umair.com Open in urlscan Pro
185.162.89.65  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response umair.com/	8 KB 3 KB	1425ms 259ms	Document text/html	185.162.89.65 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://umair.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.162.89.65 , Netherlands, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS sv402.hostbudget.net Software / Resource Hash 23a9fe43d817c861e036254939e9130b2f8fbf4c35042de186f6c2ffc016e788 Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 2466 content-type text/html; charset=UTF-8 date Tue, 18 Jun 2024 18:58:29 GMT vary Accept-Encoding
GET H2	200	jquery-1.12.4.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	95 KB 33 KB	73ms 16ms	Script application/javascript	152.199.19.160 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.4.min.js Requested by Host: umair.com URL: https://umair.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.19.160 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ama/48AC) / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://umair.com/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 18 Jun 2024 18:58:29 GMT content-encoding gzip x-content-type-options nosniff age 7482172 x-cache HIT content-length 33835 x-xss-protection 1; mode=block last-modified Mon, 31 Oct 2016 23:10:52 GMT server ECAcc (ama/48AC) etag "0e6586cc33d21:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	404	authentication.css umair.com/	0 0	155ms 154ms	Stylesheet text/html	185.162.89.65 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL https://umair.com/authentication.css Requested by Host: umair.com URL: https://umair.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.162.89.65 , Netherlands, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS sv402.hostbudget.net Software / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://umair.com/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Tue, 18 Jun 2024 18:58:29 GMT cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 708 content-type text/html
GET H2	200	10682_hires_logo.png www.brimg.net/system/img/inst/	9 KB 10 KB	178ms 103ms	Image image/png	151.101.129.132 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://www.brimg.net/system/img/inst/10682_hires_logo.png Requested by Host: umair.com URL: https://umair.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.129.132 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash f349fe8552c382ae40ed992e01ef32291b871fc0a1e542bd8fc4217bb1b45b32 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://umair.com/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id 0Ru0RjESK18bCTQIZkaG72Xg92JWGuPs via 1.1 varnish, 1.1 varnish date Tue, 18 Jun 2024 18:58:29 GMT fastly-io-served-by vpop-kiad7010250 x-amz-request-id P0YKQGAN6QCJ2K1Y age 26319 x-cache HIT, HIT fastly-io-info ifsz=10401 idim=200x50 ifmt=png ofsz=9405 odim=200x50 ofmt=png fastly-stats io=1 content-length 9405 x-amz-id-2 g7DXSuRvdHu09Txwa8FvJ6alD16ZFZwACS6BrnM9N840Dqt2Gd5ZicBtGPRELVbTxe9zgSO7m7M= x-served-by cache-iad-kjyo7100124-IAD, cache-bru1480056-BRU server AmazonS3 x-timer S1718737109.282346,VS0,VE85 etag "wOqNPOVL+pNUqX3h9Q+1hg05Q8Nhj5YZQ0UJofgAMjQ" content-type image/png access-control-allow-origin * accept-ranges bytes x-cache-hits 1834, 0
