![](/screenshots/0b2039fc-8e5f-4a3d-9508-dc6c7ce5a420.png)
e-statement0554411129.tewin-bury.co
Open in
urlscan Pro
149.255.62.69
Malicious Activity!
Public Scan
Effective URL: http://e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/
Submission: On December 06 via manual from GB
Summary
This is the only time e-statement0554411129.tewin-bury.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 7 | 149.255.62.69 149.255.62.69 | 34931 (AWARESOFT) (AWARESOFT) | |
2 | 94.31.29.138 94.31.29.138 | 33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group) | |
1 | 2a04:4e42::621 2a04:4e42::621 | 54113 (FASTLY) (FASTLY - Fastly) | |
1 2 | 2606:4700::68... 2606:4700::6810:7daf | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 2606:4700::68... 2606:4700::6813:c497 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 34.235.97.255 34.235.97.255 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
2 | 54.221.234.215 54.221.234.215 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 2a00:1450:400... 2a00:1450:4001:81f::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 2a00:1450:400... 2a00:1450:4001:81f::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
17 | 9 |
ASN34931 (AWARESOFT, GB)
PTR: no-dns-yet.unlimited.uk.net
e-statement0554411129.tewin-bury.co |
ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
PTR: 94.31.29.138.IPYX-077437-ZYO.above.net
cdn.jsdelivr.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-235-97-255.compute-1.amazonaws.com
curli.org |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-221-234-215.compute-1.amazonaws.com
api.ipify.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
tewin-bury.co
2 redirects
e-statement0554411129.tewin-bury.co |
636 KB |
2 |
gstatic.com
fonts.gstatic.com |
28 KB |
2 |
ipify.org
api.ipify.org |
548 B |
2 |
cloudflare.com
cdnjs.cloudflare.com |
204 KB |
2 |
unpkg.com
1 redirects
unpkg.com |
865 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net |
38 KB |
1 |
googleapis.com
fonts.googleapis.com |
815 B |
1 |
curli.org
curli.org |
3 KB |
1 |
polyfill.io
cdn.polyfill.io |
2 KB |
17 | 9 |
Domain | Requested by | |
---|---|---|
7 | e-statement0554411129.tewin-bury.co |
2 redirects
e-statement0554411129.tewin-bury.co
unpkg.com |
2 | fonts.gstatic.com |
e-statement0554411129.tewin-bury.co
cdnjs.cloudflare.com |
2 | api.ipify.org |
curli.org
e-statement0554411129.tewin-bury.co |
2 | cdnjs.cloudflare.com |
e-statement0554411129.tewin-bury.co
|
2 | unpkg.com |
1 redirects
e-statement0554411129.tewin-bury.co
|
2 | cdn.jsdelivr.net |
e-statement0554411129.tewin-bury.co
|
1 | fonts.googleapis.com |
e-statement0554411129.tewin-bury.co
|
1 | curli.org |
e-statement0554411129.tewin-bury.co
|
1 | cdn.polyfill.io |
e-statement0554411129.tewin-bury.co
|
17 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cdn.jsdelivr.net COMODO RSA Domain Validation Secure Server CA |
2014-04-20 - 2019-04-19 |
5 years | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2018-10-21 - 2019-04-27 |
6 months | crt.sh |
ssl714328.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-10-23 - 2019-05-01 |
6 months | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-22 - 2019-03-31 |
6 months | crt.sh |
curli.org Let's Encrypt Authority X3 |
2018-12-01 - 2019-03-01 |
3 months | crt.sh |
*.ipify.org COMODO RSA Domain Validation Secure Server CA |
2018-01-24 - 2021-01-23 |
3 years | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-11-07 - 2019-01-30 |
3 months | crt.sh |
*.google.com Google Internet Authority G3 |
2018-11-07 - 2019-01-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/
Frame ID: 9377C1A19525BC42A1A07238C48BAB1A
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/0b2039fc-8e5f-4a3d-9508-dc6c7ce5a420.png)
Page URL History Show full URLs
-
http://e-statement0554411129.tewin-bury.co/
HTTP 302
http://e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841 HTTP 301
http://e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/ Page URL
Detected technologies
![](/vendor/wappa/icons/Semantic-ui.png)
Detected patterns
- html /(?:<link[^>]+semantic(?:\.css|\.min\.css)">)/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- env /^Vue$/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://e-statement0554411129.tewin-bury.co/
HTTP 302
http://e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841 HTTP 301
http://e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://unpkg.com/@babel/standalone/babel.min.js HTTP 302
- https://unpkg.com/@babel/standalone@7.2.0/babel.min.js
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/ Redirect Chain
|
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
runtime.js
cdn.jsdelivr.net/npm/babel-regenerator-runtime@6.5.0/ |
21 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
polyfill.js
cdn.polyfill.io/v2/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
babel.min.js
unpkg.com/@babel/standalone@7.2.0/ Redirect Chain
|
4 MB 865 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ |
265 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
vue
cdn.jsdelivr.net/npm/ |
84 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
@curli
curli.org/lib/ie/ |
3 KB 3 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
semantic.css
cdnjs.cloudflare.com/ajax/libs/semantic-ui/2.3.3/ |
803 KB 124 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft.css
e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/pip/css/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/pip/img/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
23 B 274 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
3 KB 815 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font.jpg
e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/pip/img/ |
623 KB 624 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v14/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft.js
e-statement0554411129.tewin-bury.co/c095feb795a48dcc014807d88480c841/pip/js/configs/ |
3 KB 3 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v14/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
api.ipify.org/ |
23 B 274 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| regeneratorRuntime object| Babel function| $ function| jQuery function| Vue function| curli function| _asyncToGenerator object| pip function| isEmail string| ipClient0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.ipify.org
cdn.jsdelivr.net
cdn.polyfill.io
cdnjs.cloudflare.com
curli.org
e-statement0554411129.tewin-bury.co
fonts.googleapis.com
fonts.gstatic.com
unpkg.com
149.255.62.69
2606:4700::6810:7daf
2606:4700::6813:c497
2a00:1450:4001:81f::2003
2a00:1450:4001:81f::200a
2a04:4e42::621
34.235.97.255
54.221.234.215
94.31.29.138
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0cd7513f7097a59cecd105959566cc5d0a61b02acfa6028997a717d37ab9095d
0d70317736ee638a11fe9ee8ab969204dfdd81f352b0de49c46fd40a52a50b9b
1514c4534fa56942e4b4e0e16e100ce2ed48e841ead46e548ada717a15833dcf
16d59f448fad85694dcf6b01dd225bc0ac793e0332288560c07093c1addb8977
1f1c2e932aec2b06a9b4f575b17ef4a0e74de39b73e970b4ac655ba37dc6efb6
4a785195e8e7247f30fe13d244cfc3783b4e0b5431b78dea3a41222830619108
52726fb580d6bffc46615863ddbf4c319524b5a68fb484be2972bdad4fd0310d
644c9ec95d3a020ba6f07f6282615ec3338b8dc4405b2ed1f01018404076dd65
92aa439b3a256f82c2553b138db77ad8751c1d6c23eb4d981b48216e3cd09fd9
9e01cd9d5c99f2550fff5002f1b7fcc1402aa88b84f471214b032a7cde0f42b2
a3b3c4f67bf2b44294215e2be76f12794e6b142edec201e199c93c38739f2bfc
b9258540f48bff83be38e2952dfa01f6bb5c6ccbc13baccf3e26995299f59d07
d5d71858f0080732e03899513693055a2d5a204599538f74b68ea491b0e614cf
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
e9831525c090d4e788f68657882658f1fcd0120885d2bcbb198d12d438b2ccf6