mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud Open in urlscan Pro
202.151.188.200  Malicious Activity! Public Scan

URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=h...
Submission: On April 24 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 202.151.188.200, located in Thailand and belongs to PROENNET-AS Proen Corp Public Company Limited., TH. The main domain is mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud.
TLS certificate: Issued by R3 on April 2nd 2024. Valid for: 3 months.
This is the only time mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
9 202.151.188.200 23884 (PROENNET-...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2620:1ec:bdf::45 8075 (MICROSOFT...)
11 3
Apex Domain
Subdomains
Transfer
9 ruk-com.cloud
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
324 KB
1 msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 3956
1 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33
964 B
11 3
Domain Requested by
9 mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
1 logincdn.msauth.net mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
1 fonts.googleapis.com mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
11 3

This site contains no links.

Subject Issuer Validity Valid
*.proen.app.ruk-com.cloud
R3
2024-04-02 -
2024-07-01
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2024-03-18 -
2024-06-10
3 months crt.sh
identitycdn.msauth.net
Microsoft Azure RSA TLS Issuing CA 03
2024-01-17 -
2025-01-11
a year crt.sh

This page contains 1 frames:

Primary Page: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Frame ID: AD4686A778F2932BD4F64A09545F79ED
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Entrar na conta

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

326 kB
Transfer

488 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request home.php
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/
6 KB
2 KB
Document
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
6706cbb5632288c6605846f06dd0675152e357d87bac6792c594f7af2606cd6b
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
gzip
content-length
1923
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
unsafe-none
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
same-origin
date
Wed, 24 Apr 2024 15:14:05 GMT
permissions-policy
geolocation=(self), payment=(self)
referrer-policy
strict-origin-when-cross-origin
server
openresty
strict-transport-security
max-age=15811200
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block;
bootstrap.min.css
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/css/
118 KB
20 KB
Stylesheet
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/css/bootstrap.min.css
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
26f89432f26835fdb007dbf41441a6f7440865cc0fbd0f36e880dc4c26d00d7d
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=15811200
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
19615
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 14 Mar 2022 19:42:16 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"1d878-5da32e0a9d600-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes
bootstrap-theme.min.css
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/css/
23 KB
3 KB
Stylesheet
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/css/bootstrap-theme.min.css
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
005b287d977c17d5cf6677103cc353babb47fa4c302ec8b5ea2c86817d8cb0d0
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=15811200
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
2657
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 14 Mar 2022 19:42:08 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"5aca-5da32e02fc400-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
text/css
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes
css
fonts.googleapis.com/
2 KB
964 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0c7b39faa08dbf48372cc45d4f2b8f05c5626dacdf9b06d1062cc43b480809a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Wed, 24 Apr 2024 15:14:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Wed, 24 Apr 2024 14:29:58 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Apr 2024 15:14:05 GMT
bootstrap.min.js
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/
36 KB
10 KB
Script
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/bootstrap.min.js
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
2f9f71d96d253ecafb0d73e4cc37e7a4c843cc0d082c757c80cc5de8a0edc2df
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=15811200
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
9756
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 14 Mar 2022 19:39:40 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"9039-5da32d75d7700-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes
jquery-vv.min.js
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/
30 KB
16 KB
Script
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/jquery-vv.min.js
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
6bc21e325f9e92c5571194ff99852960f3e85876f69aaf05579c1e83ea2a0422
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=15811200
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
15662
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 14 Mar 2022 19:39:48 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"7943-5da32d7d78900-gzip"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes
verificarUsuario.js
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/
0
0
Script
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/verificarUsuario.js
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:05 GMT
strict-transport-security
max-age=15811200
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy
unsafe-none
x-frame-options
SAMEORIGIN
content-type
text/html; charset=iso-8859-1
x-permitted-cross-domain-policies
none
permissions-policy
geolocation=(self), payment=(self)
cross-origin-resource-policy
same-origin
content-length
196
x-xss-protection
1; mode=block;
microsoft_logo.svg
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/img/
4 KB
4 KB
Image
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/img/microsoft_logo.svg
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:05 GMT
strict-transport-security
max-age=15811200
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
3651
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 14 Mar 2022 19:38:54 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"e43-5da32d49f8f80"
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
logincdn.msauth.net/shared/1.0/content/images/
2 KB
1 KB
Image
General
Full URL
https://logincdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 24 Apr 2024 15:14:06 GMT
content-encoding
gzip
x-cache
TCP_MISS
x-fd-int-roxy-purgeid
0
content-length
621
x-ms-lease-status
unlocked
last-modified
Tue, 10 Nov 2020 03:41:24 GMT
etag
0x8D8852A7F48993A
x-azure-ref
20240424T151405Z-17859dc676bjndt79k7wzthbt000000001e000000000u731
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
a0d8e123-001e-0066-4d5a-965db0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
hot.png
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/img/
251 KB
252 KB
Image
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/img/hot.png
Requested by
Host: mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud
URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
386ebf246f8a71ccd0b01f1787dd525e205714e9666bb9ccc7768d6920bc5300
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:07 GMT
strict-transport-security
max-age=15811200
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
257050
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 30 May 2022 11:39:48 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"3ec1a-5e0391d024900"
x-frame-options
SAMEORIGIN
content-type
image/png
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes
favicon.ico
mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/img/
17 KB
17 KB
Other
General
Full URL
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/img/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
202.151.188.200 , Thailand, ASN23884 (PROENNET-AS Proen Corp Public Company Limited., TH),
Reverse DNS
ppp-202.151.188.200.revip.proen.co.th
Software
openresty /
Resource Hash
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
Security Headers
Name Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 24 Apr 2024 15:14:10 GMT
strict-transport-security
max-age=15811200
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
cross-origin-embedder-policy
unsafe-none
cross-origin-resource-policy
same-origin
content-length
17174
x-xss-protection
1; mode=block;
referrer-policy
strict-origin-when-cross-origin
last-modified
Mon, 30 May 2022 11:28:00 GMT
server
openresty
cross-origin-opener-policy
same-origin-allow-popups
etag
"4316-5e038f2cf1000"
x-frame-options
SAMEORIGIN
content-type
image/vnd.microsoft.icon
permissions-policy
geolocation=(self), payment=(self)
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| validation

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/verificarUsuario.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/home.php?login.srf&wa=wsignin1.0&rpsnv=15&ct=1692124612&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d154d461c-5ba5-457f-5e9b-a2404d015651&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015
Message:
Refused to execute script from 'https://mkkaywefjjjashqww-0568825.proen.app.ruk-com.cloud/home/js/verificarUsuario.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=15811200
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block;