presentation.ri-yaz.com Open in urlscan Pro
117.53.155.104 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.glanzmann-kuechen.ch/
Effective URL:
https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4...
Submission: On March 17 via manual (March 17th 2020, 4:36:20 pm UTC) from IN

Summary HTTP 6 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 117.53.155.104, located in Malaysia and belongs to EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY. The main domain is presentation.ri-yaz.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 24th 2020. Valid for: 3 months.

This is the only time presentation.ri-yaz.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1	193.93.20.91 193.93.20.91		31052 (EXIGO exigo) (EXIGO exigo)
1 1	2600:9000:21f... 2600:9000:21f3:7400:19:9934:6a80:93a1		16509 (AMAZON-02) (AMAZON-02)
1 6	117.53.155.104 117.53.155.104		46015 (EXABYTES-...) (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd.)
6	2

1 193.93.20.91 (Switzerland)

ASN31052 (EXIGO exigo, Switzerland, Autonomous System, CH)
PTR: web21.exigo.ch

www.glanzmann-kuechen.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21f3:7400:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

ko1rm.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 117.53.155.104 (Malaysia) 1 redirects

ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY)
PTR: vps.dashbox-cyberjaya.com

presentation.ri-yaz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	ri-yaz.com 1 redirects presentation.ri-yaz.com	397 KB
1	app.link 1 redirects ko1rm.app.link	714 B
1	glanzmann-kuechen.ch www.glanzmann-kuechen.ch	401 B
6	3

	Domain	Requested by
6	presentation.ri-yaz.com	1 redirects www.glanzmann-kuechen.ch presentation.ri-yaz.com
1	ko1rm.app.link	1 redirects
1	www.glanzmann-kuechen.ch
6	3

This site contains no links.

Subject Issuer	Validity	Valid
presentation.ri-yaz.com cPanel, Inc. Certification Authority	`2020-02-24` - `2020-05-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error=
Frame ID: 7CB838F28665990A0CB2C898E01AB47B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.glanzmann-kuechen.ch/ Page URL
https://ko1rm.app.link/fjpz0izrV4 HTTP 307
https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/?_branch_match_id=768500194958892055&utm_me... HTTP 302
https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629... Page URL

Detected technologies

Perl (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /\bPerl\b(?: ?\/?v?([\d.]+))?/i
headers server /mod_perl(?:\/([\d\.]+))?/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_perl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_perl(?:\/([\d\.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

