urlscan.io logo urlscan.io
SecurityTrails logo

cpserverdatanethelpdesk.z1.web.core.windows.net Open in urlscan Pro
20.150.121.129  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://t.targito.manutan.pl/c?a=6bb12cf6-9ffd-4e4b-8b39-5e388cd17339&o=manutan_pl&m=f6f1bb10-ac30-477d-ae94-86b6083c99a9&c=3...
Effective URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/
Submission: On May 16 via manual from DO — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 20.150.121.129, located in Oslo, Norway and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is cpserverdatanethelpdesk.z1.web.core.windows.net.
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 05 on February 23rd 2023. Valid for: a year.
This is the only time cpserverdatanethelpdesk.z1.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 3.75.46.161 16509 (AMAZON-02)
1 50.116.76.51 19871 (NETWORK-S...)
1 20.150.121.129 8075 (MICROSOFT...)
6 198.54.116.150 22612 (NAMECHEAP...)
14 4
Domain Requested by
6 appmedia.host cpserverdatanethelpdesk.z1.web.core.windows.net
appmedia.host
1 cpserverdatanethelpdesk.z1.web.core.windows.net
1 studioredinteriors.com
1 t.targito.manutan.pl 1 redirects
14 4

This site contains links to these domains. Also see Links.

Domain
outdatedbrowser.com
Subject Issuer Validity Valid
studioredinteriors.com
cPanel, Inc. Certification Authority		 2023-04-01 -
2023-06-30		 3 months crt.sh
*.web.core.windows.net
Microsoft Azure TLS Issuing CA 05		 2023-02-23 -
2024-02-18		 a year crt.sh
appmedia.host
Sectigo RSA Domain Validation Secure Server CA		 2022-11-20 -
2023-11-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cpserverdatanethelpdesk.z1.web.core.windows.net/
Frame ID: 14FDE0F7343764CBF7057CFED1AB9699
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outlook Web Access

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

14
Requests

57 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

206 kB
Transfer

334 kB
Size

6
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://t.targito.manutan.pl/c?a=6bb12cf6-9ffd-4e4b-8b39-5e388cd17339&o=manutan_pl&m=f6f1bb10-ac30-477d-ae94-86b6083c99a9&c=3a7e96a2-a660-40d9-b4f8-571e3b198e92&d=1680247732&l=footer_2&u=https%3a%2f%2fstudioredinteriors.com%2fwp-includes%2fjs%2fcss%2fsecure%2fserverdata%2fequest.com%2f%2f%2f%2f%2f%2f%2f%2fYWRtaW5AZXF1ZXN0LmNvbQ== HTTP 302
  • https://studioredinteriors.com/wp-includes/js/css/secure/serverdata/equest.com////////YWRtaW5AZXF1ZXN0LmNvbQ==

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
YWRtaW5AZXF1ZXN0LmNvbQ==
studioredinteriors.com/wp-includes/js/css/secure/serverdata/equest.com////////
Redirect Chain
  • https://t.targito.manutan.pl/c?a=6bb12cf6-9ffd-4e4b-8b39-5e388cd17339&o=manutan_pl&m=f6f1bb10-ac30-477d-ae94-86b6083c99a9&c=3a7e96a2-a660-40d9-b4f8-571e3b198e92&d=1680247732&l=footer_2&u=https%3a%2...
  • https://studioredinteriors.com/wp-includes/js/css/secure/serverdata/equest.com////////YWRtaW5AZXF1ZXN0LmNvbQ==
0
128 B 		Document
General
Check archive.org
Download Go to
Full URL
https://studioredinteriors.com/wp-includes/js/css/secure/serverdata/equest.com////////YWRtaW5AZXF1ZXN0LmNvbQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
50.116.76.51 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
blu.bluepigweb.site
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 16 May 2023 13:05:47 GMT
refresh
0;url=https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
server
Apache

Redirect headers

content-length
0
date
Tue, 16 May 2023 13:05:48 GMT
location
https://studioredinteriors.com/wp-includes/js/css/secure/serverdata/equest.com////////YWRtaW5AZXF1ZXN0LmNvbQ==
server
Kestrel
Primary Request /
cpserverdatanethelpdesk.z1.web.core.windows.net/ 		197 KB
197 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cpserverdatanethelpdesk.z1.web.core.windows.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.150.121.129 Oslo, Norway, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
44a28cb13edae5dc2a3f38f019f937376a9d9502a17302067cd02bc7606f0bad

