urlscan.io logo urlscan.io
SecurityTrails logo

login.serv010.com Open in urlscan Pro
45.14.224.6  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ip.ios.semcs.net/LOGOUT?dest=http%3a%2f%2fex1yk9.codesandbox.io?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Effective URL: https://login.serv010.com/eYrTiDLe
Submission: On February 07 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 8 HTTP transactions. The main IP is 45.14.224.6, located in Amsterdam, Netherlands and belongs to SPECTRAIP SpectraIP B.V., NL. The main domain is login.serv010.com.
TLS certificate: Issued by R3 on January 23rd 2023. Valid for: 3 months.
This is the only time login.serv010.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 54.211.49.143 14618 (AMAZON-AES)
1 1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 45.14.224.6 62068 (SPECTRAIP...)
1 1 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2a04:4e42::347 54113 (FASTLY)
1 79.133.177.228 24429 (TAOBAO Zh...)
8 6
1    54.211.49.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-211-49-143.compute-1.amazonaws.com
ip.ios.semcs.net
1    2606:4700::6812:672 (United States)

ASN13335 (CLOUDFLARENET, US)
ex1yk9.codesandbox.io
3    2606:4700::6812:772 (United States)

ASN13335 (CLOUDFLARENET, US)
ex1yk9.codesandbox.io
codesandbox.io
1    2606:4700::6810:3865 (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
1    45.14.224.6 (Amsterdam, Netherlands)

ASN62068 (SPECTRAIP SpectraIP B.V., NL)
PTR: hosted-by.spectraip.net
login.serv010.com
1    2606:4700:20::ac43:4aa3 (United States)

ASN13335 (CLOUDFLARENET, US)
picsum.photos
1    2a04:4e42::347 (United States)

ASN54113 (FASTLY, US)
fastly.picsum.photos
1    79.133.177.228 (Russian Federation)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)
cstaticdun.126.net
Apex Domain
Subdomains		 Transfer
4 codesandbox.io
ex1yk9.codesandbox.io
codesandbox.io — Cisco Umbrella Rank: 79392
48 KB
2 picsum.photos
picsum.photos — Cisco Umbrella Rank: 54962
fastly.picsum.photos
9 KB
1 126.net
cstaticdun.126.net — Cisco Umbrella Rank: 95014
12 KB
1 serv010.com
login.serv010.com
11 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 958
6 KB
1 semcs.net
ip.ios.semcs.net
833 B
8 6
Domain Requested by
2 codesandbox.io ex1yk9.codesandbox.io
codesandbox.io
2 ex1yk9.codesandbox.io 1 redirects
1 cstaticdun.126.net login.serv010.com
1 fastly.picsum.photos login.serv010.com
1 picsum.photos 1 redirects
1 login.serv010.com ex1yk9.codesandbox.io
1 static.cloudflareinsights.com ex1yk9.codesandbox.io
1 ip.ios.semcs.net 1 redirects
8 8

This site contains no links.

Subject Issuer Validity Valid
codesandbox.io
Cloudflare Inc ECC CA-3		 2022-04-18 -
2023-04-18		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-11 -
2023-05-10		 a year crt.sh
login.serv010.com
R3		 2023-01-23 -
2023-04-23		 3 months crt.sh
*.126.net
TrustAsia RSA OV TLS CA G2		 2022-11-28 -
2023-12-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login.serv010.com/eYrTiDLe
Frame ID: 557276A958F401E2BA334B6F926AEE68
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Captcha

Page URL History Show full URLs

  1. https://ip.ios.semcs.net/LOGOUT?dest=http%3a%2f%2fex1yk9.codesandbox.io?zc=76d61726b75732e686172746d6... HTTP 302
    http://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d HTTP 301
    https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d Page URL
  2. https://login.serv010.com/eYrTiDLe Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

