![](/screenshots/05fe1cf1-04e9-4416-a342-79ad40c51ca9.png)
0.destinyinredsocks.com
Open in
urlscan Pro
185.177.94.152
Malicious Activity!
Public Scan
Effective URL: https://0.destinyinredsocks.com/index.php?p=mvstimztmy5doobvha&sub1=spokle&sub2=backback2
Submission: On June 14 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 13th 2022. Valid for: 3 months.
This is the only time 0.destinyinredsocks.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 192.185.33.203 192.185.33.203 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 3 | 101.99.95.147 101.99.95.147 | 201133 (VERDINA) (VERDINA) | |
1 | 152.199.23.72 152.199.23.72 | 15133 (EDGECAST) (EDGECAST) | |
2 | 185.177.94.152 185.177.94.152 | 39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS) | |
15 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: mail.thinkbituae.com
religie.ordevansintjacob.org |
ASN201133 (VERDINA, BZ)
PTR: vps.euromeds.to
track.greengoplatform.com | |
front.greengoplatform.com |
ASN39572 (ADVANCEDHOSTERS-AS, NL)
PTR: ip-185-177-94-152.ah-server.com
destinyinredsocks.com | |
0.destinyinredsocks.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
ordevansintjacob.org
religie.ordevansintjacob.org |
40 KB |
3 |
greengoplatform.com
1 redirects
track.greengoplatform.com — Cisco Umbrella Rank: 317295 front.greengoplatform.com — Cisco Umbrella Rank: 311510 Failed |
2 KB |
2 |
destinyinredsocks.com
destinyinredsocks.com — Cisco Umbrella Rank: 357957 Failed 0.destinyinredsocks.com — Cisco Umbrella Rank: 992132 |
104 KB |
1 |
msauthimages.net
aadcdn.msauthimages.net — Cisco Umbrella Rank: 4755 |
10 KB |
15 | 4 |
Domain | Requested by | |
---|---|---|
8 | religie.ordevansintjacob.org |
religie.ordevansintjacob.org
|
2 | front.greengoplatform.com |
religie.ordevansintjacob.org
|
1 | 0.destinyinredsocks.com |
religie.ordevansintjacob.org
|
1 | destinyinredsocks.com |
front.greengoplatform.com
|
1 | aadcdn.msauthimages.net |
religie.ordevansintjacob.org
|
1 | track.greengoplatform.com |
religie.ordevansintjacob.org
|
15 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
transportgoline.com R3 |
2022-06-05 - 2022-09-03 |
3 months | crt.sh |
aadcdn.msauthimages.net Microsoft Azure TLS Issuing CA 02 |
2022-05-11 - 2023-05-06 |
a year | crt.sh |
front.greengoplatform.com R3 |
2022-06-05 - 2022-09-03 |
3 months | crt.sh |
destinyinbluesocks.com R3 |
2022-06-13 - 2022-09-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://0.destinyinredsocks.com/index.php?p=mvstimztmy5doobvha&sub1=spokle&sub2=backback2
Frame ID: AAB89F39172F86F632802112F7B8B439
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/05fe1cf1-04e9-4416-a342-79ad40c51ca9.png)
Page Title
## Bitte tippen Sie auf die Schaltfläche Zulassen, um fortzufahren ##Page URL History Show full URLs
- http://religie.ordevansintjacob.org/TO/support@hdfcbank.com Page URL
-
https://front.greengoplatform.com/go.php?lid=3337&pid=9646&cid=114733
HTTP 302
https://front.greengoplatform.com/go.php?sid=6856&pid=9954&cid=347853 Page URL
- https://destinyinredsocks.com/go/mvstimztmy5doobvha?sub1=spokle&sub2=backback2 Page URL
- https://0.destinyinredsocks.com/index.php?p=mvstimztmy5doobvha&sub1=spokle&sub2=backback2 Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://religie.ordevansintjacob.org/TO/support@hdfcbank.com Page URL
-
https://front.greengoplatform.com/go.php?lid=3337&pid=9646&cid=114733
HTTP 302
https://front.greengoplatform.com/go.php?sid=6856&pid=9954&cid=347853 Page URL
- https://destinyinredsocks.com/go/mvstimztmy5doobvha?sub1=spokle&sub2=backback2 Page URL
- https://0.destinyinredsocks.com/index.php?p=mvstimztmy5doobvha&sub1=spokle&sub2=backback2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- https://front.greengoplatform.com/go.php?lid=3337&pid=9646&cid=114733 HTTP 302
