![](/screenshots/370ba56f-f656-4cfe-b1e8-4bc6e9c42b45.png)
hebrondigs.top
Open in
urlscan Pro
104.18.33.26
Malicious Activity!
Public Scan
Submission: On June 06 via automatic, source openphish
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on June 5th 2018. Valid for: 6 months.
This is the only time hebrondigs.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 104.18.33.26 104.18.33.26 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 2.19.41.58 2.19.41.58 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
10 | 3 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
hebrondigs.top |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-41-58.deploy.static.akamaitechnologies.com
auth.gfx.ms |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
hebrondigs.top
hebrondigs.top |
27 KB |
2 |
gfx.ms
auth.gfx.ms |
293 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
10 | 3 |
Domain | Requested by | |
---|---|---|
6 | hebrondigs.top |
hebrondigs.top
|
2 | auth.gfx.ms |
hebrondigs.top
|
0 | gppongmhjkpfnbhagpmjfkannfbllamg Failed |
hebrondigs.top
|
0 | akdgnmcogleenhbclghghlkkdndkjdjc Failed |
hebrondigs.top
|
10 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.google.com |
www.semrush.com |
www.bing.com |
www.alexa.com |
web.archive.org |
www.facebook.com |
plusone.google.com |
whois.domaintools.com |
login.live.com |
account.live.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni249050.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-06-05 - 2018-12-12 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://hebrondigs.top/ydu/auth.php
Frame ID: E60A1D86CE4A81EB2401410FE84FEA62
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/370ba56f-f656-4cfe-b1e8-4bc6e9c42b45.png)
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /cloudflare/i
Page Statistics
13 Outgoing links
These are links going to different origins than the main page.
Title: 39
Search URL Search Domain Scan URL
Title: 0
Search URL Search Domain Scan URL
Title: 6.63M
Search URL Search Domain Scan URL
Title: 9
Search URL Search Domain Scan URL
Title: 113K
Search URL Search Domain Scan URL
Title: 1996|12|20
Search URL Search Domain Scan URL
Title: 0
Search URL Search Domain Scan URL
Title: n/a
Search URL Search Domain Scan URL
Title: whois
Search URL Search Domain Scan URL
Title: Site auditn/a
Search URL Search Domain Scan URL
Title: Forgot my password
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
auth.php
hebrondigs.top/ydu/ |
32 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Converged1033.css
hebrondigs.top/ydu/auth_files/ |
86 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
seoquake-icon.svg
akdgnmcogleenhbclghghlkkdndkjdjc/static/svg/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
inject.js
gppongmhjkpfnbhagpmjfkannfbllamg/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
auth.gfx.ms/16.000.27683.1/images/Backgrounds/ |
291 KB 291 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-small.jpg
auth.gfx.ms/16.000.27683.1/images/Backgrounds/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo.svg
hebrondigs.top/ydu/auth_files/ |
4 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
picker_account_msa.svg
hebrondigs.top/ydu/auth_files/ |
379 B 311 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ellipsis_white.svg
hebrondigs.top/ydu/auth_files/ |
915 B 320 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ellipsis_grey.svg
hebrondigs.top/ydu/auth_files/ |
915 B 354 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- akdgnmcogleenhbclghghlkkdndkjdjc
- URL
- chrome-extension://akdgnmcogleenhbclghghlkkdndkjdjc/static/svg/seoquake-icon.svg
- Domain
- gppongmhjkpfnbhagpmjfkannfbllamg
- URL
- chrome-extension://gppongmhjkpfnbhagpmjfkannfbllamg/js/inject.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| PROOF1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.hebrondigs.top/ | Name: __cfduid Value: d21006c9a4ef9ab912eed1d740f20e4161528300728 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
akdgnmcogleenhbclghghlkkdndkjdjc
auth.gfx.ms
gppongmhjkpfnbhagpmjfkannfbllamg
hebrondigs.top
akdgnmcogleenhbclghghlkkdndkjdjc
gppongmhjkpfnbhagpmjfkannfbllamg
104.18.33.26
2.19.41.58
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
242109d9414e834b4f5182329678c2ea43a7d7a660d7e75ab4d7c9f6e67650a4
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
95305497963577e3dd32ed456a961c695f11b167a3d8baaef5d52349cd06c899
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b