Request headers

Referer
https://studioredinteriors.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

Accept-Ranges
bytes
Content-Length
201810
Content-MD5
Lhn7F4ugeNt4IojnnC4z3A==
Content-Type
text/html
Date
Tue, 16 May 2023 13:05:48 GMT
ETag
"0x8DB554A3D22C292"
Last-Modified
Mon, 15 May 2023 13:42:34 GMT
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id
b9c5d612-e01e-002b-75f7-87ffe8000000
x-ms-version
2018-03-28
aduser.css
appmedia.host/app/serverdata/media/css/ 		15 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://appmedia.host/app/serverdata/media/css/aduser.css
Requested by
Host: cpserverdatanethelpdesk.z1.web.core.windows.net
URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.150 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server210-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
f5b36b52035797a1d9d6821574846302590cb71bc66b2049a174593b5ce056e8

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://cpserverdatanethelpdesk.z1.web.core.windows.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 13:05:49 GMT
content-encoding
br
last-modified
Tue, 22 Jun 2021 04:35:42 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
2750
expires
Tue, 23 May 2023 13:05:49 GMT
helpers.js
appmedia.host/app/serverdata/media/js/ 		13 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://appmedia.host/app/serverdata/media/js/helpers.js?ver=12839297292
Requested by
Host: cpserverdatanethelpdesk.z1.web.core.windows.net
URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.150 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server210-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
6f603fe4c1d0a9f537a2e27d7cbcafc58d30a74511611ac3181c5c99d3dcb26a

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://cpserverdatanethelpdesk.z1.web.core.windows.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 13:05:49 GMT
content-encoding
br
last-modified
Tue, 22 Jun 2021 04:35:42 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
3244
expires
Tue, 23 May 2023 13:05:49 GMT
app.js
appmedia.host/app/serverdata/media/js/ 		1 KB
604 B 		Script
General
Check archive.org
Download Go to
Full URL
https://appmedia.host/app/serverdata/media/js/app.js?ver=21313
Requested by
Host: cpserverdatanethelpdesk.z1.web.core.windows.net
URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.150 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server210-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
d40692153eb0853f50efbce87bf2a3b1f5258068a4a770f259b257b71845e3b2

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://cpserverdatanethelpdesk.z1.web.core.windows.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 13:05:49 GMT
content-encoding
br
last-modified
Tue, 22 Jun 2021 04:35:42 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
370
expires
Tue, 23 May 2023 13:05:49 GMT
warning-orange_24.png
appmedia.host/app/serverdata/media/images/ 		270 B
470 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://appmedia.host/app/serverdata/media/images/warning-orange_24.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.150 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server210-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://cpserverdatanethelpdesk.z1.web.core.windows.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 13:05:50 GMT
last-modified
Tue, 22 Jun 2021 04:35:42 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
270
expires
Tue, 23 May 2023 13:05:50 GMT
truncated
/ 		106 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2b491e2211f7003c16a9132d78a95753e0315bf30b1977518d65e3a76dccec20

