mailer-daemon.net Open in urlscan Pro
162.0.232.252 Malicious Activity! Unlisted Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://url.emailprotection.link/?bOWmKwU9RQAIB5atacov0Fm1Y2ZtJE6kCohLLnuNyHXs2Pls3xxiCILm-280C61Wk1PvSAa_x7Px1kaHCYqb4Vxxmi-e_6p...
Effective URL:
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Submission: On November 03 via manual (November 3rd 2022, 8:27:03 am UTC) from AE — Scanned from DE

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 162.0.232.252, located in United States and belongs to NAMECHEAP-NET, US. The main domain is mailer-daemon.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 11th 2022. Valid for: a year.

This is the only time mailer-daemon.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	64.78.56.115 64.78.56.115	16406 (AS-INTERM...) (AS-INTERMEDIA)
6	162.0.232.252 162.0.232.252	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
5	2.16.238.134 2.16.238.134	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	4

1 64.78.56.115 (United States) 1 redirects

ASN16406 (AS-INTERMEDIA, US)
PTR: intermedia.net

url.emailprotection.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 162.0.232.252 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server290-4.web-hosting.com

mailer-daemon.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.16.238.134 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-238-134.deploy.static.akamaitechnologies.com

spoprod-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	mailer-daemon.net mailer-daemon.net	297 KB
5	akamaihd.net spoprod-a.akamaihd.net — Cisco Umbrella Rank: 15123	166 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 447	30 KB
1	emailprotection.link 1 redirects url.emailprotection.link — Cisco Umbrella Rank: 249248	237 B
12	4

	Domain	Requested by
6	mailer-daemon.net	mailer-daemon.net
5	spoprod-a.akamaihd.net	mailer-daemon.net
1	ajax.googleapis.com	mailer-daemon.net
1	url.emailprotection.link	1 redirects
12	4

This site contains links to these domains. Also see Links.

Domain
account.live.com

Subject Issuer	Validity	Valid
mailer-daemon.net Sectigo RSA Domain Validation Secure Server CA	`2022-10-11` - `2023-10-11`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-26` - `2022-12-19`	3 months	crt.sh
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1	`2022-06-28` - `2023-06-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Frame ID: ADEBABC0468534F928AD22CC38FB52B1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OneDrive

Page URL History Show full URLs

https://url.emailprotection.link/?bOWmKwU9RQAIB5atacov0Fm1Y2ZtJE6kCohLLnuNyHXs2Pls3xxiCILm-280C61Wk1PvSAa_x7P... HTTP 302
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/ Page URL
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/continue-to-settings.php Page URL
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/index1.php Page URL
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

493 kB
Transfer

1324 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1526366266%26rver%3d6.7.6643.0%26wp%3dMBI_SSL%26wreply%3dhttps:%252f%252faccount.microsoft.com%252fauth%252fcomplete-signin%253fru%253dhttps%25253a%25252f%25252faccount.microsoft.com%25252f%25253frefd%25253daccount.microsoft.com%252526ru%25253dhttps%2525253a%2525252f%2525252faccount.microsoft.com%2525252f%2525253frefd%2525253dlogin.live.com%252526destrt%25253dhome-index%252526refp%25253dsignedout-index%26lc%3d1033%26id%3d292666%26lw%3d1%26fl%3deasi2%26uaid%3dd533aaa96d254feabe5fbe55f190c733%26pid%3d0%26contextid%3dE9E93781B5AD88A0%26bk%3d1526366283&id=292666&uiflavor=web&cobrandid=140713607675816&uaid=d533aaa96d254feabe5fbe55f190c733&mkt=EN-US&lc=1033&bk=1526366283
Title: Forgot my code

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://url.emailprotection.link/?bOWmKwU9RQAIB5atacov0Fm1Y2ZtJE6kCohLLnuNyHXs2Pls3xxiCILm-280C61Wk1PvSAa_x7Px1kaHCYqb4Vxxmi-e_6plDIEDnuNL6KCXkzEpQ4TUVEjcNLQnRwX6d HTTP 302
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/ Page URL
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/continue-to-settings.php Page URL
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/index1.php Page URL
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://url.emailprotection.link/?bOWmKwU9RQAIB5atacov0Fm1Y2ZtJE6kCohLLnuNyHXs2Pls3xxiCILm-280C61Wk1PvSAa_x7Px1kaHCYqb4Vxxmi-e_6plDIEDnuNL6KCXkzEpQ4TUVEjcNLQnRwX6d HTTP 302
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/