8
Requests

75 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

85 kB
Transfer

226 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ip.ios.semcs.net/LOGOUT?dest=http%3a%2f%2fex1yk9.codesandbox.io?zc=76d61726b75732e686172746d616e6e40686572652e636f6d HTTP 302
    http://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d HTTP 301
    https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d Page URL
  2. https://login.serv010.com/eYrTiDLe Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://ip.ios.semcs.net/LOGOUT?dest=http%3a%2f%2fex1yk9.codesandbox.io?zc=76d61726b75732e686172746d616e6e40686572652e636f6d HTTP 302
  • http://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d HTTP 301
  • https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Request Chain 5
  • https://picsum.photos/300/150/?image=290 HTTP 302
  • https://fastly.picsum.photos/id/290/300/150.jpg?hmac=GFWQDiGHbDRzsUIE_fFhp43SIjU9cduWQapErHJupt4

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
ex1yk9.codesandbox.io/
Redirect Chain
  • https://ip.ios.semcs.net/LOGOUT?dest=http%3a%2f%2fex1yk9.codesandbox.io?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
  • http://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
  • https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:772 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f3aac2218f9436466e5ad6bf8a5b3d968fffd2babb8e8bca643433b4e454148

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0, no-cache, no-store
cf-cache-status
DYNAMIC
cf-ray
795aa9ad0c1c2be5-FRA
content-encoding
br
content-type
text/html
date
Tue, 07 Feb 2023 08:12:50 GMT
server
cloudflare
vary
Accept-Encoding
via
1.1 google
x-request-id
F0F8oagpyEakyjIKHM2B

Redirect headers

CF-RAY
795aa9ac18f690ac-FRA
Cache-Control
max-age=3600
Connection
keep-alive
Date
Tue, 07 Feb 2023 08:12:49 GMT
Expires
Tue, 07 Feb 2023 09:12:49 GMT
Location
https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Server
cloudflare
Server-Timing
cf-q-config;dur=7.9999990703072e-06
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
sse-hooks.f742b80f43c5a2e0e619b0d97b5886cd.js
codesandbox.io/public/sse-hooks/ 		172 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/public/sse-hooks/sse-hooks.f742b80f43c5a2e0e619b0d97b5886cd.js
Requested by
Host: ex1yk9.codesandbox.io
URL: https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:772 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5d32a15d4694a9a6cd245c8ce10acbb9ef6fe293331ca508a5ecc6ab78acc158

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ex1yk9.codesandbox.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 08:12:50 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
age
3973842
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Sat, 13 Aug 2022 13:00:47 GMT
server
cloudflare
etag
W/"62f7a07f-2aeb3"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
795aa9adace32be5-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
banner.be879265d.js
codesandbox.io/static/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/static/js/banner.be879265d.js
Requested by
Host: ex1yk9.codesandbox.io
URL: https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:772 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3adcc764bec65346b5a72de77f2f5688c2484ab587d2d093eb5e2327d608af60

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ex1yk9.codesandbox.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 08:12:50 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
age
284071
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 04 May 2021 17:52:33 GMT
server
cloudflare
etag
W/"609189e1-f3a"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
795aa9adace42be5-FRA
expires
Thu, 31 Dec 2037 23:55:55 GMT
vaafb692b2aea4879b33c060e79fe94621666317369993
static.cloudflareinsights.com/beacon.min.js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by
Host: ex1yk9.codesandbox.io
URL: https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://ex1yk9.codesandbox.io/
Origin
https://ex1yk9.codesandbox.io
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 08:12:50 GMT
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 01:56:09 GMT
server
cloudflare
etag
W/2022.10.1
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
795aa9ae8c8d2bf5-FRA
phishing
codesandbox.io/api/v1/sandboxes/ex1yk9/ 		0
0
Primary Request eYrTiDLe
login.serv010.com/ 		11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.serv010.com/eYrTiDLe
Requested by
Host: ex1yk9.codesandbox.io
URL: https://ex1yk9.codesandbox.io/?zc=76d61726b75732e686172746d616e6e40686572652e636f6d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.14.224.6 Amsterdam, Netherlands, ASN62068 (SPECTRAIP SpectraIP B.V., NL),
Reverse DNS
hosted-by.spectraip.net
Software
/
Resource Hash
92a0156d71801ae8352797a7b6b2fd8c5568b1616cae4a14e2fc572720b59611

