urlscan.io logo urlscan.io
SecurityTrails logo

khetibuddy.com Open in urlscan Pro
162.241.85.104  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdY...
Effective URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee03...
Submission: On October 06 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 10 HTTP transactions. The main IP is 162.241.85.104, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is khetibuddy.com.
TLS certificate: Issued by R3 on August 29th 2021. Valid for: 3 months.
This is the only time khetibuddy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 54.232.11.140 16509 (AMAZON-02)
1 144.217.158.133 16276 (OVH)
1 10 162.241.85.104 46606 (UNIFIEDLA...)
10 2
Apex Domain
Subdomains		 Transfer
10 khetibuddy.com
khetibuddy.com
384 KB
1 nucmaeirl.net
nucmaeirl.net
22 KB
1 embluemail.com
nt.embluemail.com
213 B
10 3
Domain Requested by
10 khetibuddy.com 1 redirects nucmaeirl.net
khetibuddy.com
1 nucmaeirl.net
1 nt.embluemail.com 1 redirects
10 3

This site contains no links.

Subject Issuer Validity Valid
nucmaeirl.net
R3		 2021-09-13 -
2021-12-12		 3 months crt.sh
www.khetibuddy.com
R3		 2021-08-29 -
2021-11-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Frame ID: 4D6A54936ABCEC2219B8B6B96D38B378
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to Outlook

Page URL History Show full URLs

  1. https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6a... HTTP 302
    https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org Page URL
  2. https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... HTTP 302
    https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac... Page URL

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

406 kB
Transfer

604 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fklv4416%40bjc.org HTTP 302
    https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org Page URL
  2. https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$klv4416@bjc.org HTTP 302
    https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net%2Fm7m%2F503c06a6%2Fklv4416%40bjc.org HTTP 302
  • https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
klv4416@bjc.org
nucmaeirl.net/m7m/503c06a6/
Redirect Chain
  • https://nt.embluemail.com/p/cl?data=UHnQewQ69B59Q7iV68ePPHNVuxWlwxkvViYNP0gR8oFGOEJapWkbITcB5AAoK21k6aXdF6hYrn5dEu0y%2FzdYVjhFqM8cu1p%2FK7QxTUjcUH4%3D%21-%21be9hj9%21-%21https%3A%2F%2Fnucmaeirl.net...
  • https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org
22 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
144.217.158.133 Beauharnois, Canada, ASN16276 (OVH, FR),
Reverse DNS
r3.a1center.net
Software
Apache / PHP/5.6.40
Resource Hash

Request headers

Host
nucmaeirl.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 06 Oct 2021 11:55:28 GMT
Server
Apache
X-Powered-By
PHP/5.6.40
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

date
Wed, 06 Oct 2021 11:55:28 GMT
content-type
application/json
content-length
0
location
https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org
x-amzn-requestid
ffaaa9cf-c84b-4bec-a1c0-061418a83bb3
x-amz-apigw-id
GyM7hE91mjQFZSQ=
x-amzn-trace-id
Root=1-615d8eaf-731370f93b35c85c0781cfa9;Sampled=0
Primary Request PS-615d8eb828adb
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/
Redirect Chain
  • https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/$klv4416@bjc.org
  • https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
36 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Requested by
Host: nucmaeirl.net
URL: https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
8da6aafc135b80160a43544e618643ae446d9d425857663406fa21d77cf02203

Request headers

:method
GET
:authority
khetibuddy.com
:scheme
https
:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://nucmaeirl.net/
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://nucmaeirl.net/m7m/503c06a6/klv4416@bjc.org

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
3126
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
x-server-cache
false

