ads1.blob.core.windows.net Open in urlscan Pro
52.239.170.100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/eVojItn36f
Effective URL:
https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc75...
Submission: On October 03 via manual (October 3rd 2023, 1:53:46 am UTC) from CO — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 52.239.170.100, located in Tappahannock, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is ads1.blob.core.windows.net.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on September 27th 2023. Valid for: a year.

This is the only time ads1.blob.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bancolombia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1 1	2600:1f18:612... 2600:1f18:612b:4200:1609:7c03:7144:286e	14618 (AMAZON-AES) (AMAZON-AES)
2 2	37.252.171.52 37.252.171.52	29990 (ASN-APPNEX) (ASN-APPNEX)
11	52.239.170.100 52.239.170.100	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
12	2

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4200:1609:7c03:7144:286e (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

amazon.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.171.52 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.239.170.100 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

ads1.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	windows.net ads1.blob.core.windows.net	376 KB
2	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 360	2 KB
1	tremorhub.com 1 redirects amazon.partners.tremorhub.com — Cisco Umbrella Rank: 9789	525 B
1	t.co t.co — Cisco Umbrella Rank: 707	756 B
12	4

	Domain	Requested by
11	ads1.blob.core.windows.net	t.co ads1.blob.core.windows.net
2	ib.adnxs.com	2 redirects
1	amazon.partners.tremorhub.com	1 redirects
1	t.co
12	4

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-11-14` - `2023-11-14`	a year	crt.sh
*.blob.core.windows.net Microsoft RSA TLS CA 01	`2023-09-27` - `2024-09-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Frame ID: FEF8C325A0A723CBAA3CC3B97B928D2B
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

solicitud

Page URL History Show full URLs

https://t.co/eVojItn36f Page URL
https://amazon.partners.tremorhub.com/sync?UIAM&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3F%2568%2574%2574%2570%2... HTTP 302
https://ib.adnxs.com/getuid?%68%74%74%70%73%3A%2F%2F%61%64%73%31%2E%62%6C%6F%62%2E%63%6F%72%65%2E... HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2561%2564%2573%2... HTTP 302
https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria... Page URL

Page Statistics

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

377 kB
Transfer

373 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/eVojItn36f Page URL
https://amazon.partners.tremorhub.com/sync?UIAM&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2561%2564%2573%2531%252E%2562%256C%256F%2562%252E%2563%256F%2572%2565%252E%2577%2569%256E%2564%256F%2577%2573%252E%256E%2565%2574%252F%2563%2570%256F%252F%2569%256E%2564%2565%2578%252E%2568%2574%256D%256C%3F%2Fecm3%3Fid%3D$UID%26ex%3Dappnexus.com%26%2Fecm3%3Fex%3Dtelaria.com%26id%3D%5BPARTNER_ID%5D HTTP 302
https://ib.adnxs.com/getuid?%68%74%74%70%73%3A%2F%2F%61%64%73%31%2E%62%6C%6F%62%2E%63%6F%72%65%2E%77%69%6E%64%6F%77%73%2E%6E%65%74%2F%63%70%6F%2F%69%6E%64%65%78%2E%68%74%6D%6C?/ecm3?id=$UID&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2561%2564%2573%2531%252E%2562%256C%256F%2562%252E%2563%256F%2572%2565%252E%2577%2569%256E%2564%256F%2577%2573%252E%256E%2565%2574%252F%2563%2570%256F%252F%2569%256E%2564%2565%2578%252E%2568%2574%256D%256C%3F%2Fecm3%3Fid%3D%24UID%26ex%3Dappnexus.com%26%2Fecm3%3Fex%3Dtelaria.com%26id%3Dddf33510bc7546269c3c3dcb1b9d4a00 HTTP 302
https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 eVojItn36f
t.co/ 1 KB
756 B 191ms
133ms Document
text/html 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/eVojItn36f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_f /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 384
content-type: text/html; charset=utf-8
date: Tue, 03 Oct 2023 01:53:40 GMT
expires: Tue, 03 Oct 2023 01:58:40 GMT
perf: 7626143928
server: tsa_f
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 17ae71fde7ce8f600253c0d02eb89f2ec9da3e4f88cb2929f2be55dbf302fcf6
x-response-time: 112
x-transaction-id: 8a522e66b868b7f9
x-xss-protection: 0

