![](/screenshots/5b32e65d-4777-41ab-a4c7-103e39af27ad.png)
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com
Open in
urlscan Pro
2a01:7e03::f03c:93ff:feda:4992
Malicious Activity!
Public Scan
Submission: On February 16 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 12th 2024. Valid for: 3 months.
This is the only time 0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a01:7e03::f0... 2a01:7e03::f03c:93ff:feda:4992 | 63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud) | |
1 2 | 2606:4700::68... 2606:4700::6811:3b8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 162.241.242.172 162.241.242.172 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
2 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2620:1ec:29:1... 2620:1ec:29:1::40 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
11 | 7 |
ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: dar.darcitypromotion.com
brandhub.tz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
cloudflare.com
1 redirects
challenges.cloudflare.com — Cisco Umbrella Rank: 4410 cdnjs.cloudflare.com — Cisco Umbrella Rank: 257 |
34 KB |
3 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 1176 |
5 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 940 |
59 KB |
2 |
brandhub.tz
brandhub.tz |
593 KB |
1 |
linodeobjects.com
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com |
1 KB |
11 | 5 |
Domain | Requested by | |
---|---|---|
3 | aadcdn.msauth.net |
brandhub.tz
|
2 | cdnjs.cloudflare.com |
brandhub.tz
|
2 | code.jquery.com |
brandhub.tz
|
2 | brandhub.tz |
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com
code.jquery.com |
2 | challenges.cloudflare.com |
1 redirects
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com
|
1 | 0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com | |
11 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
go.microsoft.com |
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
us-lax-1.linodeobjects.com R3 |
2024-01-12 - 2024-04-11 |
3 months | crt.sh |
*.brandhub.tz R3 |
2024-01-08 - 2024-04-07 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-01-29 - 2025-01-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com/global.html
Frame ID: 91B865884689E67C748B4166B746D4FF
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/5b32e65d-4777-41ab-a4c7-103e39af27ad.png)
Page Title
Sign in to Best Productivity Provider!Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: More information
Search URL Search Domain Scan URL
Title: Terms & Conditions
Search URL Search Domain Scan URL
Title: Cookie Privacy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP 302
- https://challenges.cloudflare.com/turnstile/v0/g/16c3caa4cd49/api.js?onload=onloadTurnstileCallback
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
global.html
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com/ |
814 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
challenges.cloudflare.com/turnstile/v0/g/16c3caa4cd49/ Redirect Chain
|
38 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sc.php
brandhub.tz/0xD3eA6d5477Cf65b3bBb9073b4702b853E0E5868e/installer%5b24.0%5d/host%5b24.0%5d/admin/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.0.0/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
1df7806.php
brandhub.tz/0xD3eA6d5477Cf65b3bBb9073b4702b853E0E5868e/installer%5b24.0%5d/host%5b24.0%5d/ |
590 KB 590 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
37 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
250 B 743 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
aadcdn.msauth.net/shared/1.0/content/images/ |
7 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
756 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
899 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
222 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
513 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| turnstile object| v94ed89e0 number| autograb object| v0a05a4 object| CryptoJS function| $ function| jQuery string| em string| ur0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
0xc6351e2f329b8e57a3e5474a18e85f9c4a9c33809.us-lax-1.linodeobjects.com
aadcdn.msauth.net
brandhub.tz
cdnjs.cloudflare.com
challenges.cloudflare.com
code.jquery.com
162.241.242.172
2606:4700::6811:180e
2606:4700::6811:3b8
2620:1ec:29:1::40
2a01:7e03::f03c:93ff:feda:4992
2a04:4e42:200::649
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0d28f6cba8f343a838eb6c1091135a40b944772d02e36b0a6893c10fdb939ca5
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
8342c308518144457164695d5fced1c9400ecb7170b9ef26c4d8b47870ca73a7
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
88d2c2da48ce40325f19c9aa5d3776ae6751e2dc3cd8db961bf6c06cb55382f1
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a5899effba54534a3e7eaffc2b4fc8dc1229e5f8e6ca06244a1ab44832724721
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
eab5d90a71736f267af39fdf32caa8c71673fd06703279b01e0f92b0d7be0bfc