Redirect headers

date
Wed, 06 Oct 2021 11:55:36 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
pragma
no-cache
location
./PS-615d8eb828adb
x-server-cache
false
set-cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4; path=/
f027171d068959bdd0493652931f6438858e1b41dd62e
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-7U2FJL/ 		103 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-7U2FJL/f027171d068959bdd0493652931f6438858e1b41dd62e
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/APP-7U2FJL/f027171d068959bdd0493652931f6438858e1b41dd62e
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 15:23:18 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public
accept-ranges
bytes
expires
max-age=A10368000, public
4f6246541be7d918d36b529f0edd80d16339578092811
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/4f6246541be7d918d36b529f0edd80d16339578092811
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/o/4f6246541be7d918d36b529f0edd80d16339578092811
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
content-encoding
gzip
last-modified
Sat, 23 Nov 2019 18:10:04 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=10368000
accept-ranges
bytes
content-length
1522
expires
max-age=A10368000, public
54546f90368d93d106e98735b672021e21b18dd194df8
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/ 		513 B
334 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/54546f90368d93d106e98735b672021e21b18dd194df8
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/e/54546f90368d93d106e98735b672021e21b18dd194df8
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
content-encoding
gzip
last-modified
Sun, 24 Nov 2019 01:44:20 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=10368000
accept-ranges
bytes
content-length
276
expires
max-age=A10368000, public
96df231f7d027045289e9581568be1b46dd934160318d
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/ 		84 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/96df231f7d027045289e9581568be1b46dd934160318d
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jq/96df231f7d027045289e9581568be1b46dd934160318d
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 16:23:14 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
expires
max-age=A10368000, public
b4113549710936256f390280e5dd18f8bd14d82e6679d
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/ 		50 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/b4113549710936256f390280e5dd18f8bd14d82e6679d
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/boot/b4113549710936256f390280e5dd18f8bd14d82e6679d
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
content-encoding
gzip
last-modified
Mon, 17 May 2021 16:23:24 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
expires
max-age=A10368000, public
d113219f448723ed6605389be61175492bdd85900d86f
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/d113219f448723ed6605389be61175492bdd85900d86f
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/jm/d113219f448723ed6605389be61175492bdd85900d86f
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Wed, 06 Oct 2021 11:55:36 GMT
content-encoding
gzip
last-modified
Fri, 03 Sep 2021 18:38:14 GMT
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private
accept-ranges
bytes
content-length
1433
expires
max-age=A10368000, public
api-eb065768341026d19f07b83491ddd489936fd151e2852
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-eb065768341026d19f07b83491ddd489936fd151e2852?email=klv4416@bjc.org&data=logo
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
175986272200fb72da9a598d30016bbda9ddcaa9e6e3f07eb94bc74196d4b805

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-eb065768341026d19f07b83491ddd489936fd151e2852?email=klv4416@bjc.org&data=logo
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 11:55:38 GMT
content-encoding
gzip
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/jpeg;
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
content-length
1262
expires
Thu, 19 Nov 1981 08:52:00 GMT
api-601b150dd23f86298d525be0d6139d813e64f99178474
khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/ 		299 KB
292 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-601b150dd23f86298d525be0d6139d813e64f99178474?email=klv4416@bjc.org&data=background
Requested by
Host: khetibuddy.com
URL: https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.85.104 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-241-85-104.unifiedlayer.com
Software
nginx/1.19.10 /
Resource Hash
345f500582fb5cfc20df5426c6b54bb0bcaa62eb0249a4a661dc9716a9edc006

Request headers

:path
/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/api-601b150dd23f86298d525be0d6139d813e64f99178474?email=klv4416@bjc.org&data=background
pragma
no-cache
cookie
PHPSESSID=a0baa1ae14e7a52b17c47733d96430b4
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
khetibuddy.com
referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://khetibuddy.com/m.m/0r1g1n_sse3/d653b5d28585ea0f0e7ef002ef7fee54ca16fcfd13bae90c0068fb0305ac6f1b7df7f0cda7d3ee033c4eebfcec4ebdea/PS-615d8eb828adb
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 06 Oct 2021 11:55:38 GMT
content-encoding
gzip
server
nginx/1.19.10
x-server-cache
false
vary
Accept-Encoding
content-type
image/jpeg;
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 private, must-revalidate
expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep

1 Cookies

Domain/Path Name / Value
khetibuddy.com/ Name: PHPSESSID
Value: a0baa1ae14e7a52b17c47733d96430b4