www.nhuadongnai.vn
Open in
urlscan Pro
123.31.43.41
Malicious Activity!
Public Scan
Effective URL: https://www.nhuadongnai.vn/wp-content/uploads/index.html
Submission: On August 17 via manual from FR
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on August 6th 2020. Valid for: 3 months.
This is the only time www.nhuadongnai.vn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 162.0.229.39 162.0.229.39 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 123.31.43.41 123.31.43.41 | 45899 (VNPT-AS-V...) (VNPT-AS-VN VNPT Corp) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
1 1 | 2a01:111:f100... 2a01:111:f100:8000::4134:941b | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2620:1ec:4::156 2620:1ec:4::156 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
3 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium114-2.web-hosting.com
27543.auldi.xyz |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
portal.microsoftonline.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
office.com
portal.office.com |
|
1 |
microsoftonline.com
1 redirects
portal.microsoftonline.com |
286 B |
1 |
aspnetcdn.com
ajax.aspnetcdn.com |
30 KB |
1 |
nhuadongnai.vn
www.nhuadongnai.vn |
320 KB |
1 |
auldi.xyz
1 redirects
27543.auldi.xyz |
209 B |
3 | 5 |
Domain | Requested by | |
---|---|---|
1 | portal.office.com |
www.nhuadongnai.vn
|
1 | portal.microsoftonline.com | 1 redirects |
1 | ajax.aspnetcdn.com |
www.nhuadongnai.vn
|
1 | www.nhuadongnai.vn | |
1 | 27543.auldi.xyz | 1 redirects |
3 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.live.com |
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.nhuadongnai.vn Let's Encrypt Authority X3 |
2020-08-06 - 2020-11-04 |
3 months | crt.sh |
*.vo.msecnd.net Microsoft IT TLS CA 2 |
2020-03-18 - 2022-03-18 |
2 years | crt.sh |
portal.office.com GlobalSign Organization Validation CA - SHA256 - G3 |
2020-05-29 - 2022-05-30 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.nhuadongnai.vn/wp-content/uploads/index.html
Frame ID: 0CDE1C9B4D78BFAD4314401D3136F782
Requests: 6 HTTP requests in this frame
Frame:
https://portal.office.com/Prefetch/Prefetch.aspx
Frame ID: 1B5D32CCFB67393F3C6A6C4A0FE37453
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://27543.auldi.xyz/@9293@3645@
HTTP 302
https://www.nhuadongnai.vn/wp-content/uploads/index.html Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: get a new Microsoft account
Search URL Search Domain Scan URL
Title: Create one!
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Privacy & cookies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://27543.auldi.xyz/@9293@3645@
HTTP 302
https://www.nhuadongnai.vn/wp-content/uploads/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://portal.microsoftonline.com/Prefetch/Prefetch.aspx HTTP 302
- https://portal.office.com/Prefetch/Prefetch.aspx
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.html
www.nhuadongnai.vn/wp-content/uploads/ Redirect Chain
|
666 KB 320 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
277 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Prefetch.aspx
portal.office.com/Prefetch/ Frame 1B5D Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery function| get_email_hash function| validateEmail function| GetURLParameter2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
outlook.office365.com/ | Name: OIDC Value: 1 |
|
outlook.office365.com/ | Name: ClientId Value: 45679BDB69214A9EB06947DE31FB11B3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
27543.auldi.xyz
ajax.aspnetcdn.com
portal.microsoftonline.com
portal.office.com
www.nhuadongnai.vn
123.31.43.41
152.199.19.160
162.0.229.39
2620:1ec:4::156
2a01:111:f100:8000::4134:941b
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
9bd3af4578e571feb224c0eb8abdeece81824ea6b32cefb902206b3e594686fa
ba1f7e7f63a74f50f9e76b5cb1e445545126fac7bd1cb6b6d7fb5ab51acf9f66
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea