securelogs.canasodig.xyz Open in urlscan Pro
68.183.26.242 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://spb.viprazbor.ru/redirect_away?site=%68%74%74%70%73%3A%2F%2F%66%61%72%6D%61%2D%6E%65%74%2E%63%6F%6D%2F%61%64%6D%6...
Effective URL:
https://securelogs.canasodig.xyz/?username=darren.cossutti@img.com
Submission: On May 18 via manual (May 18th 2023, 3:44:34 pm UTC) from IN — Scanned from DE

Summary HTTP 3 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 68.183.26.242, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is securelogs.canasodig.xyz.
TLS certificate: Issued by R3 on May 18th 2023. Valid for: 3 months.

This is the only time securelogs.canasodig.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	138.201.58.58 138.201.58.58	24940 (HETZNER-AS) (HETZNER-AS)
1	89.145.93.101 89.145.93.101	29017 (GYRON ) (GYRON )
2	68.183.26.242 68.183.26.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	3

1 138.201.58.58 (Esslingen am Neckar, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: wikiroom.org

spb.viprazbor.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.145.93.101 (Maidenhead, United Kingdom)

ASN29017 (GYRON , GB)
PTR: uk605.directrouter.com

farma-net.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.183.26.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

securelogs.canasodig.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	canasodig.xyz securelogs.canasodig.xyz	161 KB
1	farma-net.com farma-net.com	292 B
1	viprazbor.ru 1 redirects spb.viprazbor.ru	297 B
3	3

	Domain	Requested by
2	securelogs.canasodig.xyz	securelogs.canasodig.xyz
1	farma-net.com
1	spb.viprazbor.ru	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
*.farma-net.com R3	`2023-04-13` - `2023-07-12`	3 months	crt.sh
canasodig.xyz R3	`2023-05-18` - `2023-08-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://securelogs.canasodig.xyz/?username=darren.cossutti@img.com
Frame ID: 7DBD66A88B9462ECEA80E29FD8B8746A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

reCAPTCHA

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

162 kB
Transfer

451 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://spb.viprazbor.ru/redirect_away?site=%68%74%74%70%73%3A%2F%2F%66%61%72%6D%61%2D%6E%65%74%2E%63%6F%6D%2F%61%64%6D%69%6E%2F%61%75%74%68%2F%73%66%5F%72%61%6E%64%5F%73%74%72%69%6E%67%5F%6D%69%78%65%64%28%38%29%2F%2F%2F%2F%64%61%72%72%65%6E%2E%63%6F%73%73%75%74%74%69%40%69%6D%67%2E%63%6F%6D HTTP 302
https://farma-net.com/admin/auth/sf_rand_string_mixed(8)////darren.cossutti@img.com

3 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

darren.cossutti@img.com Show response
farma-net.com/admin/auth/sf_rand_string_mixed(8)////
Redirect Chain

https://spb.viprazbor.ru/redirect_away?site=%68%74%74%70%73%3A%2F%2F%66%61%72%6D%61%2D%6E%65%74%2E%63%6F%6D%2F%61%64%6D%69%6E%2F%61%75%74%68%2F%73%66%5F%72%61%6E%64%5F%73%74%72%69%6E%67%5F%6D%69%78...
https://farma-net.com/admin/auth/sf_rand_string_mixed(8)////darren.cossutti@img.com

0
292 B

212ms
20ms

Document
text/html

89.145.93.101
GYRON

General

Check archive.org

Show headers Download Go to

Full URL: https://farma-net.com/admin/auth/sf_rand_string_mixed(8)////darren.cossutti@img.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 89.145.93.101 Maidenhead, United Kingdom, ASN29017 (GYRON , GB),
Reverse DNS: uk605.directrouter.com
Software: LiteSpeed / PHP/7.2.34
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 18 May 2023 15:44:29 GMT
refresh: 0;url=https://securelogs.canasodig.xyz/?username=darren.cossutti@img.com
server: LiteSpeed
x-powered-by: PHP/7.2.34

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Thu, 18 May 2023 15:44:29 GMT
Location: https://farma-net.com/admin/auth/sf_rand_string_mixed(8)////darren.cossutti@img.com
Server: nginx/1.14.0 (Ubuntu)
X-Frame-Options: SAMEORIGIN

GET
H2 200 Primary Request / Show response
securelogs.canasodig.xyz/ 410 KB
161 KB 1013ms
735ms Document
text/html 68.183.26.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://securelogs.canasodig.xyz/?username=darren.cossutti@img.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

68.183.26.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

1d19d35df85619a96e4c6e1efde6cb5e641bdc30714425c45c930146a565d264

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://farma-net.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 18 May 2023 15:44:31 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 858 B
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 / Show response
securelogs.canasodig.xyz/ 200 B
342 B 394ms
393ms Fetch
application/json 68.183.26.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://securelogs.canasodig.xyz/?username=darren.cossutti@img.com

Requested by

Host: securelogs.canasodig.xyz
URL: https://securelogs.canasodig.xyz/?username=darren.cossutti@img.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

68.183.26.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

9a991454ef471e2dfb30f6ac4533bdbb0d824d2da512b2475c7b6fdd0ebe8d2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 18 May 2023 15:44:31 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
vary: Accept-Encoding
content-type: application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

farma-net.com
securelogs.canasodig.xyz
spb.viprazbor.ru
138.201.58.58
68.183.26.242
89.145.93.101
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072
1d19d35df85619a96e4c6e1efde6cb5e641bdc30714425c45c930146a565d264
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa
9a991454ef471e2dfb30f6ac4533bdbb0d824d2da512b2475c7b6fdd0ebe8d2f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

securelogs.canasodig.xyz Open in urlscan Pro 68.183.26.242 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

162 kBTransfer

451 kBSize

0 Cookies

0 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

securelogs.canasodig.xyz Open in urlscan Pro
68.183.26.242 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

162 kB
Transfer

451 kB
Size

0
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!