vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
Open in
urlscan Pro
2a00:1450:4001:816::2014
Malicious Activity!
Public Scan
Effective URL: https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Submission: On June 30 via manual from US
Summary
TLS certificate: Issued by GTS CA 1O1 on June 17th 2020. Valid for: 3 months.
This is the only time vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID) | |
1 | 2a00:1450:400... 2a00:1450:4001:816::2014 | 15169 (GOOGLE) (GOOGLE) | |
4 | 160.153.53.104 160.153.53.104 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
6 | 3 |
ASN11377 (SENDGRID, US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u8042263.ct.sendgrid.net |
ASN15169 (GOOGLE, US)
vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-160-153-53-104.ip.secureserver.net
adkpd.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
adkpd.com
adkpd.com |
6 KB |
1 |
appspot.com
vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com |
155 KB |
1 |
sendgrid.net
1 redirects
u8042263.ct.sendgrid.net |
308 B |
6 | 3 |
Domain | Requested by | |
---|---|---|
4 | adkpd.com |
vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
|
1 | vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com | |
1 | u8042263.ct.sendgrid.net | 1 redirects |
6 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.appspot.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
adkpd.com ZeroSSL RSA Domain Secure Site CA |
2020-05-08 - 2020-08-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/
Frame ID: 75D809076395EA21FCEDA99F35791837
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u8042263.ct.sendgrid.net/ls/click?upn=GPF2gsTHza-2FC56b1W9YEaLBXG-2Fyv2mPQtH5R27bedeZmZhBbAPp0ks6NfJo...
HTTP 302
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/ Page URL
Detected technologies
Google App Engine (Web Servers) ExpandDetected patterns
- headers server /Google Frontend/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u8042263.ct.sendgrid.net/ls/click?upn=GPF2gsTHza-2FC56b1W9YEaLBXG-2Fyv2mPQtH5R27bedeZmZhBbAPp0ks6NfJoI9nuW52DFHScLfZBZ0L9A7S-2F5xufoZhUv-2BglXmfHxKLA6DewqWtlfFXysmU-2FzHydp4TGVX7dlcrf7QGpmSdKfL5xiHJx1wOJFF2cpjp19EliBVOc-3DlzbD_YX7osDPrGAo-2BwS6yNs-2FdcEhYbS7aVukQZd-2B9Q-2BAxo-2F3HsN2rs2VGckEXPyfe7TCZvNX2HTQE-2Fq78a-2Fu-2F1DTrNVk-2FlbfY4-2BEWeWmEuq0pBQVAdSUKOKhj-2FHtNX-2FNh73fe8VLQHtog1WEj7-2BBnj-2FvW-2BYvfxjDdwxmdfiziOpkOrHAZcRRZhxXgM4clVWy7-2BsbcbrlhEh3FljiY-2Fm-2F1lMZ0KsssytPfBToX4UBDcuWO688-3D
HTTP 302
https://vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com/ Redirect Chain
|
225 KB 155 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
adkpd.com/ob/media//css/ |
594 B 253 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
adkpd.com/ob/media//css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.js
adkpd.com/ob/media//js/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
adkpd.com/ob/media//js/ |
1 KB 688 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
106 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
segoeui-regular.ttf
adkpd.com/ob/media//fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- adkpd.com
- URL
- https://adkpd.com/ob/media//fonts/segoeui-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate string| LIB_phrase string| LIB_view string| ____media string| ____b string| ____rdr object| d object| s function| bindElements function| validateEmail function| getUrlParameter function| dDOM object| Base64 number| LIB_submitTrial function| initForLogin function| initForTrueLogin function| loginUser function| trueLoginUser function| initApp function| sendPost function| sendGet function| bindXhr object| isMobile number| c2 number| c1 object| LIB_submitButton object| LIB_userInput object| LIB_pwdInput object| LIB_spinner function| LIB_beforeSend function| LIB_onComplete0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adkpd.com
u8042263.ct.sendgrid.net
vroggjlvulrdxfdptvqofycoptxgnrotlxrn-dot-gl494903049.wl.r.appspot.com
adkpd.com
160.153.53.104
167.89.123.16
2a00:1450:4001:816::2014
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
0f064b85d872f5bb47211acb9576741248eac8504bca29773c57e7255175aea9
2b491e2211f7003c16a9132d78a95753e0315bf30b1977518d65e3a76dccec20
49705cc2f1777d040b0293f2192443f24c82b61b2962b7c00a3e22d1ec8a4066
49910c68e536af7b7e9a3518ac15c49f8ccfe4f76e9fed75b743e5e43652e7e8
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
96ef5524fc0613f15738e1acc4010d6d34b05b6c0b6d815095109c9ec595ad41
c38d76da3da3c7c8b704f8a11daa64929f65884becfc2a79a1e909d6378686de
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b