r8ookw.brighaccio.yachts
Open in
urlscan Pro
2606:4700:3037::ac43:9ee9
Malicious Activity!
Public Scan
Submission: On March 29 via api from US — Scanned from US
Summary
This is the only time r8ookw.brighaccio.yachts was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Downloads These files were downloaded by the website
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 5 | 2606:4700:303... 2606:4700:3037::ac43:9ee9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2600:141b:f00... 2600:141b:f000:d08c::317f | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 2 |
ASN20940 (AKAMAI-ASN1, NL)
download.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
brighaccio.yachts
2 redirects
r8ookw.brighaccio.yachts |
10 KB |
1 |
microsoft.com
download.microsoft.com — Cisco Umbrella Rank: 9300 |
|
4 | 2 |
Domain | Requested by | |
---|---|---|
5 | r8ookw.brighaccio.yachts |
2 redirects
r8ookw.brighaccio.yachts
|
1 | download.microsoft.com | |
4 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
akamai.download.microsoft.com Microsoft Azure TLS Issuing CA 02 |
2022-12-21 - 2023-06-19 |
6 months | crt.sh |
This page contains 1 frames:
Frame:
https://download.microsoft.com/download/b/3/7/b375974d-d9a8-454e-b929-4ed9b8020121/6001.18000.080118-1840_x86fre_wave1_ServicePackInstaller-FRMCSP1_CD1.iso
Frame ID: 81F3165C85F37E6BE65A723B2E6B70F8
Requests: 4 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- http://r8ookw.brighaccio.yachts/cdn-cgi/phish-bypass?atok=qa3h5.9qlB4zMgcPYNUj02w3WjmXaNphcnlRy0OJa70-1680102778-0-%2FA05322ddp%2FplW2IlooIzV2I4%2F9596458%2F388_CONTRATO.Zip HTTP 301
- http://r8ookw.brighaccio.yachts/A05322ddp/plW2IlooIzV2I4/9596458/388_CONTRATO.Zip HTTP 302
- https://download.microsoft.com/download/b/3/7/b375974d-d9a8-454e-b929-4ed9b8020121/6001.18000.080118-1840_x86fre_wave1_ServicePackInstaller-FRMCSP1_CD1.iso
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
388_CONTRATO.Zip
r8ookw.brighaccio.yachts/A05322ddp/plW2IlooIzV2I4/9596458/ |
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
r8ookw.brighaccio.yachts/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
r8ookw.brighaccio.yachts/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6001.18000.080118-1840_x86fre_wave1_ServicePackInstaller-FRMCSP1_CD1.iso
download.microsoft.com/download/b/3/7/b375974d-d9a8-454e-b929-4ed9b8020121/ Redirect Chain
|
0 0 |
Document
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| _cf_translation6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.r8ookw.brighaccio.yachts/ | Name: __cf_mw_byp Value: qa3h5.9qlB4zMgcPYNUj02w3WjmXaNphcnlRy0OJa70-1680102778-0-/A05322ddp/plW2IlooIzV2I4/9596458/388_CONTRATO.Zip |
|
r8ookw.brighaccio.yachts/ | Name: PHPSESSID Value: gqr44e2kr3bvhnmm2mu4hqgmoq |
|
r8ookw.brighaccio.yachts/ | Name: pais Value: US |
|
r8ookw.brighaccio.yachts/ | Name: estado Value: CFXX |
|
r8ookw.brighaccio.yachts/ | Name: cidade Value: CFXX |
|
r8ookw.brighaccio.yachts/ | Name: uid Value: 388_CONTRATO.Zip |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
download.microsoft.com
r8ookw.brighaccio.yachts
2600:141b:f000:d08c::317f
2606:4700:3037::ac43:9ee9
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
a6a5a39899683209917cf05c2114ffebbfea232e0bdc615ca3a66e620ac86a63
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016