shajara.org
Open in
urlscan Pro
109.94.209.7
Malicious Activity!
Public Scan
Effective URL: https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/sf8743rg387efg9823983.html?cmd=...
Submission: On November 10 via manual from CL
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 18th 2020. Valid for: 3 months.
This is the only time shajara.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citrix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 107.175.145.197 107.175.145.197 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
3 9 | 109.94.209.7 109.94.209.7 | 202376 (ARVID-LOG...) (ARVID-LOGICUM) | |
7 | 2 |
ASN36352 (AS-COLOCROSSING, US)
PTR: 107-175-145-197-host.colocrossing.com
hotmay.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
shajara.org
3 redirects
shajara.org |
83 KB |
1 |
hotmay.net
hotmay.net |
354 B |
7 | 2 |
Domain | Requested by | |
---|---|---|
9 | shajara.org |
3 redirects
hotmay.net
shajara.org |
1 | hotmay.net | |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.hotmay.net Let's Encrypt Authority X3 |
2020-10-07 - 2021-01-05 |
3 months | crt.sh |
shajara.org Let's Encrypt Authority X3 |
2020-09-18 - 2020-12-17 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/sf8743rg387efg9823983.html?cmd=login_submit&id=55432d8dfe1e5c3d501d6572c97a5c2055432d8dfe1e5c3d501d6572c97a5c20&session=55432d8dfe1e5c3d501d6572c97a5c2055432d8dfe1e5c3d501d6572c97a5c20
Frame ID: BE2167E402767F2702E56C9A46ABC222
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://hotmay.net/ Page URL
-
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/
HTTP 302
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862 HTTP 301
http://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ HTTP 307
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ HTTP 302
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/sf8743rg387... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://hotmay.net/ Page URL
-
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/
HTTP 302
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862 HTTP 301
http://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ HTTP 307
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ HTTP 302
https://shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/sf8743rg387efg9823983.html?cmd=login_submit&id=55432d8dfe1e5c3d501d6572c97a5c2055432d8dfe1e5c3d501d6572c97a5c20&session=55432d8dfe1e5c3d501d6572c97a5c2055432d8dfe1e5c3d501d6572c97a5c20 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
hotmay.net/ |
234 B 354 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
sf8743rg387efg9823983.html
shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ Redirect Chain
|
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
oc8743rg387efg9823983c.css
shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ |
36 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sf367dfywf762fd872823.png
shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ctx32r6ew2f8237d9273.png
shajara.org/shd0e/j92nbd582n5jqc2tsb3jd94mp/0419cc0bb194655bc76df57ba56d2862/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CitrixSans-Light.woff
shajara.org/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
CitrixSans-Regular.woff
shajara.org/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citrix (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
hotmay.net
shajara.org
107.175.145.197
109.94.209.7
29bd5d2df52bdaca911afaf66b06164a6afbcaefe168f81dc8b7bc375b903ff1
316b6da40b69575bb179a0ce5bc2a131ec4982d230bff88a79cf2ea22edc4496
5427503ceef1bba8dbf2c8e95b4a6d5b7fe6f1baafdfb435901d7b1387224d90
5e744f802e66b48d9849af9255e589ac4b9ffe915558f83d41d8e4f486183950
89f7289aac37c6175b3fab56de66b3942ecb3cce2b9a5f3a5700eed99f542e21