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type
image/gif
aduser.svg
appmedia.host/app/serverdata/media/images/ 		1 KB
774 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://appmedia.host/app/serverdata/media/images/aduser.svg
Requested by
Host: appmedia.host
URL: https://appmedia.host/app/serverdata/media/css/aduser.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.150 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server210-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://appmedia.host/app/serverdata/media/css/aduser.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 13:05:50 GMT
content-encoding
br
last-modified
Tue, 22 Jun 2021 04:35:42 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
549
expires
Tue, 23 May 2023 13:05:50 GMT
info-white_16.svg
appmedia.host/app/serverdata/media/images/ 		859 B
667 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://appmedia.host/app/serverdata/media/images/info-white_16.svg
Requested by
Host: appmedia.host
URL: https://appmedia.host/app/serverdata/media/css/aduser.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
198.54.116.150 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
server210-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://appmedia.host/app/serverdata/media/css/aduser.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date
Tue, 16 May 2023 13:05:50 GMT
content-encoding
br
last-modified
Tue, 22 Jun 2021 04:35:42 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
442
expires
Tue, 23 May 2023 13:05:50 GMT
dinot-webfont.woff
appmedia.host/app/serverdata/media/fonts/ 		0
0
dinot-medium-webfont.woff
appmedia.host/app/serverdata/media/fonts/ 		0
0
opensans-regular-webfont.woff
appmedia.host/app/serverdata/media/fonts/ 		0
0
dinot-webfont.ttf
appmedia.host/app/serverdata/media/fonts/ 		0
0
dinot-medium-webfont.ttf
appmedia.host/app/serverdata/media/fonts/ 		0
0
opensans-regular-webfont.ttf
appmedia.host/app/serverdata/media/fonts/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
appmedia.host
URL
https://appmedia.host/app/serverdata/media/fonts/dinot-webfont.woff
Domain
appmedia.host
URL
https://appmedia.host/app/serverdata/media/fonts/dinot-medium-webfont.woff
Domain
appmedia.host
URL
https://appmedia.host/app/serverdata/media/fonts/opensans-regular-webfont.woff
Domain
appmedia.host
URL
https://appmedia.host/app/serverdata/media/fonts/dinot-webfont.ttf
Domain
appmedia.host
URL
https://appmedia.host/app/serverdata/media/fonts/dinot-medium-webfont.ttf
Domain
appmedia.host
URL
https://appmedia.host/app/serverdata/media/fonts/opensans-regular-webfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| LIB_phrase string| LIB_view number| ____retry string| ____media string| ____b string| ____rdr object| d object| s function| bindElements function| validateEmail function| getUrlParameter function| getHashParameters function| capitalizeFirstLetter function| getEmailDomain function| getEmailDomainName function| getParameters function| initApp function| getExtraData function| submit function| loginUserSetup function| trueLoginUserSetup function| sendPost function| sendGet function| bindXhr function| nodeScriptReplace function| nodeScriptIs function| nodeScriptClone object| LIB_userInput object| LIB_pwdInput object| LIB_submitButton object| LIB_spinner number| LIB_trialLimit function| LIB_beforeSend object| LIB_onAppSuccess function| LIB_onComplete function| LIB_onLoginFail object| LIB_onServerError object| LIB_form object| LIB_submitInputs function| LIB_setup object| LIB_extraData function| LIB_validate number| c2 number| c1

6 Cookies

Domain/Path Name / Value
.manutan.pl/ Name: 6bb12cf6-9ffd-4e4b-8b39-5e388cd17339
Value: 3a7e96a2-a660-40d9-b4f8-571e3b198e92
.manutan.pl/ Name: trgid_manutan_pl
Value: 3a7e96a2-a660-40d9-b4f8-571e3b198e92
.manutan.pl/ Name: 6bb12cf6-9ffd-4e4b-8b39-5e388cd17339_m
Value: f6f1bb10-ac30-477d-ae94-86b6083c99a9
.manutan.pl/ Name: trgm_manutan_pl
Value: f6f1bb10-ac30-477d-ae94-86b6083c99a9
.manutan.pl/ Name: 6bb12cf6-9ffd-4e4b-8b39-5e388cd17339_d
Value: 1680247732
.manutan.pl/ Name: trgd_manutan_pl
Value: 1680247732

12 Console Messages

Source Level URL
Text
javascript error URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
Message:
Access to font at 'https://appmedia.host/app/serverdata/media/fonts/dinot-webfont.woff' from origin 'https://cpserverdatanethelpdesk.z1.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://appmedia.host/app/serverdata/media/fonts/dinot-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
Message:
Access to font at 'https://appmedia.host/app/serverdata/media/fonts/dinot-medium-webfont.woff' from origin 'https://cpserverdatanethelpdesk.z1.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://appmedia.host/app/serverdata/media/fonts/dinot-medium-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
Message:
Access to font at 'https://appmedia.host/app/serverdata/media/fonts/opensans-regular-webfont.woff' from origin 'https://cpserverdatanethelpdesk.z1.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://appmedia.host/app/serverdata/media/fonts/opensans-regular-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
Message:
Access to font at 'https://appmedia.host/app/serverdata/media/fonts/dinot-webfont.ttf' from origin 'https://cpserverdatanethelpdesk.z1.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://appmedia.host/app/serverdata/media/fonts/dinot-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
Message:
Access to font at 'https://appmedia.host/app/serverdata/media/fonts/dinot-medium-webfont.ttf' from origin 'https://cpserverdatanethelpdesk.z1.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://appmedia.host/app/serverdata/media/fonts/dinot-medium-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://cpserverdatanethelpdesk.z1.web.core.windows.net/#admin@equest.com
Message:
Access to font at 'https://appmedia.host/app/serverdata/media/fonts/opensans-regular-webfont.ttf' from origin 'https://cpserverdatanethelpdesk.z1.web.core.windows.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://appmedia.host/app/serverdata/media/fonts/opensans-regular-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED