archive-authenticator-words.us-east-1.linodeobjects.com

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 3 HTTP transactions. The main IP is 2600:3c03::f03c:92ff:fe92:797b, located in Cedar Knolls, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is archive-authenticator-words.us-east-1.linodeobjects.com.
TLS certificate: Issued by R3 on July 28th 2023. Valid for: 3 months.

This is the only time archive-authenticator-words.us-east-1.linodeobjects.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	63.148.46.72 63.148.46.72	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
1	102.130.125.52 102.130.125.52	328364 (Host-Afri...) (Host-Africa-AS)
1	2600:3c03::f0... 2600:3c03::f03c:92ff:fe92:797b	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	194.59.183.61 194.59.183.61	16276 (OVH) (OVH)
3	4

1 63.148.46.72 (United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)
PTR: rts.eccmp.com

l.billing01.email-allstate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 102.130.125.52 (Cape Town, South Africa)

ASN328364 (Host-Africa-AS, ZA)
PTR: wp15.host-ww.net

continentalsports.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:3c03::f03c:92ff:fe92:797b (Cedar Knolls, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)

archive-authenticator-words.us-east-1.linodeobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.59.183.61 (Limburg an der Lahn, Germany)

ASN16276 (OVH, FR)
PTR: blv31.salarymgmtreports.com

edoc-signature.hydrafabsnw.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	hydrafabsnw.com edoc-signature.hydrafabsnw.com	129 KB
1	linodeobjects.com archive-authenticator-words.us-east-1.linodeobjects.com	143 KB
1	continentalsports.co.za continentalsports.co.za	580 B
1	email-allstate.com 1 redirects l.billing01.email-allstate.com — Cisco Umbrella Rank: 493275	366 B
3	4

	Domain	Requested by
1	edoc-signature.hydrafabsnw.com	archive-authenticator-words.us-east-1.linodeobjects.com
1	archive-authenticator-words.us-east-1.linodeobjects.com	continentalsports.co.za
1	continentalsports.co.za
1	l.billing01.email-allstate.com	1 redirects
3	4

This site contains no links.

Subject Issuer	Validity	Valid
mail.jscaservices.com R3	`2023-09-13` - `2023-12-12`	3 months	crt.sh
us-east-1.linodeobjects.com R3	`2023-07-28` - `2023-10-26`	3 months	crt.sh
hydrafabsnw.com R3	`2023-09-11` - `2023-12-10`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://archive-authenticator-words.us-east-1.linodeobjects.com/arcade.html
Frame ID: DEA0B82773C49B8BB3F134B45C78AC83
Requests: 2 HTTP requests in this frame

Frame: https://edoc-signature.hydrafabsnw.com/?Pp=LW&username=%2525
Frame ID: 08F30FE758E6500ADAD14AAA11CE517C
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://l.billing01.email-allstate.com/rts/go2.aspx?h=813395&tp=i-1NHD-A2-VhS-33P9Mu-2T-4OCJp-1c-KMG2-332gCa-l9CyBV... HTTP 302
https://continentalsports.co.za/global/as/ Page URL
https://archive-authenticator-words.us-east-1.linodeobjects.com/arcade.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

272 kB
Transfer

502 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://l.billing01.email-allstate.com/rts/go2.aspx?h=813395&tp=i-1NHD-A2-VhS-33P9Mu-2T-4OCJp-1c-KMG2-332gCa-l9CyBV64dS-iEzH7&x=continentalsports.co.za/global/as%2F&cf=4298&v=31ebe097239187e288f9c2997cadf34ce2fea7527bc2fd8777824234934c98d9 HTTP 302
https://continentalsports.co.za/global/as/ Page URL
https://archive-authenticator-words.us-east-1.linodeobjects.com/arcade.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://l.billing01.email-allstate.com/rts/go2.aspx?h=813395&tp=i-1NHD-A2-VhS-33P9Mu-2T-4OCJp-1c-KMG2-332gCa-l9CyBV64dS-iEzH7&x=continentalsports.co.za/global/as%2F&cf=4298&v=31ebe097239187e288f9c2997cadf34ce2fea7527bc2fd8777824234934c98d9 HTTP 302
https://continentalsports.co.za/global/as/

