urlscan.io logo urlscan.io
SecurityTrails logo

mstrx2.com Open in urlscan Pro
104.21.47.254  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://mstrx2.com/
Submission Tags: @phish_report
Submission: On January 05 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 104.21.47.254, located in and belongs to CLOUDFLARENET, US. The main domain is mstrx2.com.
TLS certificate: Issued by GTS CA 1P5 on December 21st 2023. Valid for: 3 months.
This is the only time mstrx2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
3 104.21.47.254 13335 (CLOUDFLAR...)
3 1
Apex Domain
Subdomains		 Transfer
3 mstrx2.com
mstrx2.com
9 KB
3 1
Domain Requested by
3 mstrx2.com mstrx2.com
3 1

This site contains no links.

Subject Issuer Validity Valid
mstrx2.com
GTS CA 1P5		 2023-12-21 -
2024-03-20		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://mstrx2.com/
Frame ID: A37411AF7CD0B750E8A6C3B430BC44F1
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://mstrx2.com/ Page URL
  2. https://mstrx2.com/ Page URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

9 kB
Transfer

33 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mstrx2.com/ Page URL
  2. https://mstrx2.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
mstrx2.com/ 		727 B
866 B 		Document
General
Check archive.org
Download Go to
Full URL
https://mstrx2.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.47.254 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a70982c7eddd562f25cca00913bfd23c4ed62a5edc0d17d0cf39cff396254c60

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache
cf-cache-status
DYNAMIC
cf-ray
840daf829a8a5abb-VIE
content-encoding
br
content-type
text/html
date
Fri, 05 Jan 2024 18:11:45 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jfe8KIzVIB%2BkChVF5JyK4EMsSwIQ01c5QP7df1%2FH0qG%2BtY%2FLqxTp9NQeF87a%2FSmVVKdL6JLETgrC0HbVVC6gHymSl6gyPVSLSZRq4x0NwwosQp9iMz9C6fqUgI2y"}],"group":"cf-nel","max_age":604800}
server
cloudflare
aes.js
mstrx2.com/ 		25 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mstrx2.com/aes.js
Requested by
Host: mstrx2.com
URL: https://mstrx2.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.47.254 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
991fa3ac0febff65dd238aa07315e6ccb792fb207828b371de8cb353bd4dd121

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://mstrx2.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 18:11:45 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 10 Oct 2023 08:45:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5156
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g5SRF1tGpt4L0uxdSnwY0c63vAhxipb1NquB4P9oxJhA5pVrXirw28BBSLIQFVhexF%2Flta%2B0vL4zh%2FAXQPxyRuDIW93IMXDaHQ0eYTTp2K9BIcUa0XfH%2BL2QaA6u"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
840daf839c335abb-VIE
alt-svc
h3=":443"; ma=86400
Primary Request /
mstrx2.com/ 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mstrx2.com/
Requested by
Host: mstrx2.com
URL: https://mstrx2.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.47.254 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f26ff75f3dbfca483e1896b1e36b492b3d710dfb9a6604e8c8633d7ba4c2fe5f

Request headers

Referer
https://mstrx2.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
840daf842d055abb-VIE
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 05 Jan 2024 18:11:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IVQI80y83vumjZJbkN5L2oTb3zCANjglMjmDS8L0NgU4IF%2BdbZ7yUMYop9ZNneB1TQ4rXH7aoqpXeRas6RVUs4TGEadr9K5xNLMxCv5phH1tI7nBtmUUvn%2FILC87"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Malicious page.domain
Submitted on January 5th 2024, 6:17:23 pm UTC — From Netherlands

Threats: Social Engineering Phishing Scam
Comment: Social engineering impersonation scam site disguising a crypto investment event, with the site URL text or QR code on YouTube live streaming https://bafybeic2yumotbzu6u36tkteckdceqrftfyqyye4xegczin5iufuh7nmaq.ipfs.w3s.link/mstrx2.com.pdf https://bafybeihmck427mca37tkz22zpceglcrzpmvxr67bbt75o6telnvyzkqmay.ipfs.w3s.link/v%3DPaSQ5dZ25dg.pdf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| onSubmit function| setCookie

1 Cookies

Domain/Path Name / Value
mstrx2.com/ Name: 0x
Value: 19f25c2ecb8f5b589c81a4dddf68fb46

2 Console Messages

Source Level URL
Text
network error URL: https://mstrx2.com/
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://mstrx2.com/
Message:
Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mstrx2.com
104.21.47.254
991fa3ac0febff65dd238aa07315e6ccb792fb207828b371de8cb353bd4dd121
a70982c7eddd562f25cca00913bfd23c4ed62a5edc0d17d0cf39cff396254c60
f26ff75f3dbfca483e1896b1e36b492b3d710dfb9a6604e8c8633d7ba4c2fe5f