epistasy.sa.com - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 104.21.51.225, located in and belongs to CLOUDFLARENET, US. The main domain is epistasy.sa.com.
TLS certificate: Issued by GTS CA 1P5 on February 19th 2023. Valid for: 3 months.

This is the only time epistasy.sa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
5	104.21.51.225 104.21.51.225	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	199.36.158.100 199.36.158.100	54113 (FASTLY) (FASTLY)
6	2

5 104.21.51.225 (None, )

ASN13335 (CLOUDFLARENET, US)

epistasy.sa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.36.158.100 (United States)

ASN54113 (FASTLY, US)

smtp1-edbef.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	sa.com epistasy.sa.com	111 KB
1	firebaseapp.com smtp1-edbef.firebaseapp.com	754 B
6	2

	Domain	Requested by
5	epistasy.sa.com	epistasy.sa.com
1	smtp1-edbef.firebaseapp.com	epistasy.sa.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
*.epistasy.sa.com GTS CA 1P5	`2023-02-19` - `2023-05-20`	3 months	crt.sh
firebaseapp.com GTS CA 1D4	`2022-12-20` - `2023-03-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://epistasy.sa.com/OB/
Frame ID: 4FEEC8B9ABD424885B1E78EE996490FE
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authentification

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

112 kB
Transfer

117 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
epistasy.sa.com/OB/ 6 KB
3 KB 1771ms
665ms Document
text/html 104.21.51.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://epistasy.sa.com/OB/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.225 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13932f88589d81bd36e281c1a4248b428a2a2740627199ce0a411ea96cc20826

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 79d165a10cb60b93-NRT
content-encoding: br
content-type: text/html
date: Tue, 21 Feb 2023 18:03:08 GMT
last-modified: Mon, 05 Dec 2022 19:49:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8EeTf1JWoADI0R6UxftaRHrZUgp7Lg133ySs2YRwfhkX%2FbNjzr%2Fmb1WVDzfy%2FueIQ3%2FQxYYF409mAtp9eJ8OC4aJ2yBOwqTphRBAYoCITi3Y6KKynXn7jYHjicr1fiL6SxY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 smtp.js Show response
smtp1-edbef.firebaseapp.com/ 871 B
754 B 647ms
71ms Script
text/javascript 199.36.158.100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://smtp1-edbef.firebaseapp.com/smtp.js

Requested by

Host: epistasy.sa.com
URL: https://epistasy.sa.com/OB/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

199.36.158.100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://epistasy.sa.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

x-served-by: cache-itm18844-ITM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 21 Feb 2023 18:03:09 GMT
last-modified: Thu, 12 Mar 2020 20:21:20 GMT
x-timer: S1677002589.452519,VS0,VE1
etag: "a6843aa02244acd5da02e62d6a4226e4e98cb4970964d8419ce5db8882852b40-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 387
x-cache-hits: 1

GET
H2 200 styles.css
epistasy.sa.com/OB/css/ 5 KB
1 KB 535ms
533ms Stylesheet
text/css 104.21.51.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://epistasy.sa.com/OB/css/styles.css
Requested by: Host: epistasy.sa.com
URL: https://epistasy.sa.com/OB/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.225 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ca79c05b41c5b56a993a8358fc2002d46f48676e5ecf8b643496c49421d1a9a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://epistasy.sa.com/OB/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 18:03:09 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 24 Feb 2021 15:26:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bQmsOryI3SmldVl4twagMfU7UESlx%2BB961b4u7610Q8L5fIZGC5F1H3ccRypbuoyWiPQiSkiEWbZBvVJtacDuVUlWoasryCoXtDWcsgKEV9o61EER6fUW8FgU7nxbHd2KKQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 79d165a54d6f0b93-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 logo.png
epistasy.sa.com/OB/img/ 3 KB
4 KB 423ms
423ms Image
image/png 104.21.51.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epistasy.sa.com/OB/img/logo.png
Requested by: Host: epistasy.sa.com
URL: https://epistasy.sa.com/OB/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.225 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://epistasy.sa.com/OB/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 18:03:09 GMT
cf-cache-status: MISS
last-modified: Wed, 24 Feb 2021 15:27:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UvI88RmPuCMrHT4VLYx%2BPSGKxOW%2FxvQcBTzFt%2BVlpZeJFkHEqyGpcdIx5FlWtOfxfpiCRkn9Pd7FjY3fdzkXDQttuwxEF%2BMvIlAVwasP57eHuKkw06gC4uy8p1G%2FtdBfYqo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 79d165a7ede40b93-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3354

GET
H2 200 sidebar.png
epistasy.sa.com/OB/img/ 29 KB
29 KB 604ms
603ms Image
image/png 104.21.51.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epistasy.sa.com/OB/img/sidebar.png
Requested by: Host: epistasy.sa.com
URL: https://epistasy.sa.com/OB/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.225 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://epistasy.sa.com/OB/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 18:03:10 GMT
cf-cache-status: MISS
last-modified: Wed, 24 Feb 2021 16:09:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5l3zFKRxP43m11BI2RPqQgmbqaxnGH422ApkNIxQ6l6MsKDDjVOukfHbUgHUGZ7DYAb9nRGhVS9Szb9elYzfa847ZJBKeYLqIGkDH2G4%2FmAGyB5H1Qy%2F88l9VsAhN5XIy%2B4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 79d165a8ae0d0b93-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 29367

GET
H2 200 footer.png
epistasy.sa.com/OB/img/ 74 KB
75 KB 945ms
944ms Image
image/png 104.21.51.225
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://epistasy.sa.com/OB/img/footer.png
Requested by: Host: epistasy.sa.com
URL: https://epistasy.sa.com/OB/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.51.225 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6c90b7db38e12494f591eaec3dd476e50e3217026732d9918952e747d80850f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://epistasy.sa.com/OB/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Tue, 21 Feb 2023 18:03:10 GMT
cf-cache-status: MISS
last-modified: Wed, 24 Feb 2021 16:09:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7P6kAp9vmdpA%2BtaXpooUvoHHY36SWLUL9fX39s%2FueTFUcagwQUf3WgPBsLk%2B%2BalledmT0uQFFdNDRZqUD8tD7Q3UMvDMpY8cHEqQaVm7TbDygx94%2BWFAupSQB22E2Fh2KKk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 79d165a8ae0e0b93-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 75937

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange object| Email function| sendMail

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

epistasy.sa.com
smtp1-edbef.firebaseapp.com
104.21.51.225
199.36.158.100
13932f88589d81bd36e281c1a4248b428a2a2740627199ce0a411ea96cc20826
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
5ca79c05b41c5b56a993a8358fc2002d46f48676e5ecf8b643496c49421d1a9a
8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997
b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472
f6c90b7db38e12494f591eaec3dd476e50e3217026732d9918952e747d80850f

epistasy.sa.com Open in urlscan Pro 104.21.51.225 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

112 kBTransfer

117 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

epistasy.sa.com Open in urlscan Pro
104.21.51.225 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

112 kB
Transfer

117 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!