urlscan.io logo urlscan.io
SecurityTrails logo

file.nsandi.tech Open in urlscan Pro
159.69.148.11  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Submission: On November 16 via manual from GB — Scanned from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 159.69.148.11, located in Nuremberg, Germany and belongs to HETZNER-AS, DE. The main domain is file.nsandi.tech.
TLS certificate: Issued by R3 on October 23rd 2023. Valid for: 3 months.
This is the only time file.nsandi.tech was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 11 159.69.148.11 24940 (HETZNER-AS)
8 1
Apex Domain
Subdomains		 Transfer
11 nsandi.tech
file.nsandi.tech
15 KB
8 1
Domain Requested by
11 file.nsandi.tech 3 redirects file.nsandi.tech
8 1

This site contains no links.

Subject Issuer Validity Valid
file.nsandi.tech
R3		 2023-10-23 -
2024-01-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Frame ID: 6080788DFD6A1A5B75B6024A67847B53
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log in

Detected technologies

Overall confidence: 100%
Detected patterns
  • tracker\.js

Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

14 kB
Transfer

14 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://file.nsandi.tech/js/events.js HTTP 302
  • https://file.nsandi.tech/obfuscate?path=js/events.js
Request Chain 3
  • https://file.nsandi.tech/js/timeme.min.js HTTP 302
  • https://file.nsandi.tech/obfuscate?path=js/timeme.min.js
Request Chain 4
  • https://file.nsandi.tech/js/time-tracker.js HTTP 302
  • https://file.nsandi.tech/obfuscate?path=js/time-tracker.js

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 80vu0kbd5lf0fp6b
file.nsandi.tech/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
ac70e328b6647e5084bc79d7f2abb8f9e84d1cb1d0f11b2040c1168e78ee5cc5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-CH,de;q=0.9

Response headers

Access-Control-Allow-Headers
*
Access-Control-Allow-Methods
*
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
927
Content-Type
text/html; charset=UTF-8
Date
Thu, 16 Nov 2023 09:22:48 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Pragma
no-cache
Server
Lucy
Vary
Accept-Encoding
obfuscate
file.nsandi.tech/
Redirect Chain
  • https://file.nsandi.tech/js/events.js
  • https://file.nsandi.tech/obfuscate?path=js/events.js
558 B
985 B 		Script
General
Check archive.org
Download Go to
Full URL
https://file.nsandi.tech/obfuscate?path=js/events.js
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://file.nsandi.tech/80vu0kbd5lf0fp6b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 16 Nov 2023 09:22:48 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
558
Keep-Alive