serveservershar3dfl0w.blogdns.org
Open in
urlscan Pro
107.180.25.79
Malicious Activity!
Public Scan
Submitted URL: https://serveservershar3dfl0w.blogdns.org/
Effective URL: https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/
Submission: On June 07 via manual from GB
Effective URL: https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/
Submission: On June 07 via manual from GB
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 16 HTTP transactions.
The main IP is 107.180.25.79, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US.
The main domain is serveservershar3dfl0w.blogdns.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 30th 2019. Valid for: 3 months.
This is the only time serveservershar3dfl0w.blogdns.org was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on May 30th 2019. Valid for: 3 months.
This is the only time serveservershar3dfl0w.blogdns.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) OneDrive (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 14 | 107.180.25.79 107.180.25.79 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:815::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:824::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 16 | 4 |
14
107.180.25.79
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-25-79.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-25-79.ip.secureserver.net
| serveservershar3dfl0w.blogdns.org |
1
2a00:1450:4001:815::200a
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| ajax.googleapis.com |
1
2a00:1450:4001:809::200a
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| fonts.googleapis.com |
2
2a00:1450:4001:824::2003
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| fonts.gstatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
blogdns.org
2 redirects
serveservershar3dfl0w.blogdns.org |
263 KB |
| 2 |
gstatic.com
fonts.gstatic.com |
18 KB |
| 2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
31 KB |
| 16 | 3 |
| Domain | Requested by | |
|---|---|---|
| 14 | serveservershar3dfl0w.blogdns.org |
2 redirects
serveservershar3dfl0w.blogdns.org
|
| 2 | fonts.gstatic.com |
serveservershar3dfl0w.blogdns.org
|
| 1 | fonts.googleapis.com |
serveservershar3dfl0w.blogdns.org
|
| 1 | ajax.googleapis.com |
serveservershar3dfl0w.blogdns.org
|
| 16 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| serveservershar3dfl0w.blogdns.org Let's Encrypt Authority X3 |
2019-05-30 - 2019-08-28 |
3 months | crt.sh |
| *.googleapis.com Google Internet Authority G3 |
2019-05-14 - 2019-08-06 |
3 months | crt.sh |
| *.google.com Google Internet Authority G3 |
2019-05-21 - 2019-08-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/
Frame ID: FF5A42AAAEBC2D631E31448FD146CF05
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://serveservershar3dfl0w.blogdns.org/
HTTP 302
https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40 HTTP 301
https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://serveservershar3dfl0w.blogdns.org/
HTTP 302
https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40 HTTP 301
https://serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/ Redirect Chain
|
4 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/css/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.png
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
61 KB 62 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
outlook.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
aol.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gmail.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
office.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
yahoo.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
other.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
14 KB 14 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
12 KB 849 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
log-bg.jpg
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
81 KB 82 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cloud.png
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cloud2.png
serveservershar3dfl0w.blogdns.org/b18cf8a8c5a77f8313dd33ba64dd3b40/images/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v16/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v16/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) OneDrive (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| window_opener_xc function| get_extra_data0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
fonts.googleapis.com
fonts.gstatic.com
serveservershar3dfl0w.blogdns.org
107.180.25.79
2a00:1450:4001:809::200a
2a00:1450:4001:815::200a
2a00:1450:4001:824::2003
0395c2d974a610a5826088c1752b49945c0b38e841389e794bf7171e2326982c
0a4dae67d3ec68363a0262bca63ffb6bb95d580d383560cd04292d3da83ed23a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
236e9e992659760afe02dfcc4faae126b2ca3f7ba37f8adbec1ab649a83f5406
2931f239ca2f29237a4071c422a87d0386fc0b8b434fa0ad9fdbb37590853e83
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
765b0e5ec8fd4e3a31e550a2506879863f8e873799ae7b6ada08d5a3805207b2
7976b777c1a1d694739e57292d1629d371aa79be6d7a2a87bcb0d0b9edad79f2
9dcb3f39c6f1c7f2b0fa75391efa497c84ade4b3a12867af284fbe224d24c3e9
a8911de9c6b54ea92f9322ea7570ee16713718211f4dabc77b820256dc923b4c
b2bf99365d81089bbb0939d15bd959809492c068555dbead87f91802589ef5a9
b837437b93bede28b090108d7d0612c88b65a543bf6b924d0586bf552fefccac
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bedcbef0141493931f41db1b4410c80f62812f1d5a5f98de10fcfe4da57e994d
ebe7f9c6a2d1885e9e7cfeccc2bd8ea7071b3053dc38df8ba9a16d39897e2d5f
f0a28c01a4c71be50d6cf38d6ca93f69ed0646285bd0a140d46ac0e9937de9d3