novartis-com-dot-level-elevator-279110.nw.r.appspot.com
Open in
urlscan Pro
2a00:1450:4001:808::2014
Malicious Activity!
Public Scan
Effective URL: https://novartis-com-dot-level-elevator-279110.nw.r.appspot.com/
Submission: On July 14 via manual from CH
Summary
TLS certificate: Issued by GTS CA 1O1 on June 17th 2020. Valid for: 3 months.
This is the only time novartis-com-dot-level-elevator-279110.nw.r.appspot.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.115.54 167.89.115.54 | 11377 (SENDGRID) (SENDGRID) | |
1 | 198.54.116.36 198.54.116.36 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2014 | 15169 (GOOGLE) (GOOGLE) | |
4 | 160.153.53.104 160.153.53.104 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
7 | 4 |
ASN22612 (NAMECHEAP-NET, US)
PTR: host47.registrar-servers.com
paogkkarzcotqwmhnjte.ecofurniturebd.com |
ASN15169 (GOOGLE, US)
novartis-com-dot-level-elevator-279110.nw.r.appspot.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-160-153-53-104.ip.secureserver.net
adkpd.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
adkpd.com
adkpd.com |
6 KB |
1 |
appspot.com
novartis-com-dot-level-elevator-279110.nw.r.appspot.com |
155 KB |
1 |
ecofurniturebd.com
paogkkarzcotqwmhnjte.ecofurniturebd.com |
473 B |
1 |
sendgrid.net
1 redirects
u17491394.ct.sendgrid.net |
300 B |
7 | 4 |
Domain | Requested by | |
---|---|---|
4 | adkpd.com |
paogkkarzcotqwmhnjte.ecofurniturebd.com
|
1 | novartis-com-dot-level-elevator-279110.nw.r.appspot.com |
paogkkarzcotqwmhnjte.ecofurniturebd.com
|
1 | paogkkarzcotqwmhnjte.ecofurniturebd.com | |
1 | u17491394.ct.sendgrid.net | 1 redirects |
7 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.appspot.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
adkpd.com ZeroSSL RSA Domain Secure Site CA |
2020-05-08 - 2020-08-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://novartis-com-dot-level-elevator-279110.nw.r.appspot.com/
Frame ID: DA3E3239065B65851EDE4B51475BAEFD
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u17491394.ct.sendgrid.net/ls/click?upn=cJ2xBpGvKJaU1PzYrg8X5y1b0SKEzlJQIrrNCVNd9RQbYFusS7NCF-2Bi3FjyvR...
HTTP 302
http://paogkkarzcotqwmhnjte.ecofurniturebd.com/owabludomain/ Page URL
- https://novartis-com-dot-level-elevator-279110.nw.r.appspot.com/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u17491394.ct.sendgrid.net/ls/click?upn=cJ2xBpGvKJaU1PzYrg8X5y1b0SKEzlJQIrrNCVNd9RQbYFusS7NCF-2Bi3FjyvR-2B3gUfV2srvUJJwTA8QJfBupaN8Jx-2FIHtxM0OrhByOhvaJ2t1HCvWxEtKqlFPdHniwgjP0nMCtjb57BDMTfRS28C3w-3D-3D7g2C_CJKb9IrGtu4qgVSp-2FHFJxlU8lwTt7Rjfkjs9cXYJKMWrMLSCF8KHkaPgyRYQ9-2FCIXCj8iKS7Jc3BkAFc6NkZVp6CToF1MDjM5aCM1QaSJwf9FwXnkMzBTkb1Q3ZSQxRxGNTajqPqUGZuNpzkxyK1UwrMfYsAi6DQ7548zcwDRGVNkKgxIQjAI4Lg7hXechKoqrFqtaKysk9ZL5UG8coSydHo92qwFb7hzQA588K-2BWlXP59NLe6GNYkT03a9FvX5V
HTTP 302
http://paogkkarzcotqwmhnjte.ecofurniturebd.com/owabludomain/ Page URL
- https://novartis-com-dot-level-elevator-279110.nw.r.appspot.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://u17491394.ct.sendgrid.net/ls/click?upn=cJ2xBpGvKJaU1PzYrg8X5y1b0SKEzlJQIrrNCVNd9RQbYFusS7NCF-2Bi3FjyvR-2B3gUfV2srvUJJwTA8QJfBupaN8Jx-2FIHtxM0OrhByOhvaJ2t1HCvWxEtKqlFPdHniwgjP0nMCtjb57BDMTfRS28C3w-3D-3D7g2C_CJKb9IrGtu4qgVSp-2FHFJxlU8lwTt7Rjfkjs9cXYJKMWrMLSCF8KHkaPgyRYQ9-2FCIXCj8iKS7Jc3BkAFc6NkZVp6CToF1MDjM5aCM1QaSJwf9FwXnkMzBTkb1Q3ZSQxRxGNTajqPqUGZuNpzkxyK1UwrMfYsAi6DQ7548zcwDRGVNkKgxIQjAI4Lg7hXechKoqrFqtaKysk9ZL5UG8coSydHo92qwFb7hzQA588K-2BWlXP59NLe6GNYkT03a9FvX5V HTTP 302
- http://paogkkarzcotqwmhnjte.ecofurniturebd.com/owabludomain/
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
paogkkarzcotqwmhnjte.ecofurniturebd.com/owabludomain/ Redirect Chain
|
436 B 473 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
novartis-com-dot-level-elevator-279110.nw.r.appspot.com/ |
225 KB 155 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
adkpd.com/ob/media//css/ |
594 B 337 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
adkpd.com/ob/media//css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.js
adkpd.com/ob/media//js/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
adkpd.com/ob/media//js/ |
1 KB 604 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
106 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
segoeui-regular.ttf
adkpd.com/ob/media//fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- adkpd.com
- URL
- https://adkpd.com/ob/media//fonts/segoeui-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| LIB_phrase string| LIB_view string| ____media string| ____b string| ____rdr object| d object| s function| validateEmail function| getUrlParameter function| dDOM object| Base64 number| LIB_submitTrial function| initForLogin function| initForTrueLogin function| loginUser function| trueLoginUser function| initApp function| sendPost function| sendGet function| bindXhr object| isMobile function| bindElements number| c2 number| c1 object| LIB_submitButton object| LIB_userInput object| LIB_pwdInput object| LIB_spinner function| LIB_beforeSend function| LIB_onComplete0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adkpd.com
novartis-com-dot-level-elevator-279110.nw.r.appspot.com
paogkkarzcotqwmhnjte.ecofurniturebd.com
u17491394.ct.sendgrid.net
adkpd.com
160.153.53.104
167.89.115.54
198.54.116.36
2a00:1450:4001:808::2014
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
0f064b85d872f5bb47211acb9576741248eac8504bca29773c57e7255175aea9
2b491e2211f7003c16a9132d78a95753e0315bf30b1977518d65e3a76dccec20
3ee8df4f2b417aa99a23f897cd343427cddfd83636ab5d2a523ef66e230676f1
49705cc2f1777d040b0293f2192443f24c82b61b2962b7c00a3e22d1ec8a4066
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
96ef5524fc0613f15738e1acc4010d6d34b05b6c0b6d815095109c9ec595ad41
9e0488910156b8f19f2949f6e61a52dfc9162eaefa3f1524aea23f7908f86330
c38d76da3da3c7c8b704f8a11daa64929f65884becfc2a79a1e909d6378686de
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b