pyta365.hablif.live
Open in
urlscan Pro
63.250.45.182
Malicious Activity!
Public Scan
Submitted URL: https://protect-eu.mimecast.com/s/NKh4Cv8JmFrnOL4UQPuDD?domain=pyta365.hablif.live
Effective URL: https://pyta365.hablif.live/tempfile/0c5ed75444/login.php?SesIN=63286febdd22052b0f7cef9930948d0f&f=0c5ed75444&session=161113...
Submission: On January 20 via manual from GB
Effective URL: https://pyta365.hablif.live/tempfile/0c5ed75444/login.php?SesIN=63286febdd22052b0f7cef9930948d0f&f=0c5ed75444&session=161113...
Submission: On January 20 via manual from GB
Summary
This website contacted 2 IPs
in 3 countries
across 3 domains to perform 9 HTTP transactions.
The main IP is 63.250.45.182, located in
Los Angeles, United States and
belongs to NAMECHEAP-NET, US.
The main domain is pyta365.hablif.live.
TLS certificate: Issued by R3 on January 20th 2021. Valid for: 3 months.
This is the only time pyta365.hablif.live was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 20th 2021. Valid for: 3 months.
This is the only time pyta365.hablif.live was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 2 | 91.220.42.235 91.220.42.235 | 42427 (MIMECAST-UK) (MIMECAST-UK) | |
| 2 10 | 63.250.45.182 63.250.45.182 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
| 9 | 2 |
2
91.220.42.235
(United Kingdom)
ASN42427 (MIMECAST-UK, GB)
PTR: eu-api.mimecast.com
ASN42427 (MIMECAST-UK, GB)
PTR: eu-api.mimecast.com
| protect-eu.mimecast.com |
10
63.250.45.182
(Los Angeles, United States)
ASN22612 (NAMECHEAP-NET, US)
PTR: svr.dks-server3.tech
ASN22612 (NAMECHEAP-NET, US)
PTR: svr.dks-server3.tech
| pyta365.hablif.live |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
hablif.live
2 redirects
pyta365.hablif.live |
129 KB |
| 2 |
mimecast.com
2 redirects
protect-eu.mimecast.com |
1 KB |
| 1 |
jquery.com
code.jquery.com |
33 KB |
| 9 | 3 |
| Domain | Requested by | |
|---|---|---|
| 10 | pyta365.hablif.live |
2 redirects
pyta365.hablif.live
|
| 2 | protect-eu.mimecast.com | 2 redirects |
| 1 | code.jquery.com |
pyta365.hablif.live
|
| 9 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| www.pyta365.hablif.live R3 |
2021-01-20 - 2021-04-20 |
3 months | crt.sh |
| jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pyta365.hablif.live/tempfile/0c5ed75444/login.php?SesIN=63286febdd22052b0f7cef9930948d0f&f=0c5ed75444&session=1611135128
Frame ID: 23C4A066BC46DC86AE9E8C8DEF90985E
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://protect-eu.mimecast.com/s/NKh4Cv8JmFrnOL4UQPuDD?domain=pyta365.hablif.live
HTTP 307
https://protect-eu.mimecast.com/redirect/eNpVUmmL2zAQ_StBn2NFh2VboZQc3Sy0OXa9XWhLwMiy4njjC0le2i397x2ngbYIgTT... HTTP 307
https://pyta365.hablif.live/ HTTP 302
https://pyta365.hablif.live/tempfile/0c5ed75444/ HTTP 302
https://pyta365.hablif.live/tempfile/0c5ed75444/login.php?SesIN=63286febdd22052b0f7cef9930948d0f&f=0c5ed... Page URL
Detected technologies
UNIX
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Unix/i
OpenSSL
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://protect-eu.mimecast.com/s/NKh4Cv8JmFrnOL4UQPuDD?domain=pyta365.hablif.live
HTTP 307
https://protect-eu.mimecast.com/redirect/eNpVUmmL2zAQ_StBn2NFh2VboZQc3Sy0OXa9XWhLwMiy4njjC0le2i397x2ngbYIgTTz5o3mPf1EVvcezVGj7AWXVp1Vs7Au0F3Td61pvcNwRFNUdxrNyRRZo03Ve181Bs1pRCnlXPCEkDEHRGyKjKuKMccZCQkRfIp84_ddAQWIEApkVQ_HkGBKYtg4YRBrXDmWoXfb_ZcHyvhuRZMoWq1kGCUyWW6iiGyEYHxDV3TJyOI_GL5fpeMNP6SHD_jw_Hl7OHzC68PuPTD3I6_g8MDB1tDh7H3v5sfZcdb_8IpHAp9VXlcnXFevBvBm1KPMdGCy4UJoJmT2WggZUJKthVhSGWeMMEpgZVQCxhvbyABGC2gsZRjGMk6AJ3doHlIQpFegHbrVQkLpscP6bPTlOd1CoByuo0dvXzvzMU327Cl82qX19_Q-iR8hrwfnu8ZY_UfEv0yuUe4MEUYk1_GJS6ajRLAoL5giihaa0PyUCx5qwQzh46tcW1iosF1pLH4Bj91CvdW-AJ_xcEGjw2XVtQDpbeeN9oEZcAN2a-X87TO4IX8BwN0ueKTH2WQZfJvctWXVGmOrtpxsfYGupu-6oR0Hu0l01UT_q8Wv39jut3I HTTP 307
https://pyta365.hablif.live/ HTTP 302
https://pyta365.hablif.live/tempfile/0c5ed75444/ HTTP 302
https://pyta365.hablif.live/tempfile/0c5ed75444/login.php?SesIN=63286febdd22052b0f7cef9930948d0f&f=0c5ed75444&session=1611135128 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
pyta365.hablif.live/tempfile/0c5ed75444/ Redirect Chain
|
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
converged.v2.login.min.css
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
106 KB 106 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-1.11.1.min.js
code.jquery.com/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.svg
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow_left.svg
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
513 B 819 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis.svg
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
900 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ellipsis_grey.svg
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
915 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
postscript.js
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.svg
pyta365.hablif.live/tempfile/0c5ed75444/assets/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| ajaxObj function| ajaxReturn function| emptyElement object| input function| next function| back function| signup0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
protect-eu.mimecast.com
pyta365.hablif.live
2001:4de0:ac19::1:b:3b
63.250.45.182
91.220.42.235
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
4564bb43da3facb3a12c305289c3ff7d4303e8f8415c1a64fbcadfe253aef64d
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
61d7ccc5d2c41bf86be6cefb0063405067849ba64e9f219f60596ef09a54a942
a96b2b12489a80eafe62cc4bcc04cb367e2b54efc3039e484211c7deec12c0b8
d6e4edef81f555b9e0f0a946c21bcf480c5e5f05d180d2c94de8497387c6ad68