www.icloud.com-la.fyi
147.135.20.103  Malicious Activity!

URL: http://www.icloud.com-la.fyi/sing/bKj
Submission: On August 12 via api from QA

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 147.135.20.103, located in Reston, United States and belongs to OVH, FR. The main domain is www.icloud.com-la.fyi.
This is the only time www.icloud.com-la.fyi was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

IP Address AS Autonomous System
5 147.135.20.103 16276 (OVH)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
3 104.111.230.122 16625 (AKAMAI-AS)
9 4
Domain
Subdomains
Transfer
5 com-la.fyi
www.icloud.com-la.fyi
132 KB
3 icloud.com
www.icloud.com
418 KB
1 jquery.com
code.jquery.com
75 KB
9 3
Domain Requested by
5 www.icloud.com-la.fyi www.icloud.com-la.fyi
3 www.icloud.com www.icloud.com-la.fyi
1 code.jquery.com www.icloud.com-la.fyi
9 3

This site contains links to these domains. Also see Links.

Domain
www.apple.com
Subject Issuer Validity Valid
jquery.org
COMODO RSA Domain Validation Secure Server CA
2018-10-17 -
2020-10-16
2 years crt.sh
www.icloud.com
DigiCert SHA2 Extended Validation Server CA-3
2020-07-02 -
2021-07-03
a year crt.sh
icloud.com-la.fyi
Let's Encrypt Authority X3
2020-07-07 -
2020-10-05
3 months crt.sh

This page contains 2 frames:

Primary Page: http://www.icloud.com-la.fyi/sing/bKj
Frame ID: A31E1C74AC0C61E061ECDE2FE2A2E726
Requests: 9 HTTP requests in this frame

Frame: https://www.icloud.com-la.fyi/datos.php?tr=bKj&holder=ID%20de%20Apple&idname=27655&user=
Frame ID: B9700494F44AC8B1BB8C634EEA8D25A5
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

56 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

625 kB
Transfer

1077 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set bKj
www.icloud.com-la.fyi/sing/
45 KB
45 KB
Document
General
Full URL
http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Server
147.135.20.103 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS
ip103.ip-147-135-20.us
Software
Apache /
Resource Hash
0ccedb78ef75bcf1297179686844cf69f392fdb254b1e8fb446d3ab9b33a9ef6

Request headers

Host
www.icloud.com-la.fyi
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 01:53:49 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=fd468ae9f1ecfa0afc6c8bcaabdff7bd; path=/
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
jquery-2.2.4.js
code.jquery.com/
252 KB
75 KB
Script
General
Full URL
https://code.jquery.com/jquery-2.2.4.js
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
893e90f6230962e42231635df650f20544ad22affc3ee396df768eaa6bc5a6a2

Request headers

Referer
http://www.icloud.com-la.fyi/sing/bKj
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 12 Aug 2020 01:52:06 GMT
content-encoding
gzip
last-modified
Fri, 20 May 2016 17:24:41 GMT
server
nginx
status
200
etag
W/"573f4859-3ee0f"
vary
Accept-Encoding
x-hw
1597197126.dop239.fr8.t,1597197126.cds232.fr8.hn,1597197126.cds017.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
76245
main.css
www.icloud.com/system/cloudos2/2014Project62/es-mx/
303 KB
31 KB
Stylesheet
General
Full URL
https://www.icloud.com/system/cloudos2/2014Project62/es-mx/main.css
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.122 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-230-122.deploy.static.akamaitechnologies.com
Software
AppleHttpServer/ac9d40131a4d /
Resource Hash
eea5502739cd001141fa136de80dcc7e24aa1f4cd5c4141e0214bd4a183e19b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
http://www.icloud.com-la.fyi/sing/bKj
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Server
AppleHttpServer/ac9d40131a4d
Cache-Control
public, max-age=31536000
ETag
"173a41fcbb07aeb"
Vary
accept-encoding
Content-Language
en-us
Content-Type
text/css
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
X-Apple-Request-UUID
dd280078-3cba-481d-8032-3fc3cac6976f
Date
Wed, 12 Aug 2020 01:52:06 GMT
Connection
keep-alive
Content-Location
/system/cloudos2/2014Project62/es-mx/main.css.gzip
Content-Length
31467
data:truncated
data:truncated
5 KB
0
Stylesheet
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e69849b56d9384d0a7f9c5bf62bf73811a2e59aa5dea61fcd05cbf742ba8a25c