83 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

397 kB
Transfer

396 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.glanzmann-kuechen.ch/ Page URL
https://ko1rm.app.link/fjpz0izrV4 HTTP 307
https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/?_branch_match_id=768500194958892055&utm_medium=marketing HTTP 302
https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.glanzmann-kuechen.ch/	95 B 401 B	117ms 62ms	Document text/html	193.93.20.91 EXIGO exigo
General Check archive.org Show headers Download Go to Full URL http://www.glanzmann-kuechen.ch/ Protocol HTTP/1.1 Server 193.93.20.91 , Switzerland, ASN31052 (EXIGO exigo, Switzerland, Autonomous System, CH), Reverse DNS web21.exigo.ch Software Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7e-p1 mod_fcgid/2.3.1 mod_perl/2.0.3 Perl/v5.8.8 / PHP/5.3.27 Resource Hash `6d031aeb584701823eda80117ebc7f0eb53d4e2bd6d41329e92fb94c10415f2f` Request headers Host www.glanzmann-kuechen.ch Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 17 Mar 2020 16:35:50 GMT Server Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7e-p1 mod_fcgid/2.3.1 mod_perl/2.0.3 Perl/v5.8.8 X-Powered-By PHP/5.3.27 Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html
GET H/1.1	200 OK	Primary Request uuvjcim62j7vc53wevn8f1k4.php Show response presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/ Redirect Chain https://ko1rm.app.link/fjpz0izrV4 https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/?_branch_match_id=768500194958892055&utm_medium=marketing https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d...	3 KB 3 KB	269ms 263ms	Document text/html	117.53.155.104 EXABYTES-AS-AP Ex...
General Check archive.org Show headers Download Go to Full URL https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= Requested by Host: www.glanzmann-kuechen.ch URL: http://www.glanzmann-kuechen.ch/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 117.53.155.104 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY), Reverse DNS vps.dashbox-cyberjaya.com Software Apache / Resource Hash `d270904c64d7002c6c4ce2a35a982e27a29a05b9dad703db5728437181c1e8de` Request headers Host presentation.ri-yaz.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Referer http://www.glanzmann-kuechen.ch/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Referer http://www.glanzmann-kuechen.ch/ Response headers Date Tue, 17 Mar 2020 16:35:52 GMT Server Apache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Tue, 17 Mar 2020 16:35:52 GMT Server Apache Location uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style.css presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/	6 KB 6 KB	190ms 190ms	Stylesheet text/css	117.53.155.104 EXABYTES-AS-AP Ex...
General Check archive.org Show headers Download Go to Full URL https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/style.css Requested by Host: presentation.ri-yaz.com URL: https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 117.53.155.104 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY), Reverse DNS vps.dashbox-cyberjaya.com Software Apache / Resource Hash `8967c23e12f26fdcd7d3b9e2a14f6b655865768aaee0724dc5d7e282892e392d` Request headers Referer https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Tue, 17 Mar 2020 16:35:52 GMT Last-Modified Tue, 22 Jan 2019 02:59:16 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 5700
GET H/1.1	200 OK	jquery.js Show response presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/js/	94 KB 94 KB	482ms 382ms	Script application/javascript	117.53.155.104 EXABYTES-AS-AP Ex...
General Check archive.org Show headers Download Go to Full URL https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/js/jquery.js Requested by Host: presentation.ri-yaz.com URL: https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 117.53.155.104 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY), Reverse DNS vps.dashbox-cyberjaya.com Software Apache / Resource Hash `91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef` Request headers Referer https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Tue, 17 Mar 2020 16:35:52 GMT Last-Modified Tue, 22 Jan 2019 02:59:16 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 95790
GET H/1.1	200 OK	ms-logo-v2.jpg presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/images/	3 KB 3 KB	388ms 196ms	Image image/jpeg	117.53.155.104 EXABYTES-AS-AP Ex...
General Check archive.org Show headers Download Go to Show image Full URL https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/images/ms-logo-v2.jpg Requested by Host: presentation.ri-yaz.com URL: https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 117.53.155.104 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY), Reverse DNS vps.dashbox-cyberjaya.com Software Apache / Resource Hash `bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164` Request headers Referer https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/uuvjcim62j7vc53wevn8f1k4.php?K808G215844629521a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc1a180554432537bbd4a241d2517e83fc&email=&error= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Tue, 17 Mar 2020 16:35:52 GMT Last-Modified Tue, 22 Jan 2019 02:59:16 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2797
GET H/1.1	200 OK	0.jpg presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/images/	291 KB 291 KB	202ms 202ms	Image image/jpeg	117.53.155.104 EXABYTES-AS-AP Ex...
General Check archive.org Show headers Download Go to Show image Full URL https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/images/0.jpg Requested by Host: presentation.ri-yaz.com URL: https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/js/jquery.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 117.53.155.104 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY), Reverse DNS vps.dashbox-cyberjaya.com Software Apache / Resource Hash `62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214` Request headers Referer https://presentation.ri-yaz.com/wp-admin/js/widgets/vm/vnmn/cymk/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Tue, 17 Mar 2020 16:35:54 GMT Last-Modified Tue, 22 Jan 2019 02:59:16 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 298105

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| isValidEmailAddress

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ko1rm.app.link
presentation.ri-yaz.com
www.glanzmann-kuechen.ch
117.53.155.104
193.93.20.91
2600:9000:21f3:7400:19:9934:6a80:93a1
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
6d031aeb584701823eda80117ebc7f0eb53d4e2bd6d41329e92fb94c10415f2f
8967c23e12f26fdcd7d3b9e2a14f6b655865768aaee0724dc5d7e282892e392d
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
d270904c64d7002c6c4ce2a35a982e27a29a05b9dad703db5728437181c1e8de