lisboa-jp.com
Open in
urlscan Pro
157.7.107.198
Malicious Activity!
Public Scan
Effective URL: https://lisboa-jp.com/webmail%20admin/secured/3650/login/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=...
Submission: On September 16 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on July 14th 2020. Valid for: 3 months.
This is the only time lisboa-jp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 18.195.92.197 18.195.92.197 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 208.113.172.105 208.113.172.105 | 26347 (DREAMHOST-AS) (DREAMHOST-AS) | |
1 5 | 157.7.107.198 157.7.107.198 | 7506 (INTERQ GM...) (INTERQ GMO Internet) | |
3 | 2a02:26f0:10c... 2a02:26f0:10c:599::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 2 | 133.130.35.170 133.130.35.170 | 7506 (INTERQ GM...) (INTERQ GMO Internet) | |
1 2 | 23.42.26.147 23.42.26.147 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 2600:9000:214... 2600:9000:214f:9200:6:bd5c:1300:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.35.254.46 13.35.254.46 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 103.142.124.130 103.142.124.130 | 131957 (MICROAD M...) (MICROAD MicroAd) | |
16 | 9 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-92-197.eu-central-1.compute.amazonaws.com
linkprotect.cudasvc.com |
ASN26347 (DREAMHOST-AS, US)
PTR: apache2-jolly.coffee.dreamhost.com
cortinasmetalcor.cl |
ASN7506 (INTERQ GMO Internet,Inc, JP)
PTR: 157-7-107-198.virt.lolipop.jp
lisboa-jp.com |
ASN20940 (AKAMAI-ASN1, EU)
secure.aadcdn.microsoftonline-p.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-42-26-147.deploy.static.akamaitechnologies.com
j.microad.net | |
jgl.microad.net |
ASN16509 (AMAZON-02, US)
PTR: server-13-35-254-46.fra6.r.cloudfront.net
cache.send.microadinc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
lisboa-jp.com
1 redirects
lisboa-jp.com |
40 KB |
3 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
294 KB |
2 |
microadinc.com
cache.send.microadinc.com s-rtb.send.microadinc.com ssp.send.microadinc.com Failed |
1 KB |
2 |
microad.net
1 redirects
j.microad.net jgl.microad.net |
20 KB |
2 |
lolipop.jp
1 redirects
assets.lolipop.jp |
8 KB |
1 |
minne.com
static.minne.com |
79 KB |
1 |
cortinasmetalcor.cl
cortinasmetalcor.cl |
663 B |
1 |
cudasvc.com
1 redirects
linkprotect.cudasvc.com |
662 B |
0 |
ad-stir.com
Failed
js.ad-stir.com Failed |
|
16 | 9 |
Domain | Requested by | |
---|---|---|
5 | lisboa-jp.com |
1 redirects
cortinasmetalcor.cl
lisboa-jp.com |
3 | secure.aadcdn.microsoftonline-p.com |
lisboa-jp.com
|
2 | assets.lolipop.jp |
1 redirects
lisboa-jp.com
|
1 | s-rtb.send.microadinc.com |
j.microad.net
|
1 | cache.send.microadinc.com |
j.microad.net
|
1 | static.minne.com |
lisboa-jp.com
|
1 | jgl.microad.net |
lisboa-jp.com
|
1 | j.microad.net | 1 redirects |
1 | cortinasmetalcor.cl | |
1 | linkprotect.cudasvc.com | 1 redirects |
0 | ssp.send.microadinc.com Failed |
lisboa-jp.com
|
0 | js.ad-stir.com Failed |
lisboa-jp.com
j.microad.net |
16 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
lisboa-jp.com Let's Encrypt Authority X3 |
2020-07-14 - 2020-10-12 |
3 months | crt.sh |
secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 4 |
2019-07-17 - 2021-07-17 |
2 years | crt.sh |
*.lolipop.jp AlphaSSL CA - SHA256 - G2 |
2019-07-29 - 2021-09-12 |
2 years | crt.sh |
*.microad.net GeoTrust RSA CA 2018 |
2020-05-28 - 2021-08-27 |
a year | crt.sh |
*.minne.com GlobalSign RSA DV SSL CA 2018 |
2020-03-10 - 2022-05-01 |
2 years | crt.sh |
cache.send.microadinc.com Amazon |
2020-03-23 - 2021-04-23 |
a year | crt.sh |
*.send.microadinc.com Cybertrust Japan Public CA G3 |
2019-04-17 - 2020-10-31 |
2 years | crt.sh |
This page contains 4 frames:
Primary Page:
https://lisboa-jp.com/webmail%20admin/secured/3650/login/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=76&id=903587916&email=johnr.martin@crown.com
Frame ID: 0F0C8FC293567DE82A6C4EDBE2C5DB70
Requests: 7 HTTP requests in this frame
Frame:
https://lisboa-jp.com/webmail%20admin/secured/3650/login/data_files/Prefetch.html
Frame ID: 72E961C2A66B6CA9D82717A154E62105
Requests: 7 HTTP requests in this frame
Frame:
https://cache.send.microadinc.com/js/cookie_loader.html
Frame ID: B30F5DD69393D33B307D018D3B5A795A
Requests: 1 HTTP requests in this frame
Frame:
https://js.ad-stir.com/js/adstir.js
Frame ID: E85136781E774361EC3E25B427D1F7BE
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fcortinasmetalcor.cl%2f%23johnr.martin%40crown.com&c=E,1,K...
