rwdifference.se
Open in
urlscan Pro
2a02:250:0:8::54
Public Scan
Effective URL: http://rwdifference.se/wp-content/updatespp/
Submission Tags: phishing malicious Search All
Submission: On February 26 via api from US
Summary
This is the only time rwdifference.se was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 81.19.78.85 81.19.78.85 | 24638 (RAMBLER-T...) (RAMBLER-TELECOM-AS) | |
1 | 52.239.128.33 52.239.128.33 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a02:250:0:8::54 2a02:250:0:8::54 | 39570 (LOOPIA) (LOOPIA) | |
2 | 2 |
ASN24638 (RAMBLER-TELECOM-AS, RU)
PTR: mail.rambler.ru
mail.rambler.ru |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
newupdatespp.z7.web.core.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
rwdifference.se
rwdifference.se |
230 B |
1 |
windows.net
newupdatespp.z7.web.core.windows.net |
421 B |
1 |
rambler.ru
1 redirects
mail.rambler.ru |
603 B |
2 | 3 |
Domain | Requested by | |
---|---|---|
1 | rwdifference.se | |
1 | newupdatespp.z7.web.core.windows.net | |
1 | mail.rambler.ru | 1 redirects |
2 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.web.core.windows.net Microsoft IT TLS CA 4 |
2020-01-27 - 2022-01-27 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://rwdifference.se/wp-content/updatespp/
Frame ID: F6CFA93A876B1205566FFA16B8B3B16B
Requests: 2 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://mail.rambler.ru/m/redirect?url=https%3A//newupdatespp.z7.web.core.windows.net/&hash=1568d2cc...
HTTP 302
https://newupdatespp.z7.web.core.windows.net/ Page URL
- http://rwdifference.se/wp-content/updatespp/ Page URL
Detected technologies
Microsoft HTTPAPI (Web Servers) ExpandDetected patterns
- headers server /Microsoft-HTTPAPI(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://mail.rambler.ru/m/redirect?url=https%3A//newupdatespp.z7.web.core.windows.net/&hash=1568d2cca01a364fe1af8d5134ac662e
HTTP 302
https://newupdatespp.z7.web.core.windows.net/ Page URL
- http://rwdifference.se/wp-content/updatespp/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://mail.rambler.ru/m/redirect?url=https%3A//newupdatespp.z7.web.core.windows.net/&hash=1568d2cca01a364fe1af8d5134ac662e HTTP 302
- https://newupdatespp.z7.web.core.windows.net/
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
newupdatespp.z7.web.core.windows.net/ Redirect Chain
|
91 B 421 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
rwdifference.se/wp-content/updatespp/ |
1 B 230 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.rambler.ru
newupdatespp.z7.web.core.windows.net
rwdifference.se
2a02:250:0:8::54
52.239.128.33
81.19.78.85
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
c0a71a17e7a3a728c83890cca37c7adc804d7363d3c608dd05abdff94a643f55