brbrbr.blob.core.windows.net Open in urlscan Pro
20.209.1.107 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://t.co/l2M8AtDbof
Effective URL:
https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9...
Submission: On April 07 via manual (April 7th 2024, 6:04:00 am UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 20.209.1.107, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is brbrbr.blob.core.windows.net.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 04 on April 4th 2024. Valid for: a year.

This is the only time brbrbr.blob.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bancolombia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1 1	2600:1f18:612... 2600:1f18:612b:4280:2ca4:8578:2c0:8bab	14618 (AMAZON-AES) (AMAZON-AES)
2 2	185.89.210.46 185.89.210.46	29990 (ASN-APPNEX) (ASN-APPNEX)
12	20.209.1.107 20.209.1.107	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
13	2

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4280:2ca4:8578:2c0:8bab (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

amazon.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.46 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 20.209.1.107 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

brbrbr.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	windows.net brbrbr.blob.core.windows.net	377 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 253	2 KB
1	tremorhub.com 1 redirects amazon.partners.tremorhub.com — Cisco Umbrella Rank: 6577	536 B
1	t.co t.co — Cisco Umbrella Rank: 663	757 B
13	4

	Domain	Requested by
12	brbrbr.blob.core.windows.net	t.co brbrbr.blob.core.windows.net
2	ib.adnxs.com	2 redirects
1	amazon.partners.tremorhub.com	1 redirects
1	t.co
13	4

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
*.blob.core.windows.net Microsoft Azure RSA TLS Issuing CA 04	`2024-04-04` - `2025-03-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Frame ID: AC6498E6221CDA1BD03EF06A4FB0A63C
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

solicitud

Page URL History Show full URLs

http://t.co/l2M8AtDbof HTTP 307
https://t.co/l2M8AtDbof Page URL
https://amazon.partners.tremorhub.com/sync?UIAM&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3F%2568%2574%2574%2570%2... HTTP 302
https://ib.adnxs.com/getuid?%68%74%74%70%73%3A%2F%2F%62%72%62%72%62%72%2E%62%6C%6F%62%2E%63%6F%72... HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2562%2572%2562%2... HTTP 302
https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=tela... Page URL

Page Statistics

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

377 kB
Transfer

374 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://t.co/l2M8AtDbof HTTP 307
https://t.co/l2M8AtDbof Page URL
https://amazon.partners.tremorhub.com/sync?UIAM&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2562%2572%2562%2572%2562%2572%252E%2562%256C%256F%2562%252E%2563%256F%2572%2565%252E%2577%2569%256E%2564%256F%2577%2573%252E%256E%2565%2574%252F%2577%2570%256F%2577%2565%2572%252F%2569%256E%2564%2565%2578%252E%2568%2574%256D%256C%3F%2Fecm3%3Fid%3D$UID%26ex%3Dappnexus.com%26%2Fecm3%3Fex%3Dtelaria.com%26id%3D%5BPARTNER_ID%5D HTTP 302
https://ib.adnxs.com/getuid?%68%74%74%70%73%3A%2F%2F%62%72%62%72%62%72%2E%62%6C%6F%62%2E%63%6F%72%65%2E%77%69%6E%64%6F%77%73%2E%6E%65%74%2F%77%70%6F%77%65%72%2F%69%6E%64%65%78%2E%68%74%6D%6C?/ecm3?id=$UID&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2562%2572%2562%2572%2562%2572%252E%2562%256C%256F%2562%252E%2563%256F%2572%2565%252E%2577%2569%256E%2564%256F%2577%2573%252E%256E%2565%2574%252F%2577%2570%256F%2577%2565%2572%252F%2569%256E%2564%2565%2578%252E%2568%2574%256D%256C%3F%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com%26%2Fecm3%3Fex%3Dtelaria.com%26id%3Dbc30f08b9c5c4f09930c187d36a9ea34 HTTP 302
https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://t.co/l2M8AtDbof HTTP 307
https://t.co/l2M8AtDbof

