caselegal.am Open in urlscan Pro
173.254.30.55  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://redirectsrv.sgp1.cdn.digitaloceanspaces.com/downloading.html Page URL
2. https://caselegal.am/captcha.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	downloading.html Show response redirectsrv.sgp1.cdn.digitaloceanspaces.com/	37 KB 37 KB	42ms 9ms	Document text/html	205.185.216.10 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://redirectsrv.sgp1.cdn.digitaloceanspaces.com/downloading.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US), Reverse DNS map2.hwcdn.net Software / Resource Hash 904ab40246c2784bb71fb67a8aca96d9ed6241fb464756ec00b8688ac1802463 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Thu, 20 Jan 2022 18:47:43 GMT Connection Keep-Alive Cache-Control max-age=2917 Content-Length 37498 Content-Type text/html Last-Modified Thu, 20 Jan 2022 16:19:42 GMT Accept-Ranges bytes x-rgw-object-type Normal etag "db86eb6b84e0b44720b78c4097e8fd6e" x-amz-request-id tx000000000000077d01526-0061e9aba4-9c18b92-sgp1b strict-transport-security max-age=15552000; includeSubDomains; preload Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1642704463.dop224.fr8.t,1642704463.cds284.fr8.shn,1642704463.dop224.fr8.t,1642704463.cds057.fr8.c
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a00f7ed35be5bfea9cbbdcbeca07f536d9db6fb6391ca55ad38790eecb01ffeb Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Content-Type image/png
GET H2	200	Primary Request captcha.html Show response caselegal.am/	139 B 233 B	450ms 150ms	Document text/html	173.254.30.55 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://caselegal.am/captcha.html Requested by Host: redirectsrv.sgp1.cdn.digitaloceanspaces.com URL: https://redirectsrv.sgp1.cdn.digitaloceanspaces.com/downloading.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.30.55 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS just2035.justhost.com Software Apache / Resource Hash 060ba2ef51ffdeb7ce24847923e3f2b4daed05035047faee5ad02e2bebf984fe Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://redirectsrv.sgp1.cdn.digitaloceanspaces.com/ Response headers last-modified Thu, 20 Jan 2022 17:26:16 GMT accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 118 content-type text/html date Thu, 20 Jan 2022 18:47:46 GMT server Apache
GET H2	200	myscr242127.js Show response caselegal.am/	46 KB 13 KB	154ms 153ms	Script application/javascript	173.254.30.55 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://caselegal.am/myscr242127.js Requested by Host: caselegal.am URL: https://caselegal.am/captcha.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 173.254.30.55 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS just2035.justhost.com Software Apache / Resource Hash 40d4eefb58cf65c6e7bd6bede5fb5622676c8a00a14642e575483a96523bce4e Request headers Accept-Language de-DE,de;q=0.9 Referer https://caselegal.am/captcha.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 20 Jan 2022 18:47:46 GMT content-encoding gzip last-modified Thu, 20 Jan 2022 17:25:52 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 13058
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	61ms 20ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: caselegal.am URL: https://caselegal.am/myscr242127.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://caselegal.am/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 20 Jan 2022 18:47:47 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 17:27:20 GMT server nginx etag W/"603e7578-15d9d" vary Accept-Encoding x-hw 1642704467.dop003.ml1.t,1642704467.cds207.ml1.hn,1642704467.cds012.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H2	200	jquery.inputmask.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery.inputmask/5.0.7-beta.29/	94 KB 26 KB	80ms 36ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery.inputmask/5.0.7-beta.29/jquery.inputmask.min.js Requested by Host: caselegal.am URL: https://caselegal.am/myscr242127.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c35de839bf714c1ae5ff01f24453ba7293d36427f10f8c296a9046ba34eded39 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://caselegal.am/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 20 Jan 2022 18:47:47 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 128401 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 25765 timing-allow-origin * last-modified Wed, 10 Nov 2021 10:00:45 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "618b984d-64a5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gwhF8uNj0bJnsfSdVw2%2BzmMY8HJCcCvh8IIlgOdyvDeuJOP9QIoFYM1tUxLY6UFnGRdUafPCJymN1OYMrxtf9xkjWRN2XCToxys4pVZ99SpezMXC4yOjgW5ji33NGe5zO2t5Bu0D1mYAOdxYGMs%2FT0cd"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6d0a79275e143753-MXP expires Tue, 10 Jan 2023 18:47:47 GMT
GET H2	200	jquery-ui.js Show response code.jquery.com/ui/1.12.1/	509 KB 122 KB	83ms 43ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/ui/1.12.1/jquery-ui.js Requested by Host: caselegal.am URL: https://caselegal.am/myscr242127.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 4f455eb2ddf2094ee969f470f6bfac7adb4c057e8990a374e9da819e943c777d Request headers Referer https://caselegal.am/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 20 Jan 2022 18:47:47 GMT content-encoding gzip last-modified Wed, 14 Sep 2016 16:34:16 GMT server nginx etag "57d97c08-7f20a" vary Accept-Encoding x-hw 1642704467.dop003.ml1.t,1642704467.cds207.ml1.hn,1642704467.cds208.ml1.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 124434
GET		/ www.undefined/ Frame 8CC0	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.undefined

URL

https://www.undefined/

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| erp string| em number| tmp function| $ function| jQuery function| Inputmask function| default function| _0x236d function| createBlueDots function| makeId function| _0x1bde function| refreshCaptcha function| httpGet string| captcha

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://caselegal.am/myscr242127.js(Line 2018) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://caselegal.am/myscr242127.js(Line 2018) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery.inputmask/5.0.7-beta.29/jquery.inputmask.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://caselegal.am/myscr242127.js(Line 2018) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/ui/1.12.1/jquery-ui.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://caselegal.am/myscr242127.js(Line 2018) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://caselegal.am/myscr242127.js(Line 2018) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery.inputmask/5.0.7-beta.29/jquery.inputmask.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://caselegal.am/myscr242127.js(Line 2018) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/ui/1.12.1/jquery-ui.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

caselegal.am
cdnjs.cloudflare.com
code.jquery.com
redirectsrv.sgp1.cdn.digitaloceanspaces.com
www.undefined
www.undefined
173.254.30.55
2001:4de0:ac18::1:a:3b
205.185.216.10
2606:4700::6810:125e
060ba2ef51ffdeb7ce24847923e3f2b4daed05035047faee5ad02e2bebf984fe
40d4eefb58cf65c6e7bd6bede5fb5622676c8a00a14642e575483a96523bce4e
4f455eb2ddf2094ee969f470f6bfac7adb4c057e8990a374e9da819e943c777d
904ab40246c2784bb71fb67a8aca96d9ed6241fb464756ec00b8688ac1802463
a00f7ed35be5bfea9cbbdcbeca07f536d9db6fb6391ca55ad38790eecb01ffeb
c35de839bf714c1ae5ff01f24453ba7293d36427f10f8c296a9046ba34eded39
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e