GET
H/1.1

200
OK

Primary Request index.html Show response
ads1.blob.core.windows.net/cpo/
Redirect Chain

https://amazon.partners.tremorhub.com/sync?UIAM&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2561%2564%2573%2531%252E%2562%256C%256F%2562%252E%2563%256F%2572...
https://ib.adnxs.com/getuid?%68%74%74%70%73%3A%2F%2F%61%64%73%31%2E%62%6C%6F%62%2E%63%6F%72%65%2E%77%69%6E%64%6F%77%73%2E%6E%65%74%2F%63%70%6F%2F%69%6E%64%65%78%2E%68%74%6D%6C?/ecm3?id=$UID&ex=appn...
https://ib.adnxs.com/bounce?%2Fgetuid%3F%2568%2574%2574%2570%2573%253A%252F%252F%2561%2564%2573%2531%252E%2562%256C%256F%2562%252E%2563%256F%2572%2565%252E%2577%2569%256E%2564%256F%2577%2573%252E%2...
https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00

3 KB
4 KB

422ms
101ms

Document
text/html

52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Requested by: Host: t.co
URL: https://t.co/eVojItn36f
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f7cd8beae28d5a2a6dc827d17bf6a65355bf00574b1e2c60b6aa8c80523bd424

Request headers

Referer: https://t.co/eVojItn36f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Length: 3491
Content-MD5: qVoWpx9E52JtxRc81ZX4FA==
Content-Type: text/html
Date: Tue, 03 Oct 2023 01:53:41 GMT
ETag: 0x8DBAF30E7933959
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 1de3a1b9-b01e-001b-439c-f596f4000000
x-ms-version: 2009-09-19

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 79275ea6-5c47-43e0-8526-358b39a2c617
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 03 Oct 2023 01:53:41 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
x-proxy-origin: 45.141.152.75; 45.141.152.75; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK styles.css
ads1.blob.core.windows.net/cpo/assets/css/ 3 KB
3 KB 97ms
97ms Stylesheet
text/css 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://ads1.blob.core.windows.net/cpo/assets/css/styles.css
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: ef0ea9ebcc6eb62c9a886a825c31be8907a1a261bff242ea84224ec9cfb4e70c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: 7ru/MDUJj5UFIxz8vy/zlA==
ETag: 0x8DBAF30E793606A
Content-Type: text/css
x-ms-request-id: 1de3a1f0-b01e-001b-759c-f596f4000000
x-ms-version: 2009-09-19
Content-Length: 2959

GET
H/1.1 200
OK logo-of.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 15 KB
16 KB 195ms
97ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/logo-of.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: a85cee21cc711a99fc95a8f36a96b68ce166b422f007f74b509b695280748e81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:59 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: F9mt83hXOsGIpAMfu6Kosw==
ETag: 0x8DBAF30E82DB4DC
Content-Type: image/png
x-ms-request-id: 1de3a226-b01e-001b-299c-f596f4000000
x-ms-version: 2009-09-19
Content-Length: 15762

GET
H/1.1 200
OK ico-1.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 6 KB
6 KB 385ms
103ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/ico-1.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 665a17e8d0570e4d9e18445694e7ace8096510aa32ee6d3f0e4712bf8186087f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: K/kWb7GwixlDuXRPmy5WVg==
ETag: 0x8DBAF30E7F484D9
Content-Type: image/png
x-ms-request-id: 96d78133-901e-009a-659c-f5362e000000
x-ms-version: 2009-09-19
Content-Length: 5698

GET
H/1.1 200
OK ico-2.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 7 KB
7 KB 386ms
101ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/ico-2.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: fc5a44c143208597694987cac5af950e15779936e578d691df27bb362fda94d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: kuOlartNuQC6bbXa550vDw==
ETag: 0x8DBAF30E7F4D2F6
Content-Type: image/png
x-ms-request-id: 7efc3974-b01e-0069-589c-f591bb000000
x-ms-version: 2009-09-19
Content-Length: 7235

GET
H/1.1 200
OK ico-3.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 8 KB
8 KB 385ms
99ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/ico-3.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d0a7b5fb9c1f7838d220030b7937baa2ba683f4d6f32138522e6f40f408317dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: X2jbKnIhQ0bjfud+50zMqw==
ETag: 0x8DBAF30E7F484D9
Content-Type: image/png
x-ms-request-id: ff1ef83f-801e-0096-169c-f5a126000000
x-ms-version: 2009-09-19
Content-Length: 7984

GET
H/1.1 200
OK flyer.png
ads1.blob.core.windows.net/cpo/assets/img/ 324 KB
324 KB 414ms
124ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/flyer.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 700c368b3a6c9ef1a09df2e39c86826e73b528ea4b1da3f970f92783a6dc2d56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: sXybNFiJO1oYA93Y+WmOJw==
ETag: 0x8DBAF30E7C5657F
Content-Type: image/png
x-ms-request-id: e722aaae-d01e-0040-7d9c-f5afcf000000
x-ms-version: 2009-09-19
Content-Length: 331793