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

l2M8AtDbof
t.co/
Redirect Chain

http://t.co/l2M8AtDbof
https://t.co/l2M8AtDbof

1 KB
757 B

206ms
143ms

Document
text/html

104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/l2M8AtDbof

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 385
content-type: text/html; charset=utf-8
date: Sun, 07 Apr 2024 06:03:53 GMT
expires: Sun, 07 Apr 2024 06:08:53 GMT
perf: 7469935968
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: ba0f3158050bf5bda6f91aa95f926bc624d262b31f86bff1bd029063c12347ac
x-response-time: 115
x-transaction-id: 61a6eeae98966ef0
x-xss-protection: 0

Redirect headers

Location: https://t.co/l2M8AtDbof
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1

200
OK

Primary Request index.html Show response
brbrbr.blob.core.windows.net/wpower/
Redirect Chain

https://amazon.partners.tremorhub.com/sync?UIAM&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2562%2572%2562%2572%2562%2572%252E%2562%256C%256F%2562%252E%2563...
https://ib.adnxs.com/getuid?%68%74%74%70%73%3A%2F%2F%62%72%62%72%62%72%2E%62%6C%6F%62%2E%63%6F%72%65%2E%77%69%6E%64%6F%77%73%2E%6E%65%74%2F%77%70%6F%77%65%72%2F%69%6E%64%65%78%2E%68%74%6D%6C?/ecm3?...
https://ib.adnxs.com/bounce?%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2562%2572%2562%2572%2562%2572%252E%2562%256C%256F%2562%252E%2563%256F%2572%2565%252E%2577%2569%256E%2564%256F%2577%2...
https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34

3 KB
4 KB

550ms
165ms

Document
text/html

20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Requested by: Host: t.co
URL: https://t.co/l2M8AtDbof
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f7cd8beae28d5a2a6dc827d17bf6a65355bf00574b1e2c60b6aa8c80523bd424

Request headers

Referer: https://t.co/l2M8AtDbof
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Content-Length: 3491
Content-MD5: qVoWpx9E52JtxRc81ZX4FA==
Content-Type: text/html
Date: Sun, 07 Apr 2024 06:03:54 GMT
ETag: 0x8DC398A84E3B29D
Last-Modified: Fri, 01 Mar 2024 00:57:07 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 6e688924-a01e-0041-45b1-88b9b1000000
x-ms-version: 2009-09-19

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 9b7ae752-ba4c-4472-bc04-3c3d27f08084
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Sun, 07 Apr 2024 06:03:54 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 193.32.248.229; 193.32.248.229; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK styles.css
brbrbr.blob.core.windows.net/wpower/assets/css/ 3 KB
3 KB 150ms
149ms Stylesheet
text/css 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/css/styles.css
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ef0ea9ebcc6eb62c9a886a825c31be8907a1a261bff242ea84224ec9cfb4e70c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:08 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: 7ru/MDUJj5UFIxz8vy/zlA==
ETag: 0x8DC398A856F771B
Content-Type: text/css
x-ms-request-id: 6e6889ee-a01e-0041-7fb1-88b9b1000000
x-ms-version: 2009-09-19
Content-Length: 2959

GET
H/1.1 200
OK logo-of.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 15 KB
16 KB 491ms
124ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/logo-of.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: a85cee21cc711a99fc95a8f36a96b68ce166b422f007f74b509b695280748e81

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: F9mt83hXOsGIpAMfu6Kosw==
ETag: 0x8DC398A876CB499
Content-Type: image/png
x-ms-request-id: af3321a9-601e-004e-2eb1-88cfdd000000
x-ms-version: 2009-09-19
Content-Length: 15762

GET
H/1.1 200
OK ico-1.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 6 KB
6 KB 490ms
122ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/ico-1.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 665a17e8d0570e4d9e18445694e7ace8096510aa32ee6d3f0e4712bf8186087f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:11 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: K/kWb7GwixlDuXRPmy5WVg==
ETag: 0x8DC398A873BF047
Content-Type: image/png
x-ms-request-id: c53e9922-b01e-0062-77b1-882372000000
x-ms-version: 2009-09-19
Content-Length: 5698

