urlscan.io logo urlscan.io
SecurityTrails logo

budsbud.com Open in urlscan Pro
134.19.178.41  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://budsbud.com/P2dvZHM9MVE4Sjc0NDEwVDFlMUQ=
Submission: On December 21 via manual from US — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 134.19.178.41, located in Netherlands and belongs to GLOBALLAYER, NL. The main domain is budsbud.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 3rd 2021. Valid for: 3 months.
This is the only time budsbud.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 134.19.178.41 49453 (GLOBALLAYER)
2 157.7.189.209 7506 (INTERQ GM...)
1 151.139.128.11 20446 (HIGHWINDS3)
4 3
Apex Domain
Subdomains		 Transfer
2 seiwa-st.com
seiwa-st.com
1 KB
1 imageshack.com
imagizer.imageshack.com
128 KB
1 budsbud.com
budsbud.com
645 B
4 3
Domain Requested by
2 seiwa-st.com budsbud.com
seiwa-st.com
1 imagizer.imageshack.com seiwa-st.com
1 budsbud.com
4 3

This site contains no links.

Subject Issuer Validity Valid
budsbud.com
cPanel, Inc. Certification Authority		 2021-12-03 -
2022-03-03		 3 months crt.sh
seiwa-st.com
R3		 2021-10-22 -
2022-01-20		 3 months crt.sh
*.imageshack.com
Go Daddy Secure Certificate Authority - G2		 2021-02-03 -
2022-03-07		 a year crt.sh

This page contains 2 frames:

Primary Page: https://budsbud.com/P2dvZHM9MVE4Sjc0NDEwVDFlMUQ=
Frame ID: 98608CE17774A0B26BC52FDF3958C433
Requests: 1 HTTP requests in this frame

Frame: https://seiwa-st.com/ain/?gods=1Q8J74410T1e1D
Frame ID: CCF8AB66CE8942B143B9F7900A315B3A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

130 kB
Transfer

129 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request P2dvZHM9MVE4Sjc0NDEwVDFlMUQ=
budsbud.com/ 		366 B
645 B 		Document
General
Check archive.org
Download Go to
Full URL
https://budsbud.com/P2dvZHM9MVE4Sjc0NDEwVDFlMUQ=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
134.19.178.41 , Netherlands, ASN49453 (GLOBALLAYER, NL),
Reverse DNS
hosted-by.lvpshosting.com
Software
Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.5.38
Resource Hash
8174fa78a733467f1ac963c15abc0cfc1debbe037fcc386ff16881e51f121b6f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9

Response headers

Date
Tue, 21 Dec 2021 03:06:49 GMT
Server
Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By
PHP/5.5.38
X-Mod-Pagespeed
1.12.34.2-0
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=0, no-cache
Content-Length
265
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
/
seiwa-st.com/ain/ Frame CCF8 		999 B
675 B 		Document
General
Check archive.org
Download Go to
Full URL
https://seiwa-st.com/ain/?gods=1Q8J74410T1e1D
Requested by
Host: budsbud.com
URL: https://budsbud.com/P2dvZHM9MVE4Sjc0NDEwVDFlMUQ=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
157.7.189.209 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS
users030.vip.heteml.jp
Software
Apache / PHP/7.4.12
Resource Hash
905a0988c7323fa4dfa5bc671186178e3ab79c7c2b604099f3f845af67e2f5c4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
nl-NL,nl;q=0.9
Referer
https://budsbud.com/

Response headers

date
Tue, 21 Dec 2021 03:06:51 GMT
content-type
text/html; charset=UTF-8
content-length
509
server
Apache
x-powered-by
PHP/7.4.12
vary
Range,Accept-Encoding
accept-ranges
none
content-encoding
gzip
astro.css
seiwa-st.com/ain/ Frame CCF8 		727 B
503 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://seiwa-st.com/ain/astro.css
Requested by
Host: seiwa-st.com
URL: https://seiwa-st.com/ain/?gods=1Q8J74410T1e1D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
157.7.189.209 , Japan, ASN7506 (INTERQ GMO Internet,Inc, JP),
Reverse DNS
users030.vip.heteml.jp
Software
Apache /
Resource Hash
657750ef96e803d0fad28cd1701403acc36d96baefc041d6a25a788e33de2ee8

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://seiwa-st.com/ain/?gods=1Q8J74410T1e1D
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 03:06:51 GMT
content-encoding
gzip
last-modified
Mon, 20 Dec 2021 19:58:52 GMT
server
Apache
vary
Range,Accept-Encoding
content-type
text/css
accept-ranges
none
content-length
336
rXsGdD.png
imagizer.imageshack.com/img924/3772/ Frame CCF8 		127 KB
128 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://imagizer.imageshack.com/img924/3772/rXsGdD.png
Requested by
Host: seiwa-st.com
URL: https://seiwa-st.com/ain/?gods=1Q8J74410T1e1D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx/1.2.8 /
Resource Hash
9e14734d8de60b0274ec30a7f72eb1a5353cb4f93e2db8db8b7b3a0d1a954bdd

Request headers

Accept-Language
nl-NL,nl;q=0.9
Referer
https://seiwa-st.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-varnish-ip
38.99.77.68
date
Tue, 21 Dec 2021 03:06:51 GMT
via
1.1 varnish
xkey
imageshack.imagizer.com
age
2713
accept-ranges
bytes
x-varnish-port
17001
x-original-filesize
129981
x-original-response-code
200
access-control-allow-methods
GET, POST, OPTIONS, HEAD, GET, POST, OPTIONS
content-length
129981
x-varnish
810919036 810865739
s3-cache-processed
MISS:imageshack.imagizer.com/processed/585f90ace561d83561377037d4b92d35
server
nginx/1.2.8
x-origin-fetch-time
36
etag
59cf3a16b33df588c1f83faa48d92c61
x-hw
1640056011.cds064.lo4.hn,1640056011.cds269.lo4.c
x-imagizer-host
imageshack.imagizer.com
access-control-allow-origin
*, imageshack.com, *
access-control-expose-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length,X-Original-Filesize,X-Original-Resolution,X-CSRF-TOKEN
cache-control
max-age=2592000, public
access-control-allow-credentials
true
x-original-resolution
1078x521
x-varnish-hits
40
content-type
image/png
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length,X-Original-Filesize,X-Original-Resolution,X-CSRF-TOKEN, Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since
x-cache-hits
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies