wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz
Open in
urlscan Pro
139.59.255.208
Malicious Activity!
Public Scan
Effective URL: https://wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/PS-6140a72ab4e73
Submission: On September 14 via manual from GB — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 2nd 2021. Valid for: 3 months.
This is the only time wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 18.231.80.194 18.231.80.194 | 16509 (AMAZON-02) (AMAZON-02) | |
1 11 | 139.59.255.208 139.59.255.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
10 | 1 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-231-80-194.sa-east-1.compute.amazonaws.com
nt.embluemail.com |
ASN14061 (DIGITALOCEAN-ASN, US)
vulvet.effectivestuffs.com | |
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
cloudns.nz
1 redirects
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz |
326 KB |
1 |
effectivestuffs.com
vulvet.effectivestuffs.com |
23 KB |
1 |
embluemail.com
1 redirects
nt.embluemail.com |
233 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz |
1 redirects
vulvet.effectivestuffs.com
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz |
1 | vulvet.effectivestuffs.com | |
1 | nt.embluemail.com | 1 redirects |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
vulvet.effectivestuffs.com R3 |
2021-09-02 - 2021-12-01 |
3 months | crt.sh |
www.wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz R3 |
2021-09-02 - 2021-12-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/PS-6140a72ab4e73
Frame ID: 8B396C1F271D41D360A5D8518B9204E0
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
A6A9655CDEBF38FD4C68C4489776E4736140A72B20280Page URL History Show full URLs
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2...
HTTP 302
https://vulvet.effectivestuffs.com/bWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ== Page URL
-
https://wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/$&jKvuohDkt0b18SwubSjMenf...
HTTP 302
https://wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/PS-6140a72ab4e73 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fvulvet.effectivestuffs.com%2FbWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ==
HTTP 302
https://vulvet.effectivestuffs.com/bWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ== Page URL
-
https://wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/$&jKvuohDkt0b18SwubSjMenfKHBnLkOamHpMwp2o4IXosFW04Pjs3WNzIU4lIcdc0ttyuJsX4X9yybHe01G8VqIIaGCzjOfulAhqmxXxRryKFLmWPum3a4OHssTRvXuvoe4QN56CGyfOIDJ81b794Lt4h5uo66tLe4S2Q3pgSpJdl4JoSkjPIHVsEoCJwawDzoJqv04v0?client=bWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ==
HTTP 302
https://wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/PS-6140a72ab4e73 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fvulvet.effectivestuffs.com%2FbWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ== HTTP 302
- https://vulvet.effectivestuffs.com/bWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ==
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
bWFuZHkuYmVhdWNoYW1wQHJlbmlzaGF3LmNvbQ==
vulvet.effectivestuffs.com/ Redirect Chain
|
23 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
PS-6140a72ab4e73
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/ Redirect Chain
|
38 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0628a02c4c79b602a38e4e5fc8457a667d71b49d4386f
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/APP-BXX0DV/ |
103 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
260f8cb03867c1d4fe5c88644677e962023aab45d4a97
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/o/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6a4576dca4fd408716e7b36b896a932c0485742f2c80e
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/e/ |
513 B 635 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
f0467040caec94a66f3ed74281423869885a7dcb657b2
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/jq/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d645077fd5c444263f93e6a6c8794ba0e82c8b760a821
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/boot/ |
50 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6ae106a7674f983cad75e42c2887bd208fb4c46634095
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/jm/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-66b998e6e84d7f7b1c408764f3d54aa4200cc85a72632
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/ |
9 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-451897db663de82a923c46baa0c67f0846578ef40247c
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/JZDbKXAP2RBTUejEYLFYi4LpdK2zvuwgWHqh5W7PPCBTmE6hTd/ |
258 KB 246 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz/ | Name: PHPSESSID Value: biqdd0705r9go38tbvumsin83d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
nt.embluemail.com
vulvet.effectivestuffs.com
wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz
139.59.255.208
18.231.80.194
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0b41a1b2450b9ec870a5da4dbf0f5060c83bdc80704fd7ba07d7995e3f24fade
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6507d6288ea9a2b5d15664894b1f12339f27b4aad496e6b40f332b17918ccc0a
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
ab264b8c7a87cc2c6fbb0e2474b18577fe53020025e92d00c8f60befc885ac0f
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7