GET
H/1.1 200
OK home.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 1 KB
1 KB 387ms
96ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/home.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: f94f6d0e3ac20ca0c9913d7fceb0aa08ac549ed30f5a1719b7d868a206d2c1e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: eO4KsmvYQDy9ggduSc8X9A==
ETag: 0x8DBAF30E7F34C8F
Content-Type: image/png
x-ms-request-id: 1de3a2d4-b01e-001b-489c-f596f4000000
x-ms-version: 2009-09-19
Content-Length: 1105

GET
H/1.1 200
OK mov.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 2 KB
2 KB 249ms
96ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/mov.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2cd42610a30b3f691f7979f192ebbe43e14a017e36c868732a8bc9fab8f210eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:59 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: Tr0nSxCCcHUJpNSlVT21+w==
ETag: 0x8DBAF30E82E5107
Content-Type: image/png
x-ms-request-id: 1de3a290-b01e-001b-089c-f596f4000000
x-ms-version: 2009-09-19
Content-Length: 1584

GET
H/1.1 200
OK exp.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 1 KB
2 KB 252ms
100ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/exp.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 2bb7eb9fc9a93bc9215bb1b89ab879f69f6739e1592ab780f8693fab2936009a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: V/W1uZEQfv7id+VAcaPH3w==
ETag: 0x8DBAF30E7F37394
Content-Type: image/png
x-ms-request-id: 29fac691-e01e-0006-4b9c-f59b48000000
x-ms-version: 2009-09-19
Content-Length: 1294

GET
H/1.1 200
OK conf.png
ads1.blob.core.windows.net/cpo/assets/img/icons/ 2 KB
2 KB 153ms
96ms Image
image/png 52.239.170.100
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads1.blob.core.windows.net/cpo/assets/img/icons/conf.png
Requested by: Host: ads1.blob.core.windows.net
URL: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.239.170.100 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 7ca74fa0d97adf0c785c5ab27893421f391fb94188b694c5fe296d520c8e4cf6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads1.blob.core.windows.net/cpo/index.html?/ecm3?id=3840551519549964981&ex=appnexus.com&/ecm3?ex=telaria.com&id=ddf33510bc7546269c3c3dcb1b9d4a00
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 03 Oct 2023 01:53:41 GMT
Last-Modified: Wed, 06 Sep 2023 23:27:58 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: aisQNHM97KKT69Q26gp6Rg==
ETag: 0x8DBAF30E7C231A5
Content-Type: image/png
x-ms-request-id: 1de3a260-b01e-001b-5e9c-f596f4000000
x-ms-version: 2009-09-19
Content-Length: 1875

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bancolombia (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 00:41:52	Name: muc Value: 86c8770d-a8f8-444d-bf9d-342eda71757d
.tremorhub.com/	1970-01-20 23:57:34	Name: tvid Value: eda46cb84a3a4f8db80cd587252ea265
.tremorhub.com/	1970-01-21 00:47:38	Name: tv_UIAM Value: ddf33510bc7546269c3c3dcb1b9d4a00
.adnxs.com/	1970-01-20 17:21:14	Name: uuid2 Value: 3840551519549964981

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads1.blob.core.windows.net
amazon.partners.tremorhub.com
ib.adnxs.com
t.co
104.244.42.69
2600:1f18:612b:4200:1609:7c03:7144:286e
37.252.171.52
52.239.170.100
2bb7eb9fc9a93bc9215bb1b89ab879f69f6739e1592ab780f8693fab2936009a
2cd42610a30b3f691f7979f192ebbe43e14a017e36c868732a8bc9fab8f210eb
665a17e8d0570e4d9e18445694e7ace8096510aa32ee6d3f0e4712bf8186087f
700c368b3a6c9ef1a09df2e39c86826e73b528ea4b1da3f970f92783a6dc2d56
7ca74fa0d97adf0c785c5ab27893421f391fb94188b694c5fe296d520c8e4cf6
a85cee21cc711a99fc95a8f36a96b68ce166b422f007f74b509b695280748e81
d0a7b5fb9c1f7838d220030b7937baa2ba683f4d6f32138522e6f40f408317dd
ef0ea9ebcc6eb62c9a886a825c31be8907a1a261bff242ea84224ec9cfb4e70c
f7cd8beae28d5a2a6dc827d17bf6a65355bf00574b1e2c60b6aa8c80523bd424
f94f6d0e3ac20ca0c9913d7fceb0aa08ac549ed30f5a1719b7d868a206d2c1e9
fc5a44c143208597694987cac5af950e15779936e578d691df27bb362fda94d6

ads1.blob.core.windows.net Open in urlscan Pro 52.239.170.100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

2 Countries

377 kBTransfer

373 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

ads1.blob.core.windows.net Open in urlscan Pro
52.239.170.100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

377 kB
Transfer

373 kB
Size

4
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!