12 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
mailer-daemon.net/file=sharing=system/file.id.3=s22412369/
Redirect Chain

https://url.emailprotection.link/?bOWmKwU9RQAIB5atacov0Fm1Y2ZtJE6kCohLLnuNyHXs2Pls3xxiCILm-280C61Wk1PvSAa_x7Px1kaHCYqb4Vxxmi-e_6plDIEDnuNL6KCXkzEpQ4TUVEjcNLQnRwX6d
https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/

68 B
227 B

708ms
192ms

Document
text/html

162.0.232.252
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server290-4.web-hosting.com
Software: LiteSpeed / PHP/7.4.32
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-length: 60
content-type: text/html; charset=UTF-8
date: Thu, 03 Nov 2022 08:26:56 GMT
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.4.32
x-turbo-charged-by: LiteSpeed

Redirect headers

Connection: keep-alive
Content-Length: 10
Content-Type: text/plain; charset=utf-8
Date: Thu, 03 Nov 2022 08:26:55 GMT
Location: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/
Server: nginx

GET
H2 200 continue-to-settings.php
mailer-daemon.net/file=sharing=system/file.id.3=s22412369/ 54 B
221 B 174ms
174ms Document
text/html 162.0.232.252
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/continue-to-settings.php
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server290-4.web-hosting.com
Software: LiteSpeed / PHP/7.4.32
Resource Hash

Request headers

Referer: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-length: 54
content-type: text/html; charset=UTF-8
date: Thu, 03 Nov 2022 08:26:56 GMT
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.4.32
x-turbo-charged-by: LiteSpeed

GET
H2 200 index1.php
mailer-daemon.net/file=sharing=system/file.id.3=s22412369/ 60 B
225 B 185ms
185ms Document
text/html 162.0.232.252
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/index1.php
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/continue-to-settings.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server290-4.web-hosting.com
Software: LiteSpeed / PHP/7.4.32
Resource Hash

Request headers

Referer: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/continue-to-settings.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-length: 58
content-type: text/html; charset=UTF-8
date: Thu, 03 Nov 2022 08:26:56 GMT
server: LiteSpeed
vary: Accept-Encoding
x-powered-by: PHP/7.4.32
x-turbo-charged-by: LiteSpeed

GET
H2 200 Primary Request first.check.html Show response
mailer-daemon.net/file=sharing=system/file.id.3=s22412369/ 426 KB
295 KB 165ms
165ms Document
text/html 162.0.232.252
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/index1.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server290-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 7238bf17f09798e69a2fa223e73e20f82bef021208fb5544370b0a9afe85510f

Request headers

Referer: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/index1.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 301731
content-type: text/html
date: Thu, 03 Nov 2022 08:26:56 GMT
last-modified: Wed, 02 Nov 2022 14:24:22 GMT
server: LiteSpeed
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 85 KB
30 KB 32ms
8ms Script
text/javascript 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date: Thu, 03 Nov 2022 06:39:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6450
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30306
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 03 Nov 2023 06:39:26 GMT

GET
H2 200 maincss-aec76c77.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001// 136 KB
25 KB 262ms
214ms Stylesheet
text/css 2.16.238.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001//maincss-aec76c77.css
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.238.134 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-238-134.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 446332e8c993ca5c57c1ec267b71675c4c9e4f72ba3ae4b4aa0468f4e683a0fa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Nov 2022 08:26:57 GMT
content-encoding: gzip
content-md5: rsdsd6WYhfyy0BwEMRimWg==
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 25469
x-ms-lease-status: unlocked
last-modified: Tue, 23 Jan 2018 20:18:35 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5629E7B551A53
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: ef34ce27-d01e-0084-3d5e-eff42c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31296874
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 jquery-1.7.2-39eeb07e.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/ 92 KB
33 KB 52ms
45ms Script
application/javascript 2.16.238.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/jquery-1.7.2-39eeb07e.js
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.238.134 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-238-134.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Nov 2022 08:26:57 GMT
content-encoding: gzip
content-md5: Oe6wfmgC4rV/XhCprZvKJA==
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 33335
x-ms-lease-status: unlocked
last-modified: Tue, 23 Jan 2018 20:18:35 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5629E7B455FF8
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f911fe04-701e-0069-56af-ebbf61000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=30892049
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 legacy_s_legacy-0f159289.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/ 49 KB
17 KB 25ms
25ms Script
application/javascript 2.16.238.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/legacy_s_legacy-0f159289.js
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.238.134 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-238-134.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 39db86fe6a7793f60aec27cfd27f88a57150c64b58111ff74788504942a80e94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Nov 2022 08:26:57 GMT
content-encoding: gzip
content-md5: DxWSiYU/qC+20VWOVfKrIg==
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 16422
x-ms-lease-status: unlocked
last-modified: Tue, 23 Jan 2018 20:18:22 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5629E735D17A9
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 767f307e-601e-0028-12af-ebe785000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=30891968
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 legacy1-1a09fb82.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/ 240 KB
84 KB 43ms
43ms Script
application/javascript 2.16.238.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/legacy1-1a09fb82.js
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.238.134 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-238-134.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 771d5c4a06a1573da9c0fb15fedc1b8bf2219dca348887c344843077a76dd803

