r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net
Open in
urlscan Pro
52.239.167.113
Malicious Activity!
Public Scan
Effective URL: https://r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net/Error.html
Submission: On February 18 via api from CA
Summary
TLS certificate: Issued by Microsoft IT TLS CA 4 on February 1st 2020. Valid for: 2 years.
This is the only time r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2001:41d0:301... 2001:41d0:301::23 | 16276 (OVH) (OVH) | |
1 | 52.239.167.113 52.239.167.113 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a02:26f0:f1:... 2a02:26f0:f1:186::145b | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 92.123.19.43 92.123.19.43 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2600:9000:214... 2600:9000:214f:fc00:1a:f17d:4240:21 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net |
ASN16625 (AKAMAI-AS, US)
PTR: a92-123-19-43.deploy.static.akamaitechnologies.com
now.symassets.com |
ASN16509 (AMAZON-02, US)
d3pbdh1dmixop.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
cloudfront.net
d3pbdh1dmixop.cloudfront.net |
417 KB |
1 |
symassets.com
now.symassets.com |
4 KB |
1 |
symantec.com
www.symantec.com |
3 KB |
1 |
windows.net
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net |
8 KB |
1 |
lachaisefrancaise.fr
1 redirects
lachaisefrancaise.fr |
325 B |
4 | 5 |
Domain | Requested by | |
---|---|---|
1 | d3pbdh1dmixop.cloudfront.net |
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net
|
1 | now.symassets.com |
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net
|
1 | www.symantec.com |
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net
|
1 | r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net | |
1 | lachaisefrancaise.fr | 1 redirects |
4 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft IT TLS CA 4 |
2020-02-01 - 2022-02-01 |
2 years | crt.sh |
www.symantec.com DigiCert SHA2 Extended Validation Server CA |
2019-09-24 - 2020-07-25 |
10 months | crt.sh |
store.norton.com DigiCert SHA2 Extended Validation Server CA |
2020-01-28 - 2020-06-29 |
5 months | crt.sh |
*.cloudfront.net DigiCert Global CA G2 |
2019-07-17 - 2020-07-05 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net/Error.html
Frame ID: 9627AF0E10E41C25E349712B9DFAD863
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://lachaisefrancaise.fr/modules/graphnvd3/vendor/composer/ss/llc.php?phishing-processor
HTTP 302
https://r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net/Error.html Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Microsoft HTTPAPI (Web Servers) Expand
Detected patterns
- headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://lachaisefrancaise.fr/modules/graphnvd3/vendor/composer/ss/llc.php?phishing-processor
HTTP 302
https://r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net/Error.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Error.html
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net/ Redirect Chain
|
7 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
symantec-logo-top.png
www.symantec.com/content/dam/symantec/images/common/ |
2 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_norton_91x35.png
now.symassets.com/content/dam/clp/global/images/non-product/logos/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Screen%20Shot%202018-09-14%20at%203.48.42%20PM.png
d3pbdh1dmixop.cloudfront.net/spark/Blog/reasons-why-spark-makes-the-best-inbox-by-gmail-alternative/ |
417 KB 417 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d3pbdh1dmixop.cloudfront.net
lachaisefrancaise.fr
now.symassets.com
r02smuo589c89er35l9l732s-secondary.z5.web.core.windows.net
www.symantec.com
2001:41d0:301::23
2600:9000:214f:fc00:1a:f17d:4240:21
2a02:26f0:f1:186::145b
52.239.167.113
92.123.19.43
3af4940f346f8dabd2135647ae9f901ce2b654beb53fbd4dc81b0b0f08ad2cc3
44147f630873eb84ac14e3129a70d39d76c611ee3cefe2b80818771a01e2b8f9
5c3882329f9c08203d823e491e69f63fb7aa8f53f6f80dcc04b34b2b1a2305be
b71c79022578a104cbce78156a019993e7cba2df8a09865a8589e3d1f8205c0d