urlscan.io logo urlscan.io
SecurityTrails logo

sv.com.my Open in urlscan Pro
110.4.42.53  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.aptracking1.com/b?action=click&controller=redirector&y=49ii4eh26op3gp9mcoo3icb1chi3iohg61gjap32chj30cp25gh748hq4...
Effective URL: https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
Submission: On May 28 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 110.4.42.53, located in Malaysia and belongs to EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY. The main domain is sv.com.my.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 15th 2021. Valid for: a year.
This is the only time sv.com.my was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 34.102.184.244 396982 (GOOGLE-CL...)
5 110.4.42.53 46015 (EXABYTES-...)
5 1
Apex Domain
Subdomains		 Transfer
5 sv.com.my
sv.com.my
474 KB
1 aptracking1.com
www.aptracking1.com — Cisco Umbrella Rank: 117520
581 B
5 2
Domain Requested by
5 sv.com.my sv.com.my
1 www.aptracking1.com 1 redirects
5 2

This site contains no links.

Subject Issuer Validity Valid
*.sv.com.my
Sectigo RSA Domain Validation Secure Server CA		 2021-06-15 -
2022-07-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
Frame ID: 98EA14732E21EEED25FFE426EC1E4A46
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Office 365 - Login

Page URL History Show full URLs

  1. https://www.aptracking1.com/b?action=click&controller=redirector&y=49ii4eh26op3gp9mcoo3icb1chi3iohg61gja... HTTP 302
    https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

474 kB
Transfer

473 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.aptracking1.com/b?action=click&controller=redirector&y=49ii4eh26op3gp9mcoo3icb1chi3iohg61gjap32chj30cp25gh748hq49k78t3gect2ubrjeon66rrd5pmnibraedpiutjfd5hmabrmdtkm6pbdc5kmobqfdpim8sj9epiiur3fctkmscpm6kn70q3g48====== HTTP 302
    https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login365.php
sv.com.my/jss/voice/voicemail/Onedrive/
Redirect Chain
  • https://www.aptracking1.com/b?action=click&controller=redirector&y=49ii4eh26op3gp9mcoo3icb1chi3iohg61gjap32chj30cp25gh748hq49k78t3gect2ubrjeon66rrd5pmnibraedpiutjfd5hmabrmdtkm6pbdc5kmobqfdpim8sj9ep...
  • https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
4 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
110.4.42.53 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS
server.sv.com.my
Software
Apache / PHP/5.3.29
Resource Hash
efb1a257b5e7c75e776411ffd66916effbaf9c606785f128d90dfcb4d5780b68

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Type
text/html
Date
Sat, 28 May 2022 03:47:07 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
X-Powered-By
PHP/5.3.29

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache
content-type
text/html; charset=utf-8
date
Sat, 28 May 2022 03:47:06 GMT
location
https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
server
nginx
status
302 Found
vary
Origin
via
1.1 google
x-frame-options
ALLOWALL
ms-style.css
sv.com.my/jss/voice/voicemail/Onedrive/scripts/ 		6 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sv.com.my/jss/voice/voicemail/Onedrive/scripts/ms-style.css
Requested by
Host: sv.com.my
URL: https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
110.4.42.53 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS
server.sv.com.my
Software
Apache /
Resource Hash
3256768e42e527cb594d0a757745ccdea42d3d0300ec6fc49395f1d98d904b97

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Sat, 28 May 2022 03:47:08 GMT
Last-Modified
Fri, 29 Jan 2021 15:38:18 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
6503
jquery-2.1.1.min.js
sv.com.my/jss/voice/voicemail/Onedrive/scripts/ 		82 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sv.com.my/jss/voice/voicemail/Onedrive/scripts/jquery-2.1.1.min.js
Requested by
Host: sv.com.my
URL: https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
110.4.42.53 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS
server.sv.com.my
Software
Apache /
Resource Hash
977a50ccb37743ee62109dad2962ab081102dd82116ef5959e1624c867b68ba6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Sat, 28 May 2022 03:47:08 GMT
Last-Modified
Fri, 29 Jan 2021 15:38:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
84246
365.png
sv.com.my/jss/voice/voicemail/Onedrive/assets/ 		103 KB
104 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sv.com.my/jss/voice/voicemail/Onedrive/assets/365.png
Requested by
Host: sv.com.my
URL: https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
110.4.42.53 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS
server.sv.com.my
Software
Apache /
Resource Hash
25b8546754839549f4603e78cb3ea78ac48dddd72ce5737b29eb1c126f81fa46

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sv.com.my/jss/voice/voicemail/Onedrive/login365.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Sat, 28 May 2022 03:47:08 GMT
Last-Modified
Fri, 29 Jan 2021 15:38:22 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
105863
ms-bg.jpg
sv.com.my/jss/voice/voicemail/Onedrive/assets/ 		277 KB
277 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sv.com.my/jss/voice/voicemail/Onedrive/assets/ms-bg.jpg
Requested by
Host: sv.com.my
URL: https://sv.com.my/jss/voice/voicemail/Onedrive/scripts/ms-style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
110.4.42.53 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS
server.sv.com.my
Software
Apache /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sv.com.my/jss/voice/voicemail/Onedrive/scripts/ms-style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Sat, 28 May 2022 03:47:08 GMT
Last-Modified
Fri, 29 Jan 2021 15:38:22 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
283351

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery function| isValidEmailAddress

3 Cookies

Domain/Path Name / Value
www.aptracking1.com/ Name: X-CSRF-TOKEN
Value: vRd%2FgvYBHwwj7c%2B%2FVLUoKSMDja1RuU8Fts%2FV6dbm0PVdGAZq4h7cE1n%2BHii2PmCdG7pgecuvpvi%2B%2BKHkmDMGHw%3D%3D
www.aptracking1.com/ Name: _leadgenie_session
Value: QTczcVVlZ0ErS05aRzlrNDdudFpRckplK05ZTWhwSGlVSTQ4WmFOdmI3WDBTU0NEQ0w4cTNDQTM4WXMydDVReVlvNDZlaXJiWlZST2k4U0o2SlJGc1p4TXFFQnlXVEJQYVFsSnViRW5wMHdGcHgzZ0lFWHluN1A5OXAyMnJFZTk2QWNTKzlDY2RmMW9US3lIVllPSFB3PT0tLWYwbVNrUHZQU3JnRUd4R1VGaDRtelE9PQ%3D%3D--9b7fb38629742ed93588af6bdd52a035f3b25ab4
sv.com.my/ Name: PHPSESSID
Value: co55isglcglf9hn05p5j5ve9q4