GET H2	200	lock.png outlook.office365.com/Encryption/	1 KB 2 KB	139ms 57ms	Image image/png	2603:1026:c0d:34::2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.office365.com/Encryption/lock.png Requested by Host: umair.com URL: https://umair.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1026:c0d:34::2 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 55400220f8792e5146328487b0dbbb259a3f558e8fd51f2b445a5ddb6bc1608e Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://umair.com/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-beserver FR3P281MB3072 date Tue, 18 Jun 2024 18:58:28 GMT x-backendhttpstatus 200 x-proxy-backendserverstatus 200 x-rum-notupdatequerieddbcopy 1 x-powered-by ASP.NET x-feserver FR2P281CA0020 x-feproxyinfo FR2P281CA0020.DEUP281.PROD.OUTLOOK.COM x-rum-validated 1 request-id 9dbc28ff-56b2-db2c-a490-5f9b81a606e3 alt-svc h3=":443";ma=2592000,h3-29=":443";ma=2592000 content-length 1100 last-modified Sun, 16 Jun 2024 11:55:40 GMT server Microsoft-IIS/10.0 x-calculatedbetarget FR3P281MB3072.DEUP281.PROD.OUTLOOK.COM etag "06c21be4bfda1:0" x-rum-notupdatequeriedpath 1 content-type image/png cache-control public,max-age=2592000 x-firsthopcafeefz FRA x-diaginfo FR3P281MB3072 x-proxy-routingcorrectness 1 accept-ranges bytes x-feefzinfo FRA
GET H2	200	liveid.png outlook.office365.com/Encryption/	3 KB 3 KB	43ms 42ms	Image image/png	2603:1026:c0d:34::2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.office365.com/Encryption/liveid.png Requested by Host: umair.com URL: https://umair.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2603:1026:c0d:34::2 Frankfurt am Main, Germany, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash da7b1e7c0e95a9caba46be191f562268cee236556f67e4b10f2b3a05785b9cad Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://umair.com/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-beserver FR3P281MB1581 date Tue, 18 Jun 2024 18:58:29 GMT x-backendhttpstatus 200 x-proxy-backendserverstatus 200 x-rum-notupdatequerieddbcopy 1 x-powered-by ASP.NET x-feserver FR2P281CA0020 x-feproxyinfo FR2P281CA0020.DEUP281.PROD.OUTLOOK.COM x-rum-validated 1 request-id f7331c39-7799-006b-9798-f79c26675f62 alt-svc h3=":443";ma=2592000,h3-29=":443";ma=2592000 content-length 2955 last-modified Sat, 15 Jun 2024 11:35:44 GMT server Microsoft-IIS/10.0 x-calculatedbetarget FR3P281MB1581.DEUP281.PROD.OUTLOOK.COM etag "028792818bfda1:0" x-rum-notupdatequeriedpath 1 content-type image/png cache-control public,max-age=2592000 x-firsthopcafeefz FRA x-diaginfo FR3P281MB1581 x-proxy-routingcorrectness 1 accept-ranges bytes x-feefzinfo FRA
GET H/1.1	200 OK	favicon.ico r1.res.office365.com/owa/prem/15.20.7633.37/resources/images/0/	5 KB 6 KB	124ms 33ms	Other image/x-icon	2a02:26f0:7100::687e:241b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://r1.res.office365.com/owa/prem/15.20.7633.37/resources/images/0/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::687e:241b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash dec51a1a5c6f5daddebe7c7d1048319969446f03de89a953c3c3514f8db08e8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://umair.com/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Tue, 18 Jun 2024 18:58:29 GMT Strict-Transport-Security max-age=31536000; includeSubDomains Last-Modified Mon, 10 Jun 2024 19:09:18 GMT Server AkamaiNetStorage Content-Type image/x-icon Access-Control-Allow-Origin * Cache-Control public,max-age=630720000, s-maxage=630720000 Connection keep-alive Accept-Ranges bytes Timing-Allow-Origin * Content-Length 5430

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery number| timerInterval function| OtpClicked function| LogOAuthSignIn function| gup function| timedText

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://umair.com/authentication.css Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
outlook.office365.com
r1.res.office365.com
umair.com
www.brimg.net
151.101.129.132
152.199.19.160
185.162.89.65
2603:1026:c0d:34::2
2a02:26f0:7100::687e:241b
23a9fe43d817c861e036254939e9130b2f8fbf4c35042de186f6c2ffc016e788
55400220f8792e5146328487b0dbbb259a3f558e8fd51f2b445a5ddb6bc1608e
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
da7b1e7c0e95a9caba46be191f562268cee236556f67e4b10f2b3a05785b9cad
dec51a1a5c6f5daddebe7c7d1048319969446f03de89a953c3c3514f8db08e8a
f349fe8552c382ae40ed992e01ef32291b871fc0a1e542bd8fc4217bb1b45b32