mariai.com.co - urlscan.io

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 192.185.174.75, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is mariai.com.co.
TLS certificate: Issued by R3 on October 1st 2022. Valid for: 3 months.

This is the only time mariai.com.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 2	192.185.174.75 192.185.174.75	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	194.187.114.156 194.187.114.156	35350 (AS_SCHWAR...) (AS_SCHWARZ_PHARMA_AG Alfred-Nobel-Str. 10)
1	2620:1ec:bdf::45 2620:1ec:bdf::45	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	4

2 192.185.174.75 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 192-185-174-75.unifiedlayer.com

mariai.com.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.187.114.156 (Anderlecht, Belgium)

ASN35350 (AS_SCHWARZ_PHARMA_AG Alfred-Nobel-Str. 10, DE)

fs.ucb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::45 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	mariai.com.co 1 redirects mariai.com.co	525 KB
1	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1074	2 KB
1	ucb.com fs.ucb.com	30 KB
3	3

	Domain	Requested by
2	mariai.com.co	1 redirects
1	aadcdn.msauth.net	mariai.com.co
1	fs.ucb.com	mariai.com.co
3	3

This site contains no links.

Subject Issuer	Validity	Valid
mariai.com.co R3	`2022-10-01` - `2022-12-30`	3 months	crt.sh
fs.ucb.com Sectigo RSA Organization Validation Secure Server CA	`2022-10-28` - `2023-10-28`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2022-08-23` - `2023-08-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mariai.com.co/of/
Frame ID: 8517EEFF00B182706F7C5635DEEB620F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

https://mariai.com.co/of HTTP 301
https://mariai.com.co/of/ Page URL

Page Statistics

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

557 kB
Transfer

1273 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mariai.com.co/of HTTP 301
https://mariai.com.co/of/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
mariai.com.co/of/
Redirect Chain

https://mariai.com.co/of
https://mariai.com.co/of/

722 KB
525 KB

131ms
130ms

Document
text/html

192.185.174.75
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://mariai.com.co/of/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.174.75 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 192-185-174-75.unifiedlayer.com
Software: Apache /
Resource Hash: 8e2db87f7be02f630bdf46c7e6950873628176dc0df0efffa980301a6265c897

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
content-encoding: gzip
content-type: text/html
date: Fri, 25 Nov 2022 00:26:30 GMT
last-modified: Thu, 15 Sep 2022 19:45:46 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

content-length: 233
content-type: text/html; charset=iso-8859-1
date: Fri, 25 Nov 2022 00:26:30 GMT
location: https://mariai.com.co/of/
server: Apache

GET
H/1.1 200
OK style.css
fs.ucb.com/adfs/portal/css/ 30 KB
30 KB 130ms
24ms Stylesheet
text/css 194.187.114.156
AS_SCHWARZ_PHARMA...

General

Check archive.org

Show headers Download Go to

Full URL

https://fs.ucb.com/adfs/portal/css/style.css?id=559755FCDD8C380D22FF7173B086021EEB91F9DBDEBA32FF9326B088623EEBAA

Requested by

Host: mariai.com.co
URL: https://mariai.com.co/of/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

194.187.114.156 Anderlecht, Belgium, ASN35350 (AS_SCHWARZ_PHARMA_AG Alfred-Nobel-Str. 10, DE),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

c9130ec8ea178999931fa67e9fb88740d9fecd894333b40860ef89aeda9e9688

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mariai.com.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;
X-Content-Type-Options: nosniff
Date: Fri, 25 Nov 2022 00:26:29 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 559755FCDD8C380D22FF7173B086021EEB91F9DBDEBA32FF9326B088623EEBAA
Content-Type: text/css
Content-Length: 30446
X-XSS-Protection: 1; mode=block
Expires: Sun, 25 Dec 2022 00:26:30 GMT

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/shared/1.0/content/images/ 4 KB
2 KB 83ms
18ms Image
image/svg+xml 2620:1ec:bdf::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: mariai.com.co
URL: https://mariai.com.co/of/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mariai.com.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 25 Nov 2022 00:26:30 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
x-cache: TCP_HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 17 Jan 2020 19:28:38 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D79B8373CB2849
x-azure-ref: 0tguAYwAAAABCg9kCOtBER7MeSCgsj25IQU1TMDRFREdFMTkxNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8259bc9c-401e-006f-235e-00fc4e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19

GET
DATA 200
OK truncated
/ 411 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a26533ae425bfd7f89f7b3b517ead714a5a79a44e28d05a103f9b8204f7b809

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 517 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91b5881b22f1828341061482662b8107c35e4dac7d422f9ca5398c95cbc056d5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
fs.ucb.com
mariai.com.co
192.185.174.75
194.187.114.156
2620:1ec:bdf::45
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0a26533ae425bfd7f89f7b3b517ead714a5a79a44e28d05a103f9b8204f7b809
8e2db87f7be02f630bdf46c7e6950873628176dc0df0efffa980301a6265c897
91b5881b22f1828341061482662b8107c35e4dac7d422f9ca5398c95cbc056d5
c9130ec8ea178999931fa67e9fb88740d9fecd894333b40860ef89aeda9e9688

mariai.com.co Open in urlscan Pro 192.185.174.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

557 kBTransfer

1273 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

0 Cookies

Indicators

mariai.com.co Open in urlscan Pro
192.185.174.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

557 kB
Transfer

1273 kB
Size

0
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!