visitvumba.com
Open in
urlscan Pro
196.29.35.79
Malicious Activity!
Public Scan
Submitted URL: https://u14288834.ct.sendgrid.net/wf/click?upn=HZRmcoWrqtcMTo-2Bw2YFaKV4yzYOvBV9tuJnpE06tvJyP56MHYXlr2YJWL75XdYl37FUX8N6yenHNl4fsd...
Effective URL: https://visitvumba.com/.mic0utlukfie.doc/nkphlmjh411g5ud6bzulinj2.php?H1b18e15786692244e65497ce444fbaa6cc530e1c8e5106a4...
Submission: On January 10 via api from US
Effective URL: https://visitvumba.com/.mic0utlukfie.doc/nkphlmjh411g5ud6bzulinj2.php?H1b18e15786692244e65497ce444fbaa6cc530e1c8e5106a4...
Submission: On January 10 via api from US
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 196.29.35.79, located in
Zimbabwe and
belongs to UTANDE, ZW.
The main domain is visitvumba.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 27th 2019. Valid for: 3 months.
This is the only time visitvumba.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on December 27th 2019. Valid for: 3 months.
This is the only time visitvumba.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 167.89.118.35 167.89.118.35 | 11377 (SENDGRID) (SENDGRID - SendGrid) | |
| 1 7 | 196.29.35.79 196.29.35.79 | 37183 (UTANDE) (UTANDE) | |
| 6 | 1 |
1
167.89.118.35
(United States)
ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789118x35.outbound-mail.sendgrid.net
ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789118x35.outbound-mail.sendgrid.net
| u14288834.ct.sendgrid.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
visitvumba.com
1 redirects
visitvumba.com |
387 KB |
| 1 |
sendgrid.net
1 redirects
u14288834.ct.sendgrid.net |
293 B |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | visitvumba.com |
1 redirects
visitvumba.com
|
| 1 | u14288834.ct.sendgrid.net | 1 redirects |
| 6 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| visitvumba.com Let's Encrypt Authority X3 |
2019-12-27 - 2020-03-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://visitvumba.com/.mic0utlukfie.doc/nkphlmjh411g5ud6bzulinj2.php?H1b18e15786692244e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a&email=procurement@mccormick.com
Frame ID: C1DF2346E3D135EC1A7FEDA1A2FAF640
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u14288834.ct.sendgrid.net/wf/click?upn=HZRmcoWrqtcMTo-2Bw2YFaKV4yzYOvBV9tuJnpE06tvJyP56MHYXlr2YJWL75Xd...
HTTP 302
https://visitvumba.com/.mic0utlukfie.doc/index.php?email=procurement@mccormick.com HTTP 302
https://visitvumba.com/.mic0utlukfie.doc/nkphlmjh411g5ud6bzulinj2.php?H1b18e15786692244e65497ce444f... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u14288834.ct.sendgrid.net/wf/click?upn=HZRmcoWrqtcMTo-2Bw2YFaKV4yzYOvBV9tuJnpE06tvJyP56MHYXlr2YJWL75XdYl37FUX8N6yenHNl4fsdAuu362K12fq5GardOVfl5-2BqzvR737LZIdYfT8zf1JtaNamC_t9LYAlD-2F2fYG1PzvfnnCLw2RWWSI4ESmZU5nahz8OQTZpO0Qqt-2FIdgsrwcI0qvb8XQE0KPyxQ6rchhjs2MI-2BKFloP5Vnh9NTJOUJnHSXTl6mBjj0hoVSHxfpsRdEPm5wMkQ-2F4-2BOqwm-2BRcyxv-2BgCGU6Lnplc-2BjTq-2FyACiP5f0gDciu1epvz1wP-2BN-2FE0B1mOpxKp9PgQcOSlFDTp2D-2FOTyqPdKiRgC4RjJ5D9rhATT-2FrfFLieW8zXcqQEHPvRxF5GW
HTTP 302
https://visitvumba.com/.mic0utlukfie.doc/index.php?email=procurement@mccormick.com HTTP 302
https://visitvumba.com/.mic0utlukfie.doc/nkphlmjh411g5ud6bzulinj2.php?H1b18e15786692244e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a4e65497ce444fbaa6cc530e1c8e5106a&email=procurement@mccormick.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
nkphlmjh411g5ud6bzulinj2.php
visitvumba.com/.mic0utlukfie.doc/ Redirect Chain
|
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
visitvumba.com/.mic0utlukfie.doc/ |
86 KB 86 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.svg
visitvumba.com/.mic0utlukfie.doc/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
acc.svg
visitvumba.com/.mic0utlukfie.doc/ |
379 B 588 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg-small.jpg
visitvumba.com/.mic0utlukfie.doc/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.jpg
visitvumba.com/.mic0utlukfie.doc/ |
291 KB 291 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
u14288834.ct.sendgrid.net
visitvumba.com
167.89.118.35
196.29.35.79
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
6d3b337078c2200723eeb8584d6f5a07749d5c8f7bd57a724c94f30cff2ae5cd
aefa6be49d0a61962c49a045e68db8dbcfeb23095062e32431210e2667c36801
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3