![](/screenshots/7b3e23c9-e863-4f87-94fb-938116713bac.png)
bruceodenyadvocates.co.ke
Open in
urlscan Pro
162.214.76.126
Malicious Activity!
Public Scan
Submission: On November 10 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 19th 2022. Valid for: 3 months.
This is the only time bruceodenyadvocates.co.ke was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 162.214.76.126 162.214.76.126 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | () () | ||
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:1634 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 78.46.106.103 78.46.106.103 | 24940 (HETZNER-AS) (HETZNER-AS) | |
7 | 146.75.116.193 146.75.116.193 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:e6:... 2606:4700:e6::ac40:cb1c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 11 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: ima.imagi-ne.com
bruceodenyadvocates.co.ke |
ASN24940 (HETZNER-AS, DE)
PTR: static.103.106.46.78.clients.your-server.de
icon-library.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 4852 |
484 KB |
4 |
bruceodenyadvocates.co.ke
bruceodenyadvocates.co.ke |
308 KB |
3 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 3084 ka-f.fontawesome.com — Cisco Umbrella Rank: 5936 |
22 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1165 |
35 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 959 |
53 KB |
2 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 447 fonts.googleapis.com — Cisco Umbrella Rank: 118 |
30 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 361 |
7 KB |
1 |
icon-library.com
icon-library.com — Cisco Umbrella Rank: 283336 |
15 KB |
22 | 8 |
Domain | Requested by | |
---|---|---|
7 | i.imgur.com |
bruceodenyadvocates.co.ke
|
4 | bruceodenyadvocates.co.ke |
bruceodenyadvocates.co.ke
|
2 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | maxcdn.bootstrapcdn.com |
bruceodenyadvocates.co.ke
|
2 | code.jquery.com |
bruceodenyadvocates.co.ke
|
1 | cdnjs.cloudflare.com |
bruceodenyadvocates.co.ke
|
1 | icon-library.com |
bruceodenyadvocates.co.ke
|
1 | kit.fontawesome.com |
bruceodenyadvocates.co.ke
|
1 | fonts.googleapis.com |
bruceodenyadvocates.co.ke
|
1 | ajax.googleapis.com |
bruceodenyadvocates.co.ke
|
22 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bruceodenyadvocates.co.ke R3 |
2022-09-19 - 2022-12-18 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-10-25 - 2023-01-17 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-12-01 - 2023-01-01 |
a year | crt.sh |
icon-library.com Sectigo RSA Domain Validation Secure Server CA |
2022-06-30 - 2023-07-15 |
a year | crt.sh |
*.imgur.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-03-08 - 2023-03-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bruceodenyadvocates.co.ke/js/x-messages.html
Frame ID: 0964B3118539FCC92E9E0B758758F19D
Requests: 22 HTTP requests in this frame
Screenshot
![](/screenshots/7b3e23c9-e863-4f87-94fb-938116713bac.png)
Page Title
OneDriveDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- /popper\.js/([0-9.]+)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
x-messages.html
bruceodenyadvocates.co.ke/js/ |
568 B 810 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
bruceodenyadvocates.co.ke/js/plies/ |
284 KB 284 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
basic.js
bruceodenyadvocates.co.ke/js/plies/ |
22 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
671589ee-e785-4578-a5a5-4215598d49c5
https://bruceodenyadvocates.co.ke/ |
16 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
one-drive-icon-28.jpg
icon-library.com/images/one-drive-icon/ |
14 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nGnvFyB.png
i.imgur.com/ |
771 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S8OpPkm.png
i.imgur.com/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FljLshP.png
i.imgur.com/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NIfcs1C.png
i.imgur.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
X088l0D.png
i.imgur.com/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5sLeYjL.png
i.imgur.com/ |
65 KB 65 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FOmubyh.png
i.imgur.com/ |
394 KB 394 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| FontAwesomeKitConfig function| Popper object| bootstrap string| rdrt number| rc string| f0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bruceodenyadvocates.co.ke
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
i.imgur.com
icon-library.com
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
146.75.116.193
162.214.76.126
2001:4de0:ac18::1:a:3b
2606:4700::6811:190e
2606:4700::6812:1634
2606:4700::6812:bcf
2606:4700:e6::ac40:cb1c
2a00:1450:4001:827::200a
2a00:1450:4001:830::200a
78.46.106.103
047cd04c0bf47796870a485d672f90f6b4ec54203957cd520022b46130102a46
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1f4e108bc1fe0497416b5a97c6d4b5ec6ccd03ac5ea59983ecbae3b066eae1f6
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
407ac6e4531394c3b409e30e4118dc6ea2cb5d56293a3e79e1f3bc5a46f266d6
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
79d91df9b3aa71e68a430047436f9cbf33e3effd51e16fb569ee61e6a7036ea4
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
88b4104b6f2d7abc164567825d695ecfd03fbf3034808b18315103d45b4ac3e7
8c2a0bafc34c3331ffd56ddfc759c7f7d98184f836a94942b7af461cff6e0afe
8e20009cccb8d6669b5a182a8c4bd12041308470aee71e6a340f28434acc6842
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
97365981ef15ddb5dacae96dc37a090ef2f75121f77e3fb4b30739a1d0ed9f01
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b51d0e024738679b5ee1af9267b2648587acda6404c4047a9cd0256c1d70088f
bcdf4efedbeffffb053002efc736dd5b9c7c8966a1d23e1168d35f2721d3a276
cddaef1a49287960674430f7b2f137494671f37cd426b97a718f7957fb3926f4
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda