URL: http://185.43.190.55/
Submission: On August 06 via api from CA — Scanned from CA

Summary

This website contacted 2 IPs in 1 countries across 0 domains to perform 2 HTTP transactions. The main IP is 185.43.190.55, located in Azerbaijan and belongs to CASTEL-AS, AZ. The main domain is 185.43.190.55.
This is the only time 185.43.190.55 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
2 185.43.190.55 201167 (CASTEL-AS)
2 2
Apex Domain
Subdomains
Transfer
2 0
Domain Requested by
2 0

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://185.43.190.55/
Frame ID: 1146DB9735AA7F21CC6BFA40940FF0FC
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Outlook Web App

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

109 kB
Transfer

123 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
185.43.190.55/
53 KB
54 KB
Document
General
Full URL
http://185.43.190.55/
Protocol
HTTP/1.1
Server
185.43.190.55 , Azerbaijan, ASN201167 (CASTEL-AS, AZ),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
a9c790c475e64b2e1af19f8046177d341728f11c4c7bb814eae83863a8ad73b7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
54726
Content-Type
text/html
Date
Sun, 06 Aug 2023 18:51:43 GMT
ETag
"61604977-d5c6"
Last-Modified
Fri, 08 Oct 2021 13:36:55 GMT
Server
nginx/1.16.1
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://185.43.190.55/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://185.43.190.55/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://185.43.190.55/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
6 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://185.43.190.55/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png
segoeui-regular.ttf
185.43.190.55/themes/resources/
55 KB
56 KB
Font
General
Full URL
http://185.43.190.55/themes/resources/segoeui-regular.ttf
Requested by
Host: 185.43.190.55
URL: http://185.43.190.55/
Protocol
HTTP/1.1
Server
185.43.190.55 , Azerbaijan, ASN201167 (CASTEL-AS, AZ),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708

Request headers

Referer
http://185.43.190.55/
Origin
http://185.43.190.55
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Date
Sun, 06 Aug 2023 18:51:43 GMT
Last-Modified
Fri, 08 Oct 2021 13:31:17 GMT
Server
nginx/1.16.1
ETag
"61604825-ddb8"
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
56760
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

accept-language
en-CA,en;q=0.9
Referer
http://185.43.190.55/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick

1 Cookies

Domain/Path Name / Value
185.43.190.55/ Name: cookieTest
Value: 1