data-enlister.rocks Open in urlscan Pro
31.220.48.56 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wap.datastarttls.com/5ye7o
Effective URL:
https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631-...
Submission: On April 03 via manual (April 3rd 2019, 10:18:05 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 31.220.48.56, located in Lithuania and belongs to AS-HOSTINGER, LT. The main domain is data-enlister.rocks.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 27th 2019. Valid for: 3 months.

This is the only time data-enlister.rocks was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:30:... 2606:4700:30::681c:16ce	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
8	31.220.48.56 31.220.48.56	47583 (AS-HOSTINGER) (AS-HOSTINGER)
3	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
11	2

1 2606:4700:30::681c:16ce (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

wap.datastarttls.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 31.220.48.56 (Lithuania)

ASN47583 (AS-HOSTINGER, LT)

data-enlister.rocks	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	data-enlister.rocks data-enlister.rocks	512 KB
3	msauth.net aadcdn.msauth.net	2 KB
1	datastarttls.com 1 redirects wap.datastarttls.com	523 B
11	3

	Domain	Requested by
8	data-enlister.rocks	data-enlister.rocks
3	aadcdn.msauth.net	data-enlister.rocks
1	wap.datastarttls.com	1 redirects
11	3

This site contains no links.

Subject Issuer	Validity	Valid
data-enlister.rocks Let's Encrypt Authority X3	`2019-03-27` - `2019-06-25`	3 months	crt.sh
aadcdn.msauth.net Microsoft IT TLS CA 4	`2018-11-07` - `2020-11-07`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk
Frame ID: 8D0015979A646DDD195CAD5D693B2FFC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://wap.datastarttls.com/5ye7o HTTP 302
https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