HTTP 302
http://cortinasmetalcor.cl/ Page URL
-
https://lisboa-jp.com/webmail%20admin/secured/3650/login/?email=johnr.martin@crown.com
HTTP 302
https://lisboa-jp.com/webmail%20admin/secured/3650/login/Login.php?websrc=59c275dc2e97dd3b896ed4ff... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fcortinasmetalcor.cl%2f%23johnr.martin%40crown.com&c=E,1,KKedOATNF4xAaGMHvwZKWAVx-twHOh0rJPJXzGfiXud3mq3m9VYpw9Nj0GB_Anp9uibxlJXZEvX3aron00bPOysz2Wozfe7hP7jfvpUx_bGhLKmamLPe0g,,&typo=1
HTTP 302
http://cortinasmetalcor.cl/ Page URL
-
https://lisboa-jp.com/webmail%20admin/secured/3650/login/?email=johnr.martin@crown.com
HTTP 302
https://lisboa-jp.com/webmail%20admin/secured/3650/login/Login.php?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=76&id=903587916&email=johnr.martin@crown.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fcortinasmetalcor.cl%2f%23johnr.martin%40crown.com&c=E,1,KKedOATNF4xAaGMHvwZKWAVx-twHOh0rJPJXzGfiXud3mq3m9VYpw9Nj0GB_Anp9uibxlJXZEvX3aron00bPOysz2Wozfe7hP7jfvpUx_bGhLKmamLPe0g,,&typo=1 HTTP 302
- http://cortinasmetalcor.cl/
- http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif HTTP 301
- https://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
- https://j.microad.net/js/compass.js HTTP 302
- https://jgl.microad.net/js/compass.js
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
cortinasmetalcor.cl/ Redirect Chain
|
452 B 663 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
lisboa-jp.com/webmail%20admin/secured/3650/login/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.login.min.css
lisboa-jp.com/webmail%20admin/secured/3650/login/data_files/ |
84 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo.svg
lisboa-jp.com/webmail%20admin/secured/3650/login/data_files/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
picker_account_aad.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6970.12/content/images/ |
756 B 772 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Prefetch.html
lisboa-jp.com/webmail%20admin/secured/3650/login/data_files/ Frame 72E9 |
19 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-small.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
secure.aadcdn.microsoftonline-p.com/ests/2.1.6387.8/content/images/backgrounds/ |
291 KB 291 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bnr_lolipop_ad_001.gif
assets.lolipop.jp/img/bnr/ Frame 72E9 Redirect Chain
|
8 KB 8 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
compass.js
jgl.microad.net/js/ Frame 72E9 Redirect Chain
|
82 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
minne_600x500@2x.jpg
static.minne.com/files/banner/ Frame 72E9 |
79 KB 79 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
adstir.js
js.ad-stir.com/js/ Frame 72E9 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie_loader.html
cache.send.microadinc.com/js/ Frame B30F |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ad
s-rtb.send.microadinc.com/ Frame 72E9 |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
adstir.js
js.ad-stir.com/js/ Frame E851 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ic
ssp.send.microadinc.com/ Frame 72E9 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- js.ad-stir.com
- URL
- http://js.ad-stir.com/js/adstir.js?20130527
- Domain
- js.ad-stir.com
- URL
- https://js.ad-stir.com/js/adstir.js
- Domain
- ssp.send.microadinc.com
- URL
- https://ssp.send.microadinc.com/ic?ep=4X2Ib9ycZxABrcu9IYd5hr1gzenyKAdLKlmj501U4UQis5dkVKFYTNaiby4x7q5cPcxC2oFzkLpgQbyEAnZvKvUqTqA1dInznb9UvnBpWGAWEq_uLeKWRC0COa5Ba
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.lolipop.jp
cache.send.microadinc.com
cortinasmetalcor.cl
j.microad.net
jgl.microad.net
js.ad-stir.com
linkprotect.cudasvc.com
lisboa-jp.com
s-rtb.send.microadinc.com
secure.aadcdn.microsoftonline-p.com
ssp.send.microadinc.com
static.minne.com
js.ad-stir.com
ssp.send.microadinc.com
103.142.124.130
13.35.254.46
133.130.35.170
157.7.107.198
18.195.92.197
208.113.172.105
23.42.26.147
2600:9000:214f:9200:6:bd5c:1300:93a1
2a02:26f0:10c:599::35c1
04864c259b74c0b5a75d4568296d64ba09eed6590011516974df99c734f933af
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
13b4cb1e8f744dbc4085d2d55103bf1be6f2eefbdca1b7b78fd9447bfe279c95
3aa70a78dd8d53c5ccdee1c93403f4b3d6fec5d7a6f04a2e43db02dc237b938d
4f962ec8ae085492d496fcbbd74185ab1c8e377438dbcb5ec4f8517b7bd9293f
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
701832f79b5f7aedd6f2f47d6b0397b72d4067ed45e5ce5d2b145c8b83a6fcf6
83eeff21d288d0a47c4784862b08b8123bcc6b206b63dd727f9a700202b42dd5
9ec7bd724896221982df1bfee78755c23566235ddce9cd85aa7e659b01214acd
aa4a4e21e93e837863b6f70f05bd134ddbf0c31626d3a777f108d2b68ef5c2f5
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b