komalshreealuminiumsales.com
Open in
urlscan Pro
216.10.250.244
Malicious Activity!
Public Scan
Effective URL: http://komalshreealuminiumsales.com/of4/login.php?ss=2&ea=46a63756c6c656e407073752e656475
Submission: On July 21 via manual from US
Summary
This is the only time komalshreealuminiumsales.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 18.228.178.86 18.228.178.86 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 173.0.63.30 173.0.63.30 | 32875 (VIRP) (VIRP) | |
1 6 | 216.10.250.244 216.10.250.244 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
2 | 2a02:26f0:dc:... 2a02:26f0:dc:2bb::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
7 | 2 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-228-178-86.sa-east-1.compute.amazonaws.com
nt.embluemail.com |
ASN20940 (AKAMAI-ASN1, NL)
secure.aadcdn.microsoftonline-p.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
komalshreealuminiumsales.com
1 redirects
komalshreealuminiumsales.com |
125 KB |
2 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
162 KB |
1 |
honosglobalcorp.com
1 redirects
psu.honosglobalcorp.com |
308 B |
1 |
embluemail.com
1 redirects
nt.embluemail.com |
220 B |
7 | 4 |
Domain | Requested by | |
---|---|---|
6 | komalshreealuminiumsales.com |
1 redirects
komalshreealuminiumsales.com
|
2 | secure.aadcdn.microsoftonline-p.com |
komalshreealuminiumsales.com
|
1 | psu.honosglobalcorp.com | 1 redirects |
1 | nt.embluemail.com | 1 redirects |
7 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
secure.aadcdn.microsoftonline-p.com Microsoft RSA TLS CA 01 |
2020-12-22 - 2021-12-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://komalshreealuminiumsales.com/of4/login.php?ss=2&ea=46a63756c6c656e407073752e656475
Frame ID: 232A04680CDF1AA6E58B189C3649857C
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://nt.embluemail.com/p/cl?data=http://psu.honosglobalcorp.com//46a63756c6c656e407073752e656475
HTTP 302
http://psu.honosglobalcorp.com//46a63756c6c656e407073752e656475 HTTP 302
http://komalshreealuminiumsales.com/of4/index?ss=2&ea=46a63756c6c656e407073752e656475 HTTP 302
http://komalshreealuminiumsales.com/of4/login.php?ss=2&ea=46a63756c6c656e407073752e656475 Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nt.embluemail.com/p/cl?data=http://psu.honosglobalcorp.com//46a63756c6c656e407073752e656475
HTTP 302
http://psu.honosglobalcorp.com//46a63756c6c656e407073752e656475 HTTP 302
http://komalshreealuminiumsales.com/of4/index?ss=2&ea=46a63756c6c656e407073752e656475 HTTP 302
http://komalshreealuminiumsales.com/of4/login.php?ss=2&ea=46a63756c6c656e407073752e656475 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
komalshreealuminiumsales.com/of4/ Redirect Chain
|
15 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en.js
komalshreealuminiumsales.com/of4/files/ |
8 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Converged1033.css
komalshreealuminiumsales.com/of4/files/ |
99 KB 100 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-idejoskpwj2t4lanht5to2xxqnmeh-q24bix5r4mhm/logintenantbranding/0/ |
4 KB 4 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
arrow_left.png
komalshreealuminiumsales.com/of4/files/ |
240 B 482 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1-small.jpg
komalshreealuminiumsales.com/of4/files2/ |
987 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
illustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-idejoskpwj2t4lanht5to2xxqnmeh-q24bix5r4mhm/logintenantbranding/0/ |
157 KB 158 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Aes object| Base64 object| Utf8 string| OfwRTiQWpY string| wtDQsGrUxJ string| DATPEIFXMC string| ctrTxt function| empty function| change function| myFunction2 function| myFunction object| form object| button0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
komalshreealuminiumsales.com
nt.embluemail.com
psu.honosglobalcorp.com
secure.aadcdn.microsoftonline-p.com
173.0.63.30
18.228.178.86
216.10.250.244
2a02:26f0:dc:2bb::35c1
1016f747743af262263e1458e01ea612da22c2c65379531d4d1eace1e15cb3f0
6369118b817a8a0549092cce8b77d77ac7ec88cc76a66d3ed9e32e9c4f6fb23f
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
9e02a2e150d7f401a095de4d5918e3b574043253bf9516a5a8e016a7d1db2d5a
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
ace7ccfd89c0acb291a2944b82b27506ebb50580efa196781dd218b8c47d46ae
c7813d74ea586bd46be064ae15384fcb9f3a2279cc108adf711d8fa8ea523435