 3 KB
1 KB 22ms
22ms Script
text/javascript 104.194.134.237
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://158924-apple.com/static/heartbeat.js
Requested by: Host: 158924-apple.com
URL: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.194.134.237 Zaandam, Netherlands, ASN14956 (ROUTERHOSTING, US),
Reverse DNS: 237.134.194.104.static.cloudzy.com
Software: Apache/2.4.58 (Ubuntu) /
Resource Hash: 4f8f85148f3a475a26fe7f3f8f72d1ca99ed2568e6928aafb246a49909805b8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e

Response headers

Content-Encoding: gzip
ETag: "ab8-6204dd3aa7c00-gzip"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 713
Keep-Alive: timeout=5, max=98
Date: Mon, 09 Dec 2024 03:09:43 GMT
Last-Modified: Thu, 22 Aug 2024 23:14:56 GMT
Vary: Accept-Encoding
Server: Apache/2.4.58 (Ubuntu)
Content-Type: text/javascript

GET
H/1.1 200
OK crawler.js Show response
158924-apple.com/static/ 2 KB
939 B 22ms
21ms Script
text/javascript 104.194.134.237
ROUTERHOSTING

General

Check archive.org

Show headers Download Go to

Full URL: https://158924-apple.com/static/crawler.js
Requested by: Host: 158924-apple.com
URL: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.194.134.237 Zaandam, Netherlands, ASN14956 (ROUTERHOSTING, US),
Reverse DNS: 237.134.194.104.static.cloudzy.com
Software: Apache/2.4.58 (Ubuntu) /
Resource Hash: cb57a6ebf07a1bb6fbe4bc88949f13026197d0e7525c58ce591132952aa13dc2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e

Response headers

Content-Encoding: gzip
ETag: "6e7-6204dd3aa7c00-gzip"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 597
Keep-Alive: timeout=5, max=97
Date: Mon, 09 Dec 2024 03:09:43 GMT
Last-Modified: Thu, 22 Aug 2024 23:14:56 GMT
Vary: Accept-Encoding
Server: Apache/2.4.58 (Ubuntu)
Content-Type: text/javascript

GET
H2 200 json Show response
ipinfo.io/ 225 B
434 B 153ms
115ms Fetch
application/json 34.117.59.81
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipinfo.io/json?token=3a4c86b7116b38

Requested by

Host: 158924-apple.com
URL: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

81.59.117.34.bc.googleusercontent.com

Software

Resource Hash

b87d3d179c1349b47f560d84cf72ca36925161164dfef36642819e6d02ebf542

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://158924-apple.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
content-encoding: br
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 151
date: Mon, 09 Dec 2024 03:09:43 GMT
x-xss-protection: 1; mode=block
content-type: application/json; charset=utf-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

POST
H2 200 sendMessage Show response
api.telegram.org/bot7895273398:AAH21yAHFQt8gdaVnhfT95RkGolN-AzkPbA/ 372 B
618 B 146ms
145ms Fetch
application/json 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.telegram.org/bot7895273398:AAH21yAHFQt8gdaVnhfT95RkGolN-AzkPbA/sendMessage

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

bd4fbf74c9ab808b89bd96a603441137dd8b99cb98bc810a25aa04de296d3dec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://158924-apple.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
content-length: 372
date: Mon, 09 Dec 2024 03:09:43 GMT
content-type: application/json
server: nginx/1.18.0

OPTIONS
H2 204 sendMessage
api.telegram.org/bot7895273398:AAH21yAHFQt8gdaVnhfT95RkGolN-AzkPbA/ 0
0 69ms
19ms Preflight 2001:67c:4e8:f004::9
Telegram Telegram...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.telegram.org/bot7895273398:AAH21yAHFQt8gdaVnhfT95RkGolN-AzkPbA/sendMessage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://158924-apple.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Type,Date,Server,Connection
access-control-max-age: 86400
date: Mon, 09 Dec 2024 03:09:43 GMT
server: nginx/1.18.0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			158924-apple.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: oubemh3p558l7it432mucfji8n

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://158924-apple.com/signin?client_id=67565f768b796-67565f768b798-67565f768b799-67565f768b79a&oauth_challenge=67565f768b79b-67565f768b79c-67565f768b79d-67565f768b79e Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

158924-apple.com
api.telegram.org
ipinfo.io
104.194.134.237
2001:67c:4e8:f004::9
34.117.59.81
16f2e7c01400ae4a9bd4e5bf9ef641379791abc3fad1047beffd6cbf2546ee24
37bc0ee575f127443b0431d76250321864056e2895d833da2863ef0b6dd4c756
446c4fde5ecf439bfed24e9704de915bdc7b0d06b4e8a6c5c7eb6493e06f4a37
4f8f85148f3a475a26fe7f3f8f72d1ca99ed2568e6928aafb246a49909805b8c
7b28292cd7fb89caf6051ad0eb4e464c1ea4f83062842aa95cc697152a135d48
a167d6a30d776e0ccd9c02d58323aaf30a8274d6e04c41127aec107349684cb8
a29d0ae263087365ae9034fe4fce375bb0880971fe03a7a7eeb98bdd993560c5
b87d3d179c1349b47f560d84cf72ca36925161164dfef36642819e6d02ebf542
bd4fbf74c9ab808b89bd96a603441137dd8b99cb98bc810a25aa04de296d3dec
cb57a6ebf07a1bb6fbe4bc88949f13026197d0e7525c58ce591132952aa13dc2
cead36e8a1b79612ef7d1a4cf924e5c5ca27c4a12d616517c54f06a703e3eaba

158924-apple.com Open in urlscan Pro 104.194.134.237 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

2619 kBTransfer

10107 kBSize

1 Cookies

3 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

158924-apple.com Open in urlscan Pro
104.194.134.237 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

2619 kB
Transfer

10107 kB
Size

1
Cookies

6 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!