Request headers

Referer
http://www.icloud.com-la.fyi/sing/bKj
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
text/css
r$__116.png
www.icloud.com-la.fyi/imagen/
9 KB
9 KB
Image
General
Full URL
http://www.icloud.com-la.fyi/imagen/r$__116.png
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Server
147.135.20.103 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS
ip103.ip-147-135-20.us
Software
Apache /
Resource Hash
51d89294cbffbf328cb91fe7f0de4f7ac73ec33eb73feba0ac7d309d35d5ad9f

Request headers

Referer
http://www.icloud.com-la.fyi/sing/bKj
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 01:53:50 GMT
Last-Modified
Sat, 05 Oct 2019 17:25:48 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
9431
spinner2.gif
www.icloud.com-la.fyi/imagen/
77 KB
77 KB
Image
General
Full URL
http://www.icloud.com-la.fyi/imagen/spinner2.gif
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Server
147.135.20.103 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS
ip103.ip-147-135-20.us
Software
Apache /
Resource Hash
832dc1d13667c3d0d1213a90ee24a013e511912220913dc4f54988b8cea73c5d

Request headers

Referer
http://www.icloud.com-la.fyi/sing/bKj
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 01:53:50 GMT
Last-Modified
Sat, 05 Oct 2019 17:25:48 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
78737
datos.php?tr=bKj&holder=ID%20de%20Apple&idname=27655&user=
www.icloud.com-la.fyi/ Frame B970
0
0
Document
General
Full URL
https://www.icloud.com-la.fyi/datos.php?tr=bKj&holder=ID%20de%20Apple&idname=27655&user=
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
147.135.20.103 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS
ip103.ip-147-135-20.us
Software
Apache /
Resource Hash

Request headers

Host
www.icloud.com-la.fyi
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
http://www.icloud.com-la.fyi/sing/bKj
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=fd468ae9f1ecfa0afc6c8bcaabdff7bd
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://www.icloud.com-la.fyi/sing/bKj

Response headers

Date
Wed, 12 Aug 2020 01:53:50 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
close.png
www.icloud.com-la.fyi/sing/imagen/
315 B
315 B
Image
General
Full URL
http://www.icloud.com-la.fyi/sing/imagen/close.png
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Server
147.135.20.103 Reston, United States, ASN16276 (OVH, FR),
Reverse DNS
ip103.ip-147-135-20.us
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
http://www.icloud.com-la.fyi/sing/bKj
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 12 Aug 2020 01:53:50 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
SFUIText-Regular.woff
www.icloud.com/fonts/
176 KB
176 KB
Font
General
Full URL
https://www.icloud.com/fonts/SFUIText-Regular.woff
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.122 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-230-122.deploy.static.akamaitechnologies.com
Software
AppleHttpServer/ac9d40131a4d /
Resource Hash
1dd142cb948458f8258fa4f7ba5e61bb3060e1b41dbc55eaefce115c3518759f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.icloud.com/system/cloudos2/2014Project62/es-mx/main.css
Origin
http://www.icloud.com-la.fyi

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Server
AppleHttpServer/ac9d40131a4d
Cache-Control
public, max-age=31536000
ETag
"1728357e0d02bf9c"
Content-Language
en-us
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
X-Apple-Request-UUID
167479cd-80e9-4129-aecb-82ab4b5c024f
Date
Wed, 12 Aug 2020 01:52:06 GMT
Connection
keep-alive
Content-Type
application/font-woff
Content-Length
180124
SFUIText-Light.woff
www.icloud.com/fonts/
210 KB
211 KB
Font
General
Full URL
https://www.icloud.com/fonts/SFUIText-Light.woff
Requested by
Host: www.icloud.com-la.fyi
URL: http://www.icloud.com-la.fyi/sing/bKj
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.230.122 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-230-122.deploy.static.akamaitechnologies.com
Software
AppleHttpServer/ac9d40131a4d /
Resource Hash
64ff0570e91055ef514596d780cd0d07533c5b49236b8a4f8cc05ed1fafcf828
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.icloud.com/system/cloudos2/2014Project62/es-mx/main.css
Origin
http://www.icloud.com-la.fyi

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Server
AppleHttpServer/ac9d40131a4d
Cache-Control
public, max-age=31536000
ETag
"1728357e0d034924"
Content-Language
en-us
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Apple-Request-UUID,Via
X-Apple-Request-UUID
ce60021d-b47a-4bde-855a-5506b3182a67
Date
Wed, 12 Aug 2020 01:52:06 GMT
Connection
keep-alive
Content-Type
application/font-woff
Content-Length
215332

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| event undefined| PolyFillCustomEvent function| __startFilteringErrors function| __startFilteringUnhandledRejections function| $ function| jQuery function| miFuncion function| close_x

0 Cookies