![](/screenshots/00b27385-4374-44f2-8241-8f1f19efa9aa.png)
nesid.sarer.pw
Open in
urlscan Pro
52.10.80.234
Malicious Activity!
Public Scan
Submission: On April 09 via manual from US
Summary
This is the only time nesid.sarer.pw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fake Flash UpdateDownloads These files were downloaded by the website
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 52.10.80.234 52.10.80.234 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 54.187.52.108 54.187.52.108 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 1 | 35.166.50.152 35.166.50.152 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 35.162.1.179 35.162.1.179 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
9 | 3 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-10-80-234.us-west-2.compute.amazonaws.com
nesid.sarer.pw |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-187-52-108.us-west-2.compute.amazonaws.com
nesid.sarer.pw |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-166-50-152.us-west-2.compute.amazonaws.com
www.sarer.pw |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-162-1-179.us-west-2.compute.amazonaws.com
www.abanor.space |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
sarer.pw
1 redirects
nesid.sarer.pw www.sarer.pw |
74 KB |
1 |
abanor.space
www.abanor.space |
|
9 | 2 |
Domain | Requested by | |
---|---|---|
8 | nesid.sarer.pw |
nesid.sarer.pw
|
1 | www.abanor.space |
nesid.sarer.pw
|
1 | www.sarer.pw | 1 redirects |
9 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sarer.pw |
Subject Issuer | Validity | Valid |
---|
This page contains 2 frames:
Primary Page:
http://nesid.sarer.pw/AwFeocZbnQ7LO2VK6evWEQ0x25dP5kIY_mxaMrjfkIWKpw3mYrxmEs1itbdqkBd6AWPIkL7B6KMT8iND_RDNJMcQcd0F8m1XpLOi0el7uIXbow==?n3er=lLbOxA==&id=2714222&cid=PL-u-tvT*gw&uu=lIaJhrzOpHZ6hXl9eHyOeXV3g3k=
Frame ID: D0C47CB0B5E44E2D809FC28FC8C79C2C
Requests: 8 HTTP requests in this frame
Frame:
http://www.abanor.space/get/files?com=dbf78f7a-5173-42f9-a46a-5000cf97df1d&=&f=Player&cifd=PL-u-tvT*gw
Frame ID: 3D5036578C6F254E7C3CFD5D9E7A3427
Requests: 1 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Install Now
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- http://www.sarer.pw/AwGk-uKDFXZcBvNLquZadgk74P-L7s7zoTxAOr4r1kqIIx5HTsEd2TNRkHe6M681cqJa2q2mQA9fPnYiTYvOdTcAnEv67bU3kjMc3ym01Al9pw==?cid=PL-u-tvT*gw&f=Player&pvhid=6658f1b2-af7a-4f94-8c59-2cd3b50d7815&n3er=1NaS5A== HTTP 302
- http://www.abanor.space/get/files?com=dbf78f7a-5173-42f9-a46a-5000cf97df1d&=&f=Player&cifd=PL-u-tvT*gw
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
AwFeocZbnQ7LO2VK6evWEQ0x25dP5kIY_mxaMrjfkIWKpw3mYrxmEs1itbdqkBd6AWPIkL7B6KMT8iND_RDNJMcQcd0F8m1XpLOi0el7uIXbow==
nesid.sarer.pw/ |
46 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Site.css
nesid.sarer.pw/css/ |
0 162 B |
Stylesheet
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
macpopup_icon.png
nesid.sarer.pw/html_resources/page/hash/31e771c798b4/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0bba8664-6753-4725-b699-368a077f90c5
nesid.sarer.pw/html_resources/page/hash/31e771c798b4/img/ |
18 KB 18 KB |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b5d49db1-3aa2-4f6f-91e8-c20da7a0e870
nesid.sarer.pw/html_resources/page/hash/31e771c798b4/img/ |
2 KB 2 KB |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chrome_helper.gif
nesid.sarer.pw/html_resources/page/hash/31e771c798b4/img/ |
12 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
safari_helper.gif
nesid.sarer.pw/html_resources/page/hash/31e771c798b4/img/ |
12 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firefox_helper.gif
nesid.sarer.pw/html_resources/page/hash/31e771c798b4/img/ |
12 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
files
www.abanor.space/get/ Frame 3D50 Redirect Chain
|
0 0 |
Document
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fake Flash Update9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| hideEl function| showEl function| hidemodal function| fadeIn function| popup number| popupReady0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nesid.sarer.pw
www.abanor.space
www.sarer.pw
35.162.1.179
35.166.50.152
52.10.80.234
54.187.52.108
29cbb613fe08616b27e4e387ca6e128ee669c49ba0f8255876252b9ede4fb6e2
3512c0ef06746b560a0b4cca60e574f329c23b444e16b791366ae2e8794e8be0
5626459d53155a430920da0837319decdf15563518521f5a1e36bbe17460447a
7de9bf65af75b7d903ab55eee4d2be436e594b5f4a6292633e648b7a3c66563b
aed2d4348180f74b6f177c26ff8236bcc9bbdae74188915cc6041dd6be8cadc5
da1d9e0ae80ec0b4bfe25a802d202e43ce40de47c4a8c2766bca26345b2bb547
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f8c160703de84169dc013f17d77d5725b658e1b6a955ec826fbc0acc38787663