GET
H/1.1 200
OK ico-2.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 7 KB
7 KB 476ms
123ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/ico-2.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: fc5a44c143208597694987cac5af950e15779936e578d691df27bb362fda94d6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:11 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: kuOlartNuQC6bbXa550vDw==
ETag: 0x8DC398A873B7B90
Content-Type: image/png
x-ms-request-id: 6afad45f-b01e-0010-24b1-88243d000000
x-ms-version: 2009-09-19
Content-Length: 7235

GET
H/1.1 200
OK ico-3.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 8 KB
8 KB 494ms
120ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/ico-3.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d0a7b5fb9c1f7838d220030b7937baa2ba683f4d6f32138522e6f40f408317dd

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:11 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: X2jbKnIhQ0bjfud+50zMqw==
ETag: 0x8DC398A8762FB72
Content-Type: image/png
x-ms-request-id: 6e688b83-a01e-0041-04b1-88b9b1000000
x-ms-version: 2009-09-19
Content-Length: 7984

GET
H/1.1 200
OK flyer.png
brbrbr.blob.core.windows.net/wpower/assets/img/ 324 KB
324 KB 605ms
148ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/flyer.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 700c368b3a6c9ef1a09df2e39c86826e73b528ea4b1da3f970f92783a6dc2d56

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:08 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: sXybNFiJO1oYA93Y+WmOJw==
ETag: 0x8DC398A859B1118
Content-Type: image/png
x-ms-request-id: 9d0409ef-c01e-0025-3fb1-884829000000
x-ms-version: 2009-09-19
Content-Length: 331793

GET
H/1.1 200
OK home.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 1 KB
1 KB 457ms
127ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/home.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f94f6d0e3ac20ca0c9913d7fceb0aa08ac549ed30f5a1719b7d868a206d2c1e9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:11 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: eO4KsmvYQDy9ggduSc8X9A==
ETag: 0x8DC398A873B54B8
Content-Type: image/png
x-ms-request-id: 8f41d3c2-a01e-001c-6db1-88b335000000
x-ms-version: 2009-09-19
Content-Length: 1105

GET
H/1.1 200
OK mov.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 2 KB
2 KB 454ms
124ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/mov.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2cd42610a30b3f691f7979f192ebbe43e14a017e36c868732a8bc9fab8f210eb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:12 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: Tr0nSxCCcHUJpNSlVT21+w==
ETag: 0x8DC398A87863A58
Content-Type: image/png
x-ms-request-id: 9d040992-c01e-0025-66b1-884829000000
x-ms-version: 2009-09-19
Content-Length: 1584

GET
H/1.1 200
OK exp.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 1 KB
2 KB 371ms
119ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/exp.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2bb7eb9fc9a93bc9215bb1b89ab879f69f6739e1592ab780f8693fab2936009a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:11 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: V/W1uZEQfv7id+VAcaPH3w==
ETag: 0x8DC398A873B2DC8
Content-Type: image/png
x-ms-request-id: 6e688af1-a01e-0041-79b1-88b9b1000000
x-ms-version: 2009-09-19
Content-Length: 1294

GET
H/1.1 200
OK conf.png
brbrbr.blob.core.windows.net/wpower/assets/img/icons/ 2 KB
2 KB 250ms
120ms Image
image/png 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brbrbr.blob.core.windows.net/wpower/assets/img/icons/conf.png
Requested by: Host: brbrbr.blob.core.windows.net
URL: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 7ca74fa0d97adf0c785c5ab27893421f391fb94188b694c5fe296d520c8e4cf6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 07 Apr 2024 06:03:55 GMT
Last-Modified: Fri, 01 Mar 2024 00:57:11 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: aisQNHM97KKT69Q26gp6Rg==
ETag: 0x8DC398A870B2C00
Content-Type: image/png
x-ms-request-id: 6e688a80-a01e-0041-0eb1-88b9b1000000
x-ms-version: 2009-09-19
Content-Length: 1875