- https://front.greengoplatform.com/go.php?sid=6856&pid=9954&cid=347853
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
support@hdfcbank.com
religie.ordevansintjacob.org/TO/ |
13 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
smile.js
track.greengoplatform.com/ |
4 KB 1016 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
religie.ordevansintjacob.org/TO/css/ |
94 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bannerlogo
aadcdn.msauthimages.net/447973e2-fxnqcqsuofetdky8dryvtojl88m2enkxxsa0ndks7fq/logintenantbranding/0/ |
9 KB 10 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow_left.svg
religie.ordevansintjacob.org/TO/images/ |
513 B 758 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
enterpass.png
religie.ordevansintjacob.org/TO/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firstmsg1.png
religie.ordevansintjacob.org/TO/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
forgpass.png
religie.ordevansintjacob.org/TO/images/ |
713 B 980 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ellipsis_white.svg
religie.ordevansintjacob.org/TO/images/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ellipsis_grey.svg
religie.ordevansintjacob.org/TO/images/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
go.php
front.greengoplatform.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
go.php
front.greengoplatform.com/ Redirect Chain
|
858 B 618 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
mvstimztmy5doobvha
destinyinredsocks.com/go/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mvstimztmy5doobvha
destinyinredsocks.com/go/ |
52 KB 52 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.php
0.destinyinredsocks.com/ |
52 KB 52 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
378 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
377 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- front.greengoplatform.com
- URL
- https://front.greengoplatform.com/go.php?lid=3337&pid=9646&cid=114733
- Domain
- destinyinredsocks.com
- URL
- https://destinyinredsocks.com/go/mvstimztmy5doobvha?sub1=spokle&sub2=backback2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| languages undefined| text string| relevanteLang string| lang function| urlB64ToUint8Array function| j4ee function| L0zz boolean| j string| title string| holder function| before_redirect_block2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.destinyinredsocks.com/ | Name: uuid Value: 75a5fcf3-87db-47c5-ab2d-4aab64d20ebe |
|
.0.destinyinredsocks.com/ | Name: uuid Value: 75a5fcf3-87db-47c5-ab2d-4aab64d20ebe |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0.destinyinredsocks.com
aadcdn.msauthimages.net
destinyinredsocks.com
front.greengoplatform.com
religie.ordevansintjacob.org
track.greengoplatform.com
destinyinredsocks.com
front.greengoplatform.com
101.99.95.147
152.199.23.72
185.177.94.152
192.185.33.203
0130163212abbde4e4e8705562ed961420e87058e7a7e3383b54a7bf7a62dfb2
077caa5b3d93d9d5d30831628fddc9c285d665cfa49b5f0d3dfaa94be48ed85e
1cf4b3ad7abf3189e78c1b3bd07308c92a03fa795fdbc5821fcde24030cfead0
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6600e628d105299a9954bb85edc818356f1ec6136ba5d503dc39b2b3de8526c7
6935876b0112bb2bb5aa7e27c0fdf9be86e190d47a0fbff8eb8e67e25d11f68d
706de242e7c3cfc4b16ba8174723f26fb80566c3171e9e795f057476011a5de1
9f2407325a9ea969c54abe49367c6e5a3e9d390f1e607444004d8347cdab4bab
d1fba9652b1065f12f66a0a068d7e4ae9ed98529b835c8cd05dc54fa378c8c29
e91d1cd5dc3a7a36a6316e70641dca893181fc267c1b2f5777ae85da5998d9eb
f9077e9ffe52966b3a279d70797b41c4eba4e6d3928471fe755fcc3856ac4b3e