3 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

/
continentalsports.co.za/global/as/
Redirect Chain

http://l.billing01.email-allstate.com/rts/go2.aspx?h=813395&tp=i-1NHD-A2-VhS-33P9Mu-2T-4OCJp-1c-KMG2-332gCa-l9CyBV64dS-iEzH7&x=continentalsports.co.za/global/as%2F&cf=4298&v=31ebe097239187e288f9c29...
https://continentalsports.co.za/global/as/

447 B
580 B

5116ms
1173ms

Document
text/html

102.130.125.52
Host-Africa-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://continentalsports.co.za/global/as/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 102.130.125.52 Cape Town, South Africa, ASN328364 (Host-Africa-AS, ZA),
Reverse DNS: wp15.host-ww.net
Software: LiteSpeed / PHP/7.4.33
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: br
content-length: 206
content-type: text/html; charset=UTF-8
date: Wed, 13 Sep 2023 14:49:48 GMT
expires: Wed, 11 Jan 1984 05:00:00 GMT
link: <https://continentalsports.co.za/global/wp-json/>; rel="https://api.w.org/"
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.4.33

Redirect headers

Cache-Control: private
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Wed, 13 Sep 2023 14:49:42 GMT
Location: https://continentalsports.co.za/global/as/
Server
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Powered-By

GET
H/1.1 200
OK Primary Request arcade.html Show response
archive-authenticator-words.us-east-1.linodeobjects.com/ 142 KB
143 KB 1130ms
371ms Document
text/html 2600:3c03::f03c:92ff:fe92:797b
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://archive-authenticator-words.us-east-1.linodeobjects.com/arcade.html
Requested by: Host: continentalsports.co.za
URL: https://continentalsports.co.za/global/as/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe92:797b Cedar Knolls, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
Software: /
Resource Hash: 3b941140467dd46157a74518ecf427a17fcf89011f2e0e2b8eb20db5514e91fb

Request headers

Referer: https://continentalsports.co.za/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Length: 145797
Content-Type: text/html
Date: Wed, 13 Sep 2023 14:49:49 GMT
ETag: "a5f0a3da9011f295a9182fa929d2fbdd"
Last-Modified: Tue, 12 Sep 2023 16:36:00 GMT
x-amz-request-id: tx00000a1f1beb284792a66-006501cc0d-485dec0d-default
x-rgw-object-type: Normal

GET
H2 200 / Show response
edoc-signature.hydrafabsnw.com/ Frame 08F3 318 KB
129 KB 313ms
201ms Document
text/html 194.59.183.61
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://edoc-signature.hydrafabsnw.com/?Pp=LW&username=%2525

Requested by

Host: archive-authenticator-words.us-east-1.linodeobjects.com
URL: https://archive-authenticator-words.us-east-1.linodeobjects.com/arcade.html

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

194.59.183.61 Limburg an der Lahn, Germany, ASN16276 (OVH, FR),

Reverse DNS

blv31.salarymgmtreports.com

Software

nginx /

Resource Hash

ff7eb771c4f98b6a44e54ca079b1c30882ba34b80a797df2fb0f43681b6c19f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://archive-authenticator-words.us-east-1.linodeobjects.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 13 Sep 2023 14:49:51 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 08F3 858 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ Frame 08F3 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| a0_0x14d1 function| a0_0x207f

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			l.billing01.email-allstate.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: iw0f55mwyfb5tdt5t4lwjzc4

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://continentalsports.co.za/global/as/#%25##base64email##%25 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

archive-authenticator-words.us-east-1.linodeobjects.com
continentalsports.co.za
edoc-signature.hydrafabsnw.com
l.billing01.email-allstate.com
102.130.125.52
194.59.183.61
2600:3c03::f03c:92ff:fe92:797b
63.148.46.72
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
3b941140467dd46157a74518ecf427a17fcf89011f2e0e2b8eb20db5514e91fb
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
ff7eb771c4f98b6a44e54ca079b1c30882ba34b80a797df2fb0f43681b6c19f7

archive-authenticator-words.us-east-1.linodeobjects.com Open in urlscan Pro 2600:3c03::f03c:92ff:fe92:797b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

272 kBTransfer

502 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

archive-authenticator-words.us-east-1.linodeobjects.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe92:797b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

272 kB
Transfer

502 kB
Size

1
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!