keraasuinm.cf
Open in
urlscan Pro
45.58.115.42
Malicious Activity!
Public Scan
URL:
http://keraasuinm.cf/ba-cat/mail.diba.cat/owa/auth/logonc3eb.html
Submission: On June 23 via automatic, source openphish
Submission: On June 23 via automatic, source openphish
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 2 HTTP transactions.
The main IP is 45.58.115.42, located in
United States and
belongs to RELIABLESITE, US.
The main domain is keraasuinm.cf.
This is the only time keraasuinm.cf was scanned on urlscan.io!
This is the only time keraasuinm.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 45.58.115.42 45.58.115.42 | 23470 (RELIABLESITE) (RELIABLESITE) | |
| 2 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 1 |
keraasuinm.cf
keraasuinm.cf |
69 KB |
| 0 |
diba.cat
Failed
mail.diba.cat Failed |
|
| 2 | 2 |
| Domain | Requested by | |
|---|---|---|
| 1 | keraasuinm.cf | |
| 0 | mail.diba.cat Failed |
keraasuinm.cf
|
| 2 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://keraasuinm.cf/ba-cat/mail.diba.cat/owa/auth/logonc3eb.html
Frame ID: 7DB18493E9FCCDA277C334451F63203F
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
logonc3eb.html
keraasuinm.cf/ba-cat/mail.diba.cat/owa/auth/ |
69 KB 69 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
12 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
segoeui-regular.ttf
mail.diba.cat/owa/auth/15.1.2176/themes/resources/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mail.diba.cat
- URL
- https://mail.diba.cat/owa/auth/15.1.2176/themes/resources/segoeui-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)37 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| keraasuinm.cf/ba-cat/mail.diba.cat/owa/auth | Name: cookieTest Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
keraasuinm.cf
mail.diba.cat
mail.diba.cat
45.58.115.42
3164743fdad4e8d4dff0a949af6130101ce7c5561f749dba3f083531864eb09c
3c4454f1cdf33e80810d2698af2261d35705374be030ac8ba7dd4f3c5154e919
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
ce94073c72b250462a106214d2a793fb65418263830574176306ced0e76f6b27
f273daeec6cf88dda6adeb09ad8f2c5eca8796735f68e1d2d9d45bb83ebd9b82