dougles.com.my Open in urlscan Pro
137.59.111.102 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://dougles.com.my/DEMINGLAW/ofc3/
Effective URL:
https://dougles.com.my/DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c...
Submission: On June 28 via manual (June 28th 2021, 4:28:28 pm UTC) from US

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 137.59.111.102, located in Malaysia and belongs to EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY. The main domain is dougles.com.my.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 11th 2021. Valid for: 3 months.

This is the only time dougles.com.my was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 3	137.59.111.102 137.59.111.102	46015 (EXABYTES-...) (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd.)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b	63949 (LINODE-AP...) (LINODE-AP Linode)
4	4

3 137.59.111.102 (Malaysia) 1 redirects

ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY)
PTR: server.zsone.com.my

dougles.com.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:3c01::f03c:91ff:fe79:43b (Fremont, United States)

ASN63949 (LINODE-AP Linode, LLC, US)

jsonip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	dougles.com.my 1 redirects dougles.com.my	30 KB
1	jsonip.com jsonip.com	453 B
1	cloudflare.com cdnjs.cloudflare.com	64 KB
4	3

	Domain	Requested by
3	dougles.com.my	1 redirects
1	jsonip.com	cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	dougles.com.my
4	3

This site contains no links.

Subject Issuer	Validity	Valid
dougles.com.my cPanel, Inc. Certification Authority	`2021-06-11` - `2021-09-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
jsonip.com R3	`2021-04-27` - `2021-07-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://dougles.com.my/DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
Frame ID: 09B1860DACE4D27D8B82E13E3D3F5114
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://dougles.com.my/DEMINGLAW/ofc3/ HTTP 303
https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012... Page URL
https://dougles.com.my/DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

94 kB
Transfer

348 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://dougles.com.my/DEMINGLAW/ofc3/ HTTP 303
https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e Page URL
https://dougles.com.my/DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://dougles.com.my/DEMINGLAW/ofc3/ HTTP 303
https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e

4 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

r.php Show response
dougles.com.my/DEMINGLAW/ofc3/
Redirect Chain

https://dougles.com.my/DEMINGLAW/ofc3/
https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e

222 B
233 B

268ms
268ms

Document
text/html

137.59.111.102
EXABYTES-AS-AP Ex...

General

Check archive.org

Show headers Download Go to

Full URL: https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 137.59.111.102 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS: server.zsone.com.my
Software: Apache /
Resource Hash: a24b023eaa4ee356ce7c7a583c23447f351e2d8e6e7c2cc1a48bffe860f0e933

Request headers

:method: GET
:authority: dougles.com.my
:scheme: https
:path: /DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=4a24cb22f057a4d406e51f71e4d99206
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 16:28:12 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

Redirect headers

date: Mon, 28 Jun 2021 16:28:12 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
set-cookie: PHPSESSID=4a24cb22f057a4d406e51f71e4d99206; path=/
location: ./r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
content-type: text/html; charset=UTF-8

GET
H2 200 Primary Request / Show response
dougles.com.my/DEMINGLAW/ofc3/s/ 54 KB
30 KB 277ms
277ms Document
text/html 137.59.111.102
EXABYTES-AS-AP Ex...

General

Check archive.org

Show headers Download Go to

Full URL: https://dougles.com.my/DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 137.59.111.102 , Malaysia, ASN46015 (EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd., MY),
Reverse DNS: server.zsone.com.my
Software: Apache /
Resource Hash: cb0fcc0f09ec5f60b43a4ce77e50666d60b2175b9980e6156f240f9656c47e84

Request headers

:method: GET
:authority: dougles.com.my
:scheme: https
:path: /DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=4a24cb22f057a4d406e51f71e4d99206
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://dougles.com.my/DEMINGLAW/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e

Response headers

date: Mon, 28 Jun 2021 16:28:12 GMT
server: Apache
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-encoding: gzip
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ 257 KB
64 KB 17ms
17ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Requested by

Host: dougles.com.my
URL: https://dougles.com.my/DEMINGLAW/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=5358411012564a307e69efa2aafdd638c5b3b26ff95752dfad6b636283dcfeb9f1e7a22e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://dougles.com.my/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 16:28:12 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 923358
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 64997
cf-request-id: 0af50c3d010000c2a9703ae000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-40464"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=0cKfblS31P3s2JV%2FhVK4XWFICrXjPgjjI2PJWI9Dk%2FGHtJgdOrmSDELCTxXGUK0w7eYB3VFl2W7%2FT51PHFxkG2es2iJGfJoAS7M1HnYLiGhKN%2FQMUou6kEooXMVvTqg3IQrpX%2FnWKuw6myFHYw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 66684974cfe1c2a9-FRA
expires: Sat, 18 Jun 2022 16:28:12 GMT

GET
DATA 200
OK truncated
/ 17 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2295c2992fb02b2ed3f1ec2936a40a709bd8d0de74d4d75eb7d4d6f5de4dbee7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
jsonip.com/ 152 B
453 B 483ms
160ms Script
application/json 2600:3c01::f03c:91ff:fe79:43b
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://jsonip.com/?callback=jQuery30003113623286702889_1624897692965&_=1624897692966

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:3c01::f03c:91ff:fe79:43b Fremont, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

be4dace43854d4ce8b119b29462ac1baeacc3b9b747ab7f2f37ce4081fe4d78f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: https://dougles.com.my/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 16:28:13 GMT
Server: nginx/1.16.1
Strict-Transport-Security: max-age=31536000;
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de172508a0a564c89673e1e2a0f7ddfa2a2a2a65ccda437a8953a525b27ed1e4

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f08a63787130f616d84161d6368af505db34d52efdbe169cbcb12b85cd89af6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b0b473b969b7fbd72d0dd97e34ffee0a155e2899e63adcf567ee0464dd211b08

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dougles.com.my/DEMINGLAW/ofc3/s	1969-12-31 23:59:59	Name: ip11 Value: 2a01:4f8:121:131a::2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
dougles.com.my
jsonip.com
137.59.111.102
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6810:135e
0f08a63787130f616d84161d6368af505db34d52efdbe169cbcb12b85cd89af6
2295c2992fb02b2ed3f1ec2936a40a709bd8d0de74d4d75eb7d4d6f5de4dbee7
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
a24b023eaa4ee356ce7c7a583c23447f351e2d8e6e7c2cc1a48bffe860f0e933
b0b473b969b7fbd72d0dd97e34ffee0a155e2899e63adcf567ee0464dd211b08
be4dace43854d4ce8b119b29462ac1baeacc3b9b747ab7f2f37ce4081fe4d78f
cb0fcc0f09ec5f60b43a4ce77e50666d60b2175b9980e6156f240f9656c47e84
de172508a0a564c89673e1e2a0f7ddfa2a2a2a65ccda437a8953a525b27ed1e4

dougles.com.my Open in urlscan Pro 137.59.111.102 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

94 kBTransfer

348 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

dougles.com.my Open in urlscan Pro
137.59.111.102 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

94 kB
Transfer

348 kB
Size

1
Cookies

4 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!