andalcreditsg.com Open in urlscan Pro
103.130.153.32  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response andalcreditsg.com/publish/	286 KB 104 KB	1259ms 614ms	Document text/html	103.130.153.32 DATAKL-MY DataKL ...
General Check archive.org Show headers Download Go to Full URL https://andalcreditsg.com/publish/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 103.130.153.32 Cyberjaya, Malaysia, ASN138359 (DATAKL-MY DataKL Solutions Sdn Bhd, MY), Reverse DNS ghost.centralmalaysia.com Software nginx / Resource Hash 8f85b88f78c2fc71feb7c877eae2093c796c0f2e30ec94af138ce8bbd04a41f5 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-origin * content-encoding gzip content-type text/html date Fri, 19 Jul 2024 03:37:24 GMT last-modified Sat, 06 Jul 2024 15:25:58 GMT server nginx strict-transport-security max-age=300; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff x-nginx-upstream-cache-status EXPIRED x-xss-protection 1; mode=block
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	158ms 33ms	Image image/svg+xml	152.195.19.97 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: andalcreditsg.com URL: https://andalcreditsg.com/publish/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.19.97 San Jose, United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (chd/0763) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer https://andalcreditsg.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 19 Jul 2024 03:37:26 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 9985030 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (chd/0763) etag 0x8D79A1B9F5E121A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id a81f985b-201e-00cd-19bc-7e0179000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	favicon.ico andalcreditsg.com/	0 286 B	310ms 301ms	Other text/html	103.130.153.32 DATAKL-MY DataKL ...
General Check archive.org Show headers Download Go to Full URL https://andalcreditsg.com/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 103.130.153.32 Cyberjaya, Malaysia, ASN138359 (DATAKL-MY DataKL Solutions Sdn Bhd, MY), Reverse DNS ghost.centralmalaysia.com Software nginx / PHP/7.4.33 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://andalcreditsg.com/publish/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers expires Tue, 17 Sep 2024 03:37:26 GMT date Fri, 19 Jul 2024 03:37:26 GMT strict-transport-security max-age=300; includeSubDomains; preload x-content-type-options nosniff server nginx x-powered-by PHP/7.4.33 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control max-age=5184000 content-length 0 x-xss-protection 1; mode=block x-nginx-upstream-cache-status STALE

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x228b object| BOOKS function| _0x2ecc function| _0x150ffa function| _0x348cd9 function| _0x1d1ef5 function| _0x5165ea function| generateCaptcha function| customDecode function| getIconSVG function| _0x85374f function| lightenColor function| checkColor function| dAndR function| startCountdown function| _0x39e1e3 function| _0x1cb853 function| _0x8d8ab5 function| _0x2dc29c function| _0x1acca0 function| _0x54a934 function| _0x3da7 function| _0x464cf8 function| _0x1008 function| _0x5d72bc function| _0xaadf01 function| checkers function| _0x48596a function| redirectToshop function| _0x33ee23 function| _0x4a8d38

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=300; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
andalcreditsg.com
103.130.153.32
152.195.19.97
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
8f85b88f78c2fc71feb7c877eae2093c796c0f2e30ec94af138ce8bbd04a41f5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855