www.updatemail.cf Open in urlscan Pro
143.244.185.216  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.updatemail.cf/	13 KB 4 KB	523ms 165ms	Document text/html	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash f6a3008a285a6424d9c9ac1221af7550048ad814f4b49b7b5ab27cd2ee1b5927 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Thu, 25 Nov 2021 16:59:43 GMT Content-Type text/html Content-Length 4018 Connection keep-alive Last-Modified Thu, 25 Nov 2021 16:59:23 GMT ETag "35bd-5d19fe575156b-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip
GET H/1.1	200 OK	1dba3111b0418d6d209e83024863b800nbr1572797879.css www.updatemail.cf/css/	2 KB 1021 B	163ms 163ms	Stylesheet text/css	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.updatemail.cf/css/1dba3111b0418d6d209e83024863b800nbr1572797879.css Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash eab089b97d39b8bec02d3efe0b3a5333b43a62e1b9a8aebdb2bb27830449ce19 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Thu, 25 Nov 2021 16:59:43 GMT Content-Encoding gzip Last-Modified Thu, 25 Nov 2021 16:59:23 GMT Server nginx ETag W/"619fc0eb-61d" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Transfer-Encoding chunked Connection keep-alive Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	ba5ecdd16c000176c18fb0f77113c442nbr1572797879.css www.updatemail.cf/css/	70 KB 8 KB	336ms 172ms	Stylesheet text/css	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://www.updatemail.cf/css/ba5ecdd16c000176c18fb0f77113c442nbr1572797879.css Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash 8f873a895fdb5d88e660e1be9023185264ecfcc49557b81f04796c3b9a6fc42e Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Thu, 25 Nov 2021 16:59:43 GMT Content-Encoding gzip Last-Modified Thu, 25 Nov 2021 16:59:23 GMT Server nginx ETag W/"619fc0eb-118c1" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=315360000 Transfer-Encoding chunked Connection keep-alive Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	ii.png www.updatemail.cf/imgs/	2 KB 3 KB	477ms 159ms	Image image/png	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.updatemail.cf/imgs/ii.png Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Thu, 25 Nov 2021 16:59:43 GMT Last-Modified Thu, 25 Nov 2021 16:59:23 GMT Server nginx ETag "619fc0eb-9c7" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 2503 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	i.png www.updatemail.cf/imgs/	4 KB 4 KB	495ms 162ms	Image image/png	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.updatemail.cf/imgs/i.png Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Thu, 25 Nov 2021 16:59:43 GMT Last-Modified Thu, 25 Nov 2021 16:59:23 GMT Server nginx ETag "619fc0eb-e0b" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 3595 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	owa.png www.updatemail.cf/imgs/	6 KB 6 KB	496ms 162ms	Image image/png	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.updatemail.cf/imgs/owa.png Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Thu, 25 Nov 2021 16:59:43 GMT Last-Modified Thu, 25 Nov 2021 16:59:23 GMT Server nginx ETag "619fc0eb-16e0" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 5856 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	owa2.png www.updatemail.cf/imgs/	1 KB 2 KB	498ms 162ms	Image image/png	143.244.185.216 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://www.updatemail.cf/imgs/owa2.png Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 143.244.185.216 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS bizcloud-mail.massinvent.space Software nginx / Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers Date Thu, 25 Nov 2021 16:59:43 GMT Last-Modified Thu, 25 Nov 2021 16:59:23 GMT Server nginx ETag "619fc0eb-5a1" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 1441 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	jquery-3.4.1.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	86 KB 30 KB	38ms 8ms	Script application/javascript	152.199.19.160 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.4.1.min.js Requested by Host: www.updatemail.cf URL: https://www.updatemail.cf/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.19.160 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8E90) / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.updatemail.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Response headers date Thu, 25 Nov 2021 16:59:43 GMT content-encoding gzip x-content-type-options nosniff age 9909815 x-cache HIT content-length 30737 x-xss-protection 1; mode=block last-modified Thu, 02 May 2019 18:32:11 GMT server ECAcc (frc/8E90) etag "808705b151d51:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| process_submited_data function| validateEmail function| GetURLParameter function| get_domain_part_of_email function| mg

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.updatemail.cf/(Line 7) Message: The key "" is not recognized and ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
www.updatemail.cf
143.244.185.216
152.199.19.160
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
8f873a895fdb5d88e660e1be9023185264ecfcc49557b81f04796c3b9a6fc42e
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
eab089b97d39b8bec02d3efe0b3a5333b43a62e1b9a8aebdb2bb27830449ce19
f6a3008a285a6424d9c9ac1221af7550048ad814f4b49b7b5ab27cd2ee1b5927