spotifyapp.mypatri.org
Open in
urlscan Pro
103.93.16.117
Malicious Activity!
Public Scan
Effective URL: https://spotifyapp.mypatri.org/nz/
Submission: On March 27 via manual from NZ — Scanned from NZ
Summary
TLS certificate: Issued by R3 on March 27th 2024. Valid for: 3 months.
This is the only time spotifyapp.mypatri.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Spotify (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.160.225.6 35.160.225.6 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 103.93.16.117 103.93.16.117 | 135822 (HOSRAJA-A...) (HOSRAJA-AS Ovi Hosting Pvt Ltd) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
2 | 3 |
ASN16509 (AMAZON-02, US)
PTR: ec2-35-160-225-6.us-west-2.compute.amazonaws.com
scnv.io |
ASN135822 (HOSRAJA-AS Ovi Hosting Pvt Ltd, IN)
PTR: windows20.hostingraja.org
spotifyapp.mypatri.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 744 |
30 KB |
1 |
mypatri.org
spotifyapp.mypatri.org |
964 KB |
1 |
scnv.io
1 redirects
scnv.io |
1 KB |
2 | 3 |
Domain | Requested by | |
---|---|---|
1 | code.jquery.com |
spotifyapp.mypatri.org
|
1 | spotifyapp.mypatri.org | |
1 | scnv.io | 1 redirects |
2 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
policies.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
spotifyapp.mypatri.org R3 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://spotifyapp.mypatri.org/nz/
Frame ID: 9FC867ED8BA1A1C8260BCA1020EA446D
Requests: 5 HTTP requests in this frame
Screenshot
Page Title
Login - SpotifyPage URL History Show full URLs
-
https://scnv.io/MKBP
HTTP 301
https://spotifyapp.mypatri.org/nz/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://scnv.io/MKBP
HTTP 301
https://spotifyapp.mypatri.org/nz/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
spotifyapp.mypatri.org/nz/ Redirect Chain
|
963 KB 964 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
82 KB 82 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
87 KB 87 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
85 KB 85 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Spotify (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
scnv.io/ | Name: sessionid Value: o4hi7polf7avkehujt5jtbnppo0laopw |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
scnv.io
spotifyapp.mypatri.org
103.93.16.117
2a04:4e42:400::649
35.160.225.6
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
322e6e399009e1d519bd001cbc057edba6d363494d7cb4e608388f0f81947f6b
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a