motebeck.ga Open in urlscan Pro
162.241.126.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://mail-epfl-com.moremurzreem.co/yq/#cmFtb24uemFyYXRlQGVwZmwuY2g
Effective URL:
https://motebeck.ga/0bkSz1YUQcRmyFVMjJlA9anigOIeLvxhfDrK7NsT4pZPtXuEGqo628W5wH3BS2FHXRcfy9lZjNqCMYnLAwEgtp4vmeOkJzsi...
Submission Tags: 7371192
Submission: On December 02 via api (December 2nd 2021, 3:52:39 pm UTC) from US — Scanned from DE

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 162.241.126.156, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is motebeck.ga.
TLS certificate: Issued by R3 on November 21st 2021. Valid for: 3 months.

This is the only time motebeck.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	192.3.231.159 192.3.231.159	36352 (AS-COLOCR...) (AS-COLOCROSSING)
3	162.241.126.156 162.241.126.156	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
6	3

1 192.3.231.159 (Los Angeles, United States)

ASN36352 (AS-COLOCROSSING, US)
PTR: 192-3-231-159-host.colocrossing.com

mail-epfl-com.moremurzreem.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.241.126.156 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-126-156.unifiedlayer.com

outlook-live-com-login.borelees.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
motebeck.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	motebeck.ga motebeck.ga	160 KB
1	borelees.ga outlook-live-com-login.borelees.ga Failed	539 B
1	moremurzreem.co mail-epfl-com.moremurzreem.co	2 KB
6	3

	Domain	Requested by
2	motebeck.ga	outlook-live-com-login.borelees.ga motebeck.ga
1	outlook-live-com-login.borelees.ga	mail-epfl-com.moremurzreem.co
1	mail-epfl-com.moremurzreem.co
6	3

This site contains no links.

Subject Issuer	Validity	Valid
*.moremurzreem.co ZeroSSL RSA Domain Secure Site CA	`2021-09-13` - `2021-12-12`	3 months	crt.sh
*.borelees.ga R3	`2021-11-21` - `2022-02-19`	3 months	crt.sh
motebeck.ga R3	`2021-11-21` - `2022-02-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://motebeck.ga/0bkSz1YUQcRmyFVMjJlA9anigOIeLvxhfDrK7NsT4pZPtXuEGqo628W5wH3BS2FHXRcfy9lZjNqCMYnLAwEgtp4vmeOkJzsiGx31QPWuKaI578BUTVoh06br49hIz12AJaD3v8ZEHyqgiwlpeQrPu6tMbjkRB7xm5XSfFsLcTUYoKVNW0CnOtkoQTuc7HKJRjxPwzVvN6rsChyYpZa4FOSiEWIUeA821qfnXbGmgL3B50DlM/pc0bYSgQ6GqzxURAetLNniXJhHfmDoWuaj893FZ7lIkTEVKwM1rv5yP2C4BO.php
Frame ID: 6FFDB6DE7876AE78577650B4183E6985
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web App

Page URL History Show full URLs

https://mail-epfl-com.moremurzreem.co/yq/ Page URL
https://outlook-live-com-login.borelees.ga/ Page URL
https://motebeck.ga/ramon.zarate@epfl.ch Page URL
https://motebeck.ga/0bkSz1YUQcRmyFVMjJlA9anigOIeLvxhfDrK7NsT4pZPtXuEGqo628W5wH3BS2FHXRcfy9lZjNqC... Page URL

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

218 kB
Transfer

233 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mail-epfl-com.moremurzreem.co/yq/ Page URL
https://outlook-live-com-login.borelees.ga/ Page URL
https://motebeck.ga/ramon.zarate@epfl.ch Page URL
https://motebeck.ga/0bkSz1YUQcRmyFVMjJlA9anigOIeLvxhfDrK7NsT4pZPtXuEGqo628W5wH3BS2FHXRcfy9lZjNqCMYnLAwEgtp4vmeOkJzsiGx31QPWuKaI578BUTVoh06br49hIz12AJaD3v8ZEHyqgiwlpeQrPu6tMbjkRB7xm5XSfFsLcTUYoKVNW0CnOtkoQTuc7HKJRjxPwzVvN6rsChyYpZa4FOSiEWIUeA821qfnXbGmgL3B50DlM/pc0bYSgQ6GqzxURAetLNniXJhHfmDoWuaj893FZ7lIkTEVKwM1rv5yP2C4BO.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response mail-epfl-com.moremurzreem.co/yq/	7 KB 2 KB	482ms 131ms	Document text/html	192.3.231.159 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://mail-epfl-com.moremurzreem.co/yq/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.3.231.159 Los Angeles, United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS 192-3-231-159-host.colocrossing.com Software nginx / Resource Hash `e3ab3f045e2bbcdcbe1d63847918e79f3809c60c113f1944243b77ef3b14a04d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Thu, 02 Dec 2021 15:52:35 GMT Content-Type text/html; charset=UTF-8 Content-Length 1929 Connection keep-alive Keep-Alive timeout=60 Vary Accept-Encoding Content-Encoding gzip
GET		/ outlook-live-com-login.borelees.ga/	0 0

