steanmcomnutiy.lee.mx Open in urlscan Pro
185.106.93.161 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://steanmcomnutiy.lee.mx/
Submission Tags: https://sinking.yachts sinking-yachts phishing Search All
Submission: On March 26 via api (March 26th 2023, 7:08:58 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 185.106.93.161, located in Moscow Oblast, Russian Federation and belongs to GALAXY-AS, RU. The main domain is steanmcomnutiy.lee.mx.
TLS certificate: Issued by R3 on March 26th 2023. Valid for: 3 months.

This is the only time steanmcomnutiy.lee.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
6	185.106.93.161 185.106.93.161	211409 (GALAXY-AS) (GALAXY-AS)
2	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2

6 185.106.93.161 (Moscow Oblast, Russian Federation)

ASN211409 (GALAXY-AS, RU)

steanmcomnutiy.lee.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	lee.mx steanmcomnutiy.lee.mx	43 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 334	48 KB
8	2

	Domain	Requested by
6	steanmcomnutiy.lee.mx	steanmcomnutiy.lee.mx
2	cdn.jsdelivr.net	steanmcomnutiy.lee.mx
8	2

This site contains no links.

Subject Issuer	Validity	Valid
steanmcomnutiy.lee.mx R3	`2023-03-26` - `2023-06-24`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-02` - `2023-06-01`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://steanmcomnutiy.lee.mx/
Frame ID: 70C62B8C755B3D2F50B76454E9A2C3A6
Requests: 7 HTTP requests in this frame

Frame: https://steanmcomnutiy.lee.mx/70ab0ju9h8f/
Frame ID: B9171054F7A9C6C27EDD2B6384874A5D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

404 Not Found

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

91 kB
Transfer

198 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
steanmcomnutiy.lee.mx/ 5 KB
3 KB 598ms
68ms Document
text/html 185.106.93.161
GALAXY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://steanmcomnutiy.lee.mx/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.93.161 Moscow Oblast, Russian Federation, ASN211409 (GALAXY-AS, RU),
Reverse DNS
Software: /
Resource Hash: 7f01b7fa2970d9b489171ebb0ab37e3ce10af0391c252e2d5eecb7fc50544d6a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000
content-encoding: gzip
content-type: text/html
date: Sun, 26 Mar 2023 19:08:53 GMT

GET
H2 200 react.production.min.js Show response
cdn.jsdelivr.net/npm/react@18.2.0/umd/ 10 KB
5 KB 85ms
33ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/react@18.2.0/umd/react.production.min.js

Requested by

Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b4969fa4ef3594324da2c6d78ce8766fbbc2fd121fff395aedf997db0a99a06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://steanmcomnutiy.lee.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Sun, 26 Mar 2023 19:08:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2802910
x-jsd-version: 18.2.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230087-FRA, cache-jnb7021-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"29f1-mAiaM9DPL6Sz4bqbfuubi6Csgqc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j861ZeLHRyXeDUirDKK3vivlBcIabGl0KBr3ei7ZqX%2FY3MvZaEf4QZI%2FmVfJtXQLuIBrH9mT%2FaYJm%2FJozNoRzF0Hd45Ue3ro7DXm0ti4KKY25Z%2FUX1z48ZsjQw66eHBgnDr7kpxwnFOcwykbTE0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 7ae1af558d8a2bb2-FRA

GET
H2 200 react-dom.production.min.js Show response
cdn.jsdelivr.net/npm/react-dom@18.2.0/umd/ 129 KB
43 KB 88ms
36ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/react-dom@18.2.0/umd/react-dom.production.min.js