Request headers

Referer
https://ex1yk9.codesandbox.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
close
Content-Type
text/html
Transfer-Encoding
chunked
150.jpg
fastly.picsum.photos/id/290/300/
Redirect Chain
  • https://picsum.photos/300/150/?image=290
  • https://fastly.picsum.photos/id/290/300/150.jpg?hmac=GFWQDiGHbDRzsUIE_fFhp43SIjU9cduWQapErHJupt4
8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fastly.picsum.photos/id/290/300/150.jpg?hmac=GFWQDiGHbDRzsUIE_fFhp43SIjU9cduWQapErHJupt4
Requested by
Host: login.serv010.com
URL: https://login.serv010.com/eYrTiDLe
Protocol
H2
Server
2a04:4e42::347 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
bfa5b49d76e0399b39788390a062044713905377cc746dc669b818a93961385c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.serv010.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 07 Feb 2023 08:12:50 GMT
via
1.1 varnish
age
0
x-cache
MISS
content-disposition
inline; filename="290-300x150.jpg"
content-length
8110
x-served-by
cache-hhn-etou8220041-HHN
x-timer
S1675757571.775438,VS0,VE100
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Type, Picsum-Id
cache-control
public, max-age=2592000, stale-while-revalidate=60, stale-if-error=43200, immutable
accept-ranges
bytes
timing-allow-origin
*
picsum-id
290

Redirect headers

date
Tue, 07 Feb 2023 08:12:50 GMT
strict-transport-security
max-age=15552000
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xDRGhA8gRs6RzacANAFGJiHcXWKisZQX748mqNDYfWvgB%2BtbH9Iz9DVFdGANlD2Hd3XPV4FWnfuGVHGF34vxRS9l07QYL1dsWU7kNTYD6GkMsCY2yyp0L0Q8RfX01gHwkV9VTLNAFwb9WRI%3D"}],"group":"cf-nel","max_age":604800}
location
https://fastly.picsum.photos/id/290/300/150.jpg?hmac=GFWQDiGHbDRzsUIE_fFhp43SIjU9cduWQapErHJupt4
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate
cf-ray
795aa9b04d8f9be8-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type
image/svg+xml
icon_light.f13cff3.png
cstaticdun.126.net//2.6.3/images/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png
Requested by
Host: login.serv010.com
URL: https://login.serv010.com/eYrTiDLe
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
79.133.177.228 , Russian Federation, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.serv010.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date
Tue, 07 Feb 2023 08:12:52 GMT
Via
cache11.l2de2[381,381,304-0,H], cache12.l2de2[382,0], cache11.de3[385,385,200-0,H], cache14.de3[387,0]
Age
0
X-Swift-CacheTime
60
X-Cache
HIT TCP_REFRESH_HIT dirn:12:583190872
Connection
keep-alive
X-Swift-SaveTime
Tue, 07 Feb 2023 08:12:52 GMT
Content-Length
11413
Last-Modified
Mon, 07 Nov 2022 05:53:30 GMT
Server
Tengine
Ali-Swift-Global-Savetime
1675757572
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Methods
GET,POST,OPTIONS,HEAD
Access-Control-Expose-Headers
*
Cache-Control
max-age=43200
Accept-Ranges
bytes
Timing-Allow-Origin
*, *
EagleId
4f85b1a216757575718518430e
Expires
Thu, 02 Feb 2023 03:59:18 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
codesandbox.io
URL
https://codesandbox.io/api/v1/sandboxes/ex1yk9/phishing

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| _createClass function| _classCallCheck function| cleanMsg object| jigsaw

3 Cookies

Domain/Path Name / Value
ip.ios.semcs.net/ Name: AWSELB
Value: A96FE98D0C2A5FD59612EF908265B26F1EAFDCFF864372151FE94D184A4E8CDED7C4D37CCD495564D9C469585295A466A7DBB73DD314BD07927CFB20CDBD8BC584379931F3
ip.ios.semcs.net/ Name: AWSELBCORS
Value: A96FE98D0C2A5FD59612EF908265B26F1EAFDCFF864372151FE94D184A4E8CDED7C4D37CCD495564D9C469585295A466A7DBB73DD314BD07927CFB20CDBD8BC584379931F3
.serv010.com/ Name: sIFx
Value: 8aeeaa29dc1b44a8a0339dca052e5fdc8d627b3d817d392883288b11a1ceb0ec