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Nov 2022 08:26:57 GMT
content-encoding: gzip
content-md5: Ggn7gueKPiHpfZ+v/jXjxw==
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
x-ms-lease-status: unlocked
last-modified: Tue, 23 Jan 2018 20:18:22 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5629E7382F5FC
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: feea3e36-301e-000a-0acb-e2229a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29914785
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 legacy0-e2cc9701.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/ 15 KB
6 KB 18ms
18ms Script
application/javascript 2.16.238.134
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180123.001/legacy0-e2cc9701.js
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.238.134 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-238-134.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 7fb28d1f6c9f57439eb0e83e6b99857ce792a3874ff3a35e6dbe912692d0e9df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 03 Nov 2022 08:26:57 GMT
content-encoding: gzip
content-md5: 4syXAQmhJXn2OCLqkfbg6Q==
alt-svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
content-length: 6058
x-ms-lease-status: unlocked
last-modified: Tue, 23 Jan 2018 20:18:21 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5629E731E2E94
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5dffbbee-c01e-0053-2ecb-e2a519000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29914676
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 404 clientstring.mvc
mailer-daemon.net/handlers/ 0
0 419ms
419ms Script
text/html 162.0.232.252
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mailer-daemon.net/handlers/clientstring.mvc?mkt=en-US&group=wlive&v=19.104.0406.2021&useRequiresJs=False
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server290-4.web-hosting.com
Software: LiteSpeed /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 03 Nov 2022 08:26:57 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
server: LiteSpeed
content-length: 1238
content-type: text/html

POST
H2 404 log Show response
mailer-daemon.net/ 1 KB
1 KB 171ms
171ms XHR
text/html 162.0.232.252
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://mailer-daemon.net/log
Requested by: Host: mailer-daemon.net
URL: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.252 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server290-4.web-hosting.com
Software: LiteSpeed /
Resource Hash: 5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Request headers

Referer: https://mailer-daemon.net/file=sharing=system/file.id.3=s22412369/first.check.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 03 Nov 2022 08:26:57 GMT
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
x-turbo-charged-by: LiteSpeed
server: LiteSpeed
content-length: 1238
content-type: text/html

GET
DATA 200
OK truncated
/ 277 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e62a83111370532c278d9eef252015ee09cce842c2362aa1f76dc393b501609

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

Content-Type: image/jpeg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

43 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mailer-daemon.net/handlers/clientstring.mvc?mkt=en-US&group=wlive&v=19.104.0406.2021&useRequiresJs=False Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://mailer-daemon.net/log Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
mailer-daemon.net
spoprod-a.akamaihd.net
url.emailprotection.link
162.0.232.252
2.16.238.134
2a00:1450:4001:813::200a
64.78.56.115
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
39db86fe6a7793f60aec27cfd27f88a57150c64b58111ff74788504942a80e94
3e62a83111370532c278d9eef252015ee09cce842c2362aa1f76dc393b501609
446332e8c993ca5c57c1ec267b71675c4c9e4f72ba3ae4b4aa0468f4e683a0fa
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807
7238bf17f09798e69a2fa223e73e20f82bef021208fb5544370b0a9afe85510f
771d5c4a06a1573da9c0fb15fedc1b8bf2219dca348887c344843077a76dd803
7fb28d1f6c9f57439eb0e83e6b99857ce792a3874ff3a35e6dbe912692d0e9df
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f

mailer-daemon.net Open in urlscan Pro 162.0.232.252 Malicious Activity! Unlisted Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

493 kBTransfer

1324 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

43 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

mailer-daemon.net Open in urlscan Pro
162.0.232.252 Malicious Activity! Unlisted Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

493 kB
Transfer

1324 kB
Size

0
Cookies

12 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!