Requested by

Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21758ed084cd0e37e735722ee4f3957ea960628a29dfa6c3ce1a1d47a2d6e4f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://steanmcomnutiy.lee.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Sun, 26 Mar 2023 19:08:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2802910
x-jsd-version: 18.2.0
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230095-FRA, cache-jnb7021-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"2032a-UG2RAMqgcABaiQvUlt5kxDfW0Ag"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2SqBxzd4iuD6qe31afFg%2Bhf4iVvjyNWbGZjwwp6SfnV84LEiBxp1p7RzXp9DxGwk0sMnDpufZdqmQ4oYpSFOuAjpdqezhfLKIMfmivfVpuKXtMtivd8JNj8XZEr27RABtGfI%2FFcBS0t27ZTTGik%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 7ae1af558d8f2bb2-FRA

GET
H2 200 n8y4rml7wm.min.js Show response
steanmcomnutiy.lee.mx/assets/sca03eu8cks/ 20 KB
10 KB 69ms
68ms Script
application/javascript 185.106.93.161
GALAXY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://steanmcomnutiy.lee.mx/assets/sca03eu8cks/n8y4rml7wm.min.js
Requested by: Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.93.161 Moscow Oblast, Russian Federation, ASN211409 (GALAXY-AS, RU),
Reverse DNS
Software: /
Resource Hash: ac96a7ddb1c8bbc5726296cdc1e89298cdbcb7586737121de2e137a1c30912bd

Request headers

Referer: https://steanmcomnutiy.lee.mx/
Origin: https://steanmcomnutiy.lee.mx
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Sun, 26 Mar 2023 19:08:53 GMT
content-encoding: gzip
last-modified: Sun, 26 Mar 2023 19:00:14 GMT
alt-svc: h3=":443"; ma=2592000
etag: W/"6420963e-4f62"
content-type: application/javascript

GET
H2 200 9ef95bb5fbecu69jfn.css
steanmcomnutiy.lee.mx/assets/x0586nuxcvf/ 5 KB
2 KB 68ms
68ms Stylesheet
text/css 185.106.93.161
GALAXY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://steanmcomnutiy.lee.mx/assets/x0586nuxcvf/9ef95bb5fbecu69jfn.css
Requested by: Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.106.93.161 Moscow Oblast, Russian Federation, ASN211409 (GALAXY-AS, RU),
Reverse DNS
Software: /
Resource Hash: 9ef95bb57cf3535ab6df019cac97894ab7b7f17cb32fbeef7861cb5110d6363b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://steanmcomnutiy.lee.mx/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Sun, 26 Mar 2023 19:08:53 GMT
content-encoding: gzip
last-modified: Sun, 26 Mar 2023 19:00:14 GMT
alt-svc: h3=":443"; ma=2592000
etag: W/"6420963e-1387"
content-type: text/css

POST
H3 200 / Show response
steanmcomnutiy.lee.mx/70ab0ju9h8f/ Frame B917 275 B
401 B 80ms
80ms Document
text/html 185.106.93.161
GALAXY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://steanmcomnutiy.lee.mx/70ab0ju9h8f/
Requested by: Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 185.106.93.161 Moscow Oblast, Russian Federation, ASN211409 (GALAXY-AS, RU),
Reverse DNS
Software: /
Resource Hash: e5c222d9b653dd691eaa55a85fa434c9176b2fb5aba503bfb03b3a85687b0634

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://steanmcomnutiy.lee.mx
Referer: https://steanmcomnutiy.lee.mx/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 26 Mar 2023 19:08:54 GMT

POST
H3 200 / Show response
steanmcomnutiy.lee.mx/api/getsiteconfig/ 463 B
377 B 92ms
92ms Fetch
application/json 185.106.93.161
GALAXY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://steanmcomnutiy.lee.mx/api/getsiteconfig/
Requested by: Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/assets/sca03eu8cks/n8y4rml7wm.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 185.106.93.161 Moscow Oblast, Russian Federation, ASN211409 (GALAXY-AS, RU),
Reverse DNS
Software: /
Resource Hash: a04efacd5769a43699a42202260f73c2daf47bfd1b92089a9c32032dd6f2df7d

Request headers

Referer: https://steanmcomnutiy.lee.mx/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
Content-Type: application/json;charset=utf-8