514 kB
Transfer

924 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://wap.datastarttls.com/5ye7o HTTP 302
https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response data-enlister.rocks/caRT/ Redirect Chain https://wap.datastarttls.com/5ye7o https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5Q...	926 B 810 B	512ms 118ms	Document text/html	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `6cf3db65325b498e1a048113759b1d03c82c06bea1a7cc44a8c0e7e34f416b83` Request headers Host data-enlister.rocks Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:47 GMT Server Apache/2.4.18 Last-Modified Wed, 27 Mar 2019 16:39:51 GMT ETag "39e-585161629d1ef-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 482 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html Redirect headers status 302 date Wed, 03 Apr 2019 22:17:47 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d1979677b6760ade6d851219b900ae8f81554329866; expires=Thu, 02-Apr-20 22:17:46 GMT; path=/; domain=.datastarttls.com; HttpOnly x-powered-by PHP/7.2.15 location https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk cache-control no-cache, no-store, must-revalidate, max-age=0 x-turbo-charged-by LiteSpeed expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4c1e6a238a7d9750-FRA
GET H/1.1	200 OK	app.29c6715b.js Show response data-enlister.rocks/caRT/js/	11 KB 4 KB	119ms 118ms	Script application/javascript	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://data-enlister.rocks/caRT/js/app.29c6715b.js Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `27f79b1c36f3ede7c76f9e0756c1ae4b1c96ce4c54174d63fa337ce597568e6c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:47 GMT Content-Encoding gzip Last-Modified Sun, 31 Mar 2019 08:09:36 GMT Server Apache/2.4.18 ETag "2cf4-5855f6cbf33e4-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 3778
GET H/1.1	200 OK	chunk-vendors.ef694eec.js Show response data-enlister.rocks/caRT/js/	85 KB 31 KB	243ms 124ms	Script application/javascript	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://data-enlister.rocks/caRT/js/chunk-vendors.ef694eec.js Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `eae31e5464d3d12f026f6c5d63d5f6c30a71c994eac5d8bc143e186a75f79b53` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:47 GMT Content-Encoding gzip Last-Modified Wed, 27 Mar 2019 16:40:10 GMT Server Apache/2.4.18 ETag "154da-58516174fd8ae-gzip" Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 31535
GET H/1.1	200 OK	styles.css data-enlister.rocks/caRT/assets/	159 KB 19 KB	240ms 122ms	Stylesheet text/css	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://data-enlister.rocks/caRT/assets/styles.css Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `a9ab616536957d2ec7f541457e30440089fdc3eaca69198769b4ad1683ffb5bb` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:47 GMT Content-Encoding gzip Last-Modified Wed, 27 Mar 2019 16:39:59 GMT Server Apache/2.4.18 ETag "27d23-5851616ae9cd0-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 19630
GET H/1.1	200 OK	jquery.js Show response data-enlister.rocks/caRT/assets/	297 KB 87 KB	496ms 138ms	Script application/javascript	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Full URL https://data-enlister.rocks/caRT/assets/jquery.js Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `ae7d52486720c57573768c2562d96111092f122924d151e9ed23d150ec00c9ae` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:48 GMT Content-Encoding gzip Last-Modified Wed, 27 Mar 2019 16:39:57 GMT Server Apache/2.4.18 ETag "4a534-58516168ae0b4-gzip" Vary Accept-Encoding Content-Type application/javascript Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99
GET H/1.1	200 OK	logo.ee5c8d9f.svg data-enlister.rocks/caRT/img/	4 KB 4 KB	118ms 117ms	Image image/svg+xml	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://data-enlister.rocks/caRT/img/logo.ee5c8d9f.svg Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:48 GMT Last-Modified Wed, 27 Mar 2019 16:40:04 GMT Server Apache/2.4.18 ETag "e43-5851616f15a24" Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 3651
GET H2	200	picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg aadcdn.msauth.net/ests/2.1/content/images/	756 B 693 B	60ms 15ms	Image image/svg+xml	2620:1ec:bdf::10 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69` Request headers Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Apr 2019 22:17:47 GMT content-encoding gzip x-azure-ref-originshield 0vVykXAAAAAA2QEfjPIe+R5XqFyFhZD/9QU1TRURHRTA2MTkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-md5 Sm6wIsHj8wthIZkm/aQWhA== status 200 content-length 394 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:36 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D64101593D933D x-azure-ref 0DDGlXAAAAABQlzfmVrDJTbNdj6jkJsvxVklFRURHRTAyMTkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/svg+xml access-control-allow-origin * x-ms-request-id 1ef5945a-301e-0070-57ab-e6c573000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H2	200	picker_more_7568a43cf440757c55d2e7f51557ae1f.svg aadcdn.msauth.net/ests/2.1/content/images/	899 B 911 B	59ms 15ms	Image image/svg+xml	2620:1ec:bdf::10 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2` Request headers Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Apr 2019 22:17:47 GMT content-encoding gzip x-azure-ref-originshield 0ghGkXAAAAACIqoIqQvkOR6escmqA9Hg4QU1TRURHRTA2MTMAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-md5 K28EA/F25txr6jQahXym+g== status 200 content-length 257 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:40 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D641015B4AAC42 x-azure-ref 0DDGlXAAAAACH1PLAnPvXSb/68RYDBdQyVklFRURHRTAyMTkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/svg+xml access-control-allow-origin * x-ms-request-id d993704d-201e-0079-7705-e6b660000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H2	200	picker_account_add_56e73414003cdb676008ff7857343074.svg aadcdn.msauth.net/ests/2.1/content/images/	222 B 480 B	59ms 15ms	Image image/svg+xml	2620:1ec:bdf::10 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343074.svg Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2` Request headers Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 03 Apr 2019 22:17:47 GMT content-encoding gzip x-azure-ref-originshield 0nCCkXAAAAACce0KSRWJ6Ro5G9da5UsXlQU1TRURHRTA1MTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-md5 ykuOnMaTo0vw2Gx/ZceiPg== status 200 content-length 184 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:37 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D6410159A239F1 x-azure-ref 0DDGlXAAAAABEUXww9qJjRLSkT2e+tYRAVklFRURHRTAyMTkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/svg+xml access-control-allow-origin * x-ms-request-id 5f685edf-501e-005a-7dba-e85a55000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H/1.1	200 OK	load.154a2f85.gif data-enlister.rocks/caRT/img/	74 KB 74 KB	118ms 117ms	Image image/gif	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://data-enlister.rocks/caRT/img/load.154a2f85.gif Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `d4b8b90f61d41500e327dcf51bb31bc2b1f01d80ba34ad755f0a128971c1c9e1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/?auth_code=n&client_email=anders-hestbech@andelskassen.dk&client_id=_--3496570289328060631--2_684247-540_4-867-944934-3184755044&locale={EN-US}&ue=bWlrZXlkb3VnbGV5QGdtYWlsLmNvbQ==&realm=zZzbIlXgsN7sHmk User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:48 GMT Last-Modified Wed, 27 Mar 2019 16:40:04 GMT Server Apache/2.4.18 ETag "126f3-5851616f211ba" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 75507
GET H/1.1	200 OK	bg.jpg data-enlister.rocks/caRT/assets/	291 KB 291 KB	120ms 118ms	Image image/jpeg	31.220.48.56 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL https://data-enlister.rocks/caRT/assets/bg.jpg Requested by Host: data-enlister.rocks URL: https://data-enlister.rocks/caRT/assets/jquery.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 31.220.48.56 , Lithuania, ASN47583 (AS-HOSTINGER, LT), Reverse DNS Software Apache/2.4.18 / Resource Hash `62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host data-enlister.rocks User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://data-enlister.rocks/caRT/assets/styles.css Connection keep-alive Cache-Control no-cache Referer https://data-enlister.rocks/caRT/assets/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 03 Apr 2019 22:17:48 GMT Last-Modified Wed, 27 Mar 2019 16:39:56 GMT Server Apache/2.4.18 ETag "48c79-585161676244d" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 298105

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
data-enlister.rocks
wap.datastarttls.com
2606:4700:30::681c:16ce
2620:1ec:bdf::10
31.220.48.56
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
27f79b1c36f3ede7c76f9e0756c1ae4b1c96ce4c54174d63fa337ce597568e6c
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
6cf3db65325b498e1a048113759b1d03c82c06bea1a7cc44a8c0e7e34f416b83
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
a9ab616536957d2ec7f541457e30440089fdc3eaca69198769b4ad1683ffb5bb
ae7d52486720c57573768c2562d96111092f122924d151e9ed23d150ec00c9ae
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
d4b8b90f61d41500e327dcf51bb31bc2b1f01d80ba34ad755f0a128971c1c9e1
eae31e5464d3d12f026f6c5d63d5f6c30a71c994eac5d8bc143e186a75f79b53

data-enlister.rocks Open in urlscan Pro 31.220.48.56 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

514 kBTransfer

924 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

data-enlister.rocks Open in urlscan Pro
31.220.48.56 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

514 kB
Transfer

924 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!