chinairdome.com
Open in
urlscan Pro
185.236.231.158
Malicious Activity!
Public Scan
Effective URL: https://chinairdome.com/common/oauth2/v2.0/authorize/?client_id=ce567f96-d720-44dce-a3bb-843808e2db01
Submission: On July 20 via api from US — Scanned from PT
Summary
TLS certificate: Issued by R10 on July 15th 2024. Valid for: 3 months.
This is the only time chinairdome.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 4 | 185.236.231.158 185.236.231.158 | 47674 (NETSOLUTIONS) (NETSOLUTIONS) | |
1 | 142.250.184.234 142.250.184.234 | 15169 (GOOGLE) (GOOGLE) | |
1 | 103.112.244.90 103.112.244.90 | 136107 (IDNIC-7IO...) (IDNIC-7ION-AS-ID PT. Tujuh Ion Indonesia) | |
1 | 104.21.27.152 104.21.27.152 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.130.137 151.101.130.137 | 54113 (FASTLY) (FASTLY) | |
2 | 152.199.21.175 152.199.21.175 | 15133 (EDGECAST) (EDGECAST) | |
2 | 13.107.246.60 13.107.246.60 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
10 | 8 |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f10.1e100.net
fonts.googleapis.com |
ASN136107 (IDNIC-7ION-AS-ID PT. Tujuh Ion Indonesia, ID)
PTR: newpinwheel.indowebsite.net
ardhiffaperdana.my.id |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
chinairdome.com
2 redirects
chinairdome.com |
6 KB |
2 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2218 |
35 KB |
2 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 2274 |
3 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
30 KB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1950 |
12 KB |
1 |
ardhiffaperdana.my.id
ardhiffaperdana.my.id |
202 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
903 B |
10 | 7 |
Domain | Requested by | |
---|---|---|
4 | chinairdome.com |
2 redirects
chinairdome.com
|
2 | aadcdn.msauth.net |
chinairdome.com
|
2 | aadcdn.msftauth.net |
chinairdome.com
|
1 | code.jquery.com |
chinairdome.com
|
1 | use.fontawesome.com |
chinairdome.com
|
1 | ardhiffaperdana.my.id |
chinairdome.com
|
1 | fonts.googleapis.com |
chinairdome.com
|
10 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
chinairdome.com R10 |
2024-07-15 - 2024-10-13 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
www.ardhiffaperdana.my.id E6 |
2024-07-05 - 2024-10-03 |
3 months | crt.sh |
use.fontawesome.com Cloudflare Inc ECC CA-3 |
2023-10-12 - 2024-10-10 |
a year | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2024-05-25 - 2025-05-25 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-04-30 - 2025-04-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://chinairdome.com/common/oauth2/v2.0/authorize/?client_id=ce567f96-d720-44dce-a3bb-843808e2db01
Frame ID: CE7D83DC7767A6628C35AEAB61B01284
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Microsoft Office 365Page URL History Show full URLs
-
https://chinairdome.com/
HTTP 302
https://chinairdome.com/common/oauth2/v2.0/authorize?client_id=ce567f96-d720-44dce-a3bb-843808e2db01 HTTP 301
https://chinairdome.com/common/oauth2/v2.0/authorize/?client_id=ce567f96-d720-44dce-a3bb-843808e2db01 Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://chinairdome.com/
HTTP 302
https://chinairdome.com/common/oauth2/v2.0/authorize?client_id=ce567f96-d720-44dce-a3bb-843808e2db01 HTTP 301
https://chinairdome.com/common/oauth2/v2.0/authorize/?client_id=ce567f96-d720-44dce-a3bb-843808e2db01 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
chinairdome.com/common/oauth2/v2.0/authorize/ Redirect Chain
|
15 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 903 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
ardhiffaperdana.my.id/css/ |
202 KB 202 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.7.0/css/ |
53 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msftauth.net/shared/1.0/content/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
back.png
chinairdome.com/assets/ |
231 B 514 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/ests/2.1/content/images/ |
17 KB 17 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msauth.net/shared/1.0/content/images/ |
17 KB 17 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
aadcdn.msftauth.net
ardhiffaperdana.my.id
chinairdome.com
code.jquery.com
fonts.googleapis.com
use.fontawesome.com
103.112.244.90
104.21.27.152
13.107.246.60
142.250.184.234
151.101.130.137
152.199.21.175
185.236.231.158
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4
7cc725dc4d597113e18ccc30e1f55c7167852266e18fecb388bd319333cf2515
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
aae65c231008861c6430ebe296c926e728c4d2ccb1492f86e42d760e9b67d9a5
afdc6bf2de981ffd7d370b76f44e7580572f197efbe214b9cfa4005d189d8eae
cf23227771143a62eaf53fafd14fa9b64757b27593f589861071fe6abae7ad2e
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a