GET
H/1.1 400
One of the request inputs is out of range. favicon.ico
brbrbr.blob.core.windows.net/ 226 B
485 B 121ms
121ms Other
application/xml 20.209.1.107
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://brbrbr.blob.core.windows.net/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.209.1.107 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Blob Service Version 1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 6e6c9f9f6805651a5796b0d3ac5b8f2cd6e456981d99ad01297273bb031111c8

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://brbrbr.blob.core.windows.net/wpower/index.html?/ecm3?id=5720203885085884513&ex=appnexus.com&/ecm3?ex=telaria.com&id=bc30f08b9c5c4f09930c187d36a9ea34
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-request-id: 9d040bf6-c01e-0025-2fb1-884829000000
Date: Sun, 07 Apr 2024 06:03:56 GMT
Server: Blob Service Version 1.0 Microsoft-HTTPAPI/2.0
Content-Length: 226
Content-Type: application/xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bancolombia (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 05:11:24	Name: muc Value: 95d8d995-9790-4231-ade8-0f589f583005
.tremorhub.com/	1970-01-21 04:27:06	Name: tvid Value: d0b1492331b44520b12718cafbc709cf
.tremorhub.com/	1970-01-21 05:17:09	Name: tv_UIAM Value: bc30f08b9c5c4f09930c187d36a9ea34
.adnxs.com/	1970-01-20 21:50:45	Name: XANDR_PANID Value: ObB_fZmWUycTcOCDcdneCqG-bkkfe12JEdLtp_m1xRGaFeafcmyFhq-cSwzrH3C0v8xU_Zu601Kj_suVAXIQbpUGFjOoDX-AIfFvrteOvK0.
.adnxs.com/	1970-01-21 05:17:09	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 21:50:45	Name: uuid2 Value: 5720203885085884513

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://brbrbr.blob.core.windows.net/favicon.ico Message: Failed to load resource: the server responded with a status of 400 (One of the request inputs is out of range.)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon.partners.tremorhub.com
brbrbr.blob.core.windows.net
ib.adnxs.com
t.co
104.244.42.69
185.89.210.46
20.209.1.107
2600:1f18:612b:4280:2ca4:8578:2c0:8bab
2bb7eb9fc9a93bc9215bb1b89ab879f69f6739e1592ab780f8693fab2936009a
2cd42610a30b3f691f7979f192ebbe43e14a017e36c868732a8bc9fab8f210eb
665a17e8d0570e4d9e18445694e7ace8096510aa32ee6d3f0e4712bf8186087f
6e6c9f9f6805651a5796b0d3ac5b8f2cd6e456981d99ad01297273bb031111c8
700c368b3a6c9ef1a09df2e39c86826e73b528ea4b1da3f970f92783a6dc2d56
7ca74fa0d97adf0c785c5ab27893421f391fb94188b694c5fe296d520c8e4cf6
a85cee21cc711a99fc95a8f36a96b68ce166b422f007f74b509b695280748e81
d0a7b5fb9c1f7838d220030b7937baa2ba683f4d6f32138522e6f40f408317dd
ef0ea9ebcc6eb62c9a886a825c31be8907a1a261bff242ea84224ec9cfb4e70c
f7cd8beae28d5a2a6dc827d17bf6a65355bf00574b1e2c60b6aa8c80523bd424
f94f6d0e3ac20ca0c9913d7fceb0aa08ac549ed30f5a1719b7d868a206d2c1e9
fc5a44c143208597694987cac5af950e15779936e578d691df27bb362fda94d6

brbrbr.blob.core.windows.net Open in urlscan Pro 20.209.1.107 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

2 Countries

377 kBTransfer

374 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

6 Cookies

1 Console Messages

Security Headers

Indicators

brbrbr.blob.core.windows.net Open in urlscan Pro
20.209.1.107 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

377 kB
Transfer

374 kB
Size

6
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!