Response headers

date: Sun, 26 Mar 2023 19:08:54 GMT
content-encoding: gzip
content-type: application/json; charset=utf-8

GET
H3 200 fcff4301fbecu69jfn.woff2
steanmcomnutiy.lee.mx/assets/x0586nuxcvf/ 28 KB
29 KB 63ms
63ms Font
font/woff2 185.106.93.161
GALAXY-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://steanmcomnutiy.lee.mx/assets/x0586nuxcvf/fcff4301fbecu69jfn.woff2
Requested by: Host: steanmcomnutiy.lee.mx
URL: https://steanmcomnutiy.lee.mx/assets/x0586nuxcvf/9ef95bb5fbecu69jfn.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 185.106.93.161 Moscow Oblast, Russian Federation, ASN211409 (GALAXY-AS, RU),
Reverse DNS
Software: /
Resource Hash: fcff4301dc083af2be2b990bb6485e9e06ce9d2b373a7acf8a74f61ea69d861a

Request headers

Referer: https://steanmcomnutiy.lee.mx/assets/x0586nuxcvf/9ef95bb5fbecu69jfn.css
Origin: https://steanmcomnutiy.lee.mx
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date: Sun, 26 Mar 2023 19:08:54 GMT
last-modified: Sun, 26 Mar 2023 19:00:14 GMT
accept-ranges: bytes
etag: "6420963e-71b0"
content-length: 29104
content-type: font/woff2

Verdicts & Comments Add Verdict or Comment

Malicious task.url
Submitted on March 26th 2023, 7:09:02 pm UTC — From United States

Threats: Phishing Scam
Comment: This domain is present in the Sinking Yachts anti-phishing list. More Info: https://sinking.yachts

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			steanmcomnutiy.lee.mx/	1969-12-31 23:59:59	Name: hash Value: 4h7
			steanmcomnutiy.lee.mx/	1969-12-31 23:59:59	Name: token Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsaW5rX2lkIjoxOTExNDEsImlhdCI6MTY3OTg1NzczMywiZXhwIjoxNjc5ODYxMzMzLCJhY3Rpb25zIjpbImZha2VfdmlzaXQiXX0.D00Kxd2j2VM-20DSgPv71XjiEIRRWGuFTMFXJEwuDG4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
steanmcomnutiy.lee.mx
185.106.93.161
2606:4700::6810:5814
21758ed084cd0e37e735722ee4f3957ea960628a29dfa6c3ce1a1d47a2d6e4f7
4b4969fa4ef3594324da2c6d78ce8766fbbc2fd121fff395aedf997db0a99a06
7f01b7fa2970d9b489171ebb0ab37e3ce10af0391c252e2d5eecb7fc50544d6a
9ef95bb57cf3535ab6df019cac97894ab7b7f17cb32fbeef7861cb5110d6363b
a04efacd5769a43699a42202260f73c2daf47bfd1b92089a9c32032dd6f2df7d
ac96a7ddb1c8bbc5726296cdc1e89298cdbcb7586737121de2e137a1c30912bd
e5c222d9b653dd691eaa55a85fa434c9176b2fb5aba503bfb03b3a85687b0634
fcff4301dc083af2be2b990bb6485e9e06ce9d2b373a7acf8a74f61ea69d861a

steanmcomnutiy.lee.mx Open in urlscan Pro 185.106.93.161 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

91 kBTransfer

198 kBSize

2 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious task.url Submitted on March 26th 2023, 7:09:02 pm UTC — From United States

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

12 JavaScript Global Variables

2 Cookies

Indicators

steanmcomnutiy.lee.mx Open in urlscan Pro
185.106.93.161 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

91 kB
Transfer

198 kB
Size

2
Cookies

8 HTTP transactions
0 data transactions

Malicious task.url
Submitted on March 26th 2023, 7:09:02 pm UTC — From United States

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!