GET H/1.1	200 OK	/ outlook-live-com-login.borelees.ga/	331 B 539 B	991ms 289ms	Document text/html	162.241.126.156 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://outlook-live-com-login.borelees.ga/ Requested by Host: mail-epfl-com.moremurzreem.co URL: https://mail-epfl-com.moremurzreem.co/yq/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.241.126.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-126-156.unifiedlayer.com Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://mail-epfl-com.moremurzreem.co/ Response headers Date Thu, 02 Dec 2021 15:52:35 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ramon.zarate@epfl.ch motebeck.ga/	348 B 730 B	520ms 141ms	Document text/html	162.241.126.156 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://motebeck.ga/ramon.zarate@epfl.ch Requested by Host: outlook-live-com-login.borelees.ga URL: https://outlook-live-com-login.borelees.ga/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.241.126.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-126-156.unifiedlayer.com Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://outlook-live-com-login.borelees.ga/ Response headers Date Thu, 02 Dec 2021 15:52:36 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request pc0bYSgQ6GqzxURAetLNniXJhHfmDoWuaj893FZ7lIkTEVKwM1rv5yP2C4BO.php Show response motebeck.ga/0bkSz1YUQcRmyFVMjJlA9anigOIeLvxhfDrK7NsT4pZPtXuEGqo628W5wH3BS2FHXRcfy9lZjNqCMYnLAwEgtp4vmeOkJzsiGx31QPWuKaI578BUTVoh06br49hIz12AJaD3v8ZEHyqgiwlpeQrPu6tMbjkRB7xm5XSfFsLcTUYoKVNW0CnOtkoQT...	159 KB 159 KB	381ms 381ms	Document text/html	162.241.126.156 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://motebeck.ga/0bkSz1YUQcRmyFVMjJlA9anigOIeLvxhfDrK7NsT4pZPtXuEGqo628W5wH3BS2FHXRcfy9lZjNqCMYnLAwEgtp4vmeOkJzsiGx31QPWuKaI578BUTVoh06br49hIz12AJaD3v8ZEHyqgiwlpeQrPu6tMbjkRB7xm5XSfFsLcTUYoKVNW0CnOtkoQTuc7HKJRjxPwzVvN6rsChyYpZa4FOSiEWIUeA821qfnXbGmgL3B50DlM/pc0bYSgQ6GqzxURAetLNniXJhHfmDoWuaj893FZ7lIkTEVKwM1rv5yP2C4BO.php Requested by Host: motebeck.ga URL: https://motebeck.ga/ramon.zarate@epfl.ch Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 162.241.126.156 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-126-156.unifiedlayer.com Software Apache / Resource Hash `a7c4ce29557ec5e3c6924bb90e4586f2cd028718167c17a3a4fbd548a5e0a21d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://motebeck.ga/ramon.zarate@epfl.ch Response headers Date Thu, 02 Dec 2021 15:52:36 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a` Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	55 KB 55 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708` Request headers Referer Origin https://motebeck.ga Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Content-Type application/octet-stream

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: outlook-live-com-login.borelees.ga
URL: https://outlook-live-com-login.borelees.ga/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			motebeck.ga/	1969-12-31 23:59:59	Name: PHPSESSID Value: c8828ae8ba5979790f82aa8b7743ee1d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail-epfl-com.moremurzreem.co
motebeck.ga
outlook-live-com-login.borelees.ga
outlook-live-com-login.borelees.ga
162.241.126.156
192.3.231.159
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
a7c4ce29557ec5e3c6924bb90e4586f2cd028718167c17a3a4fbd548a5e0a21d
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e3ab3f045e2bbcdcbe1d63847918e79f3809c60c113f1944243b77ef3b14a04d
fc7992bf2b5848f2df006acbf7fbdc144e4afac43cb7ed98b9c97b3c8c151aaa

motebeck.ga Open in urlscan Pro 162.241.126.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

67 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

218 kBTransfer

233 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

motebeck.ga Open in urlscan Pro
162.241.126.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

67 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

218 kB
Transfer

233 kB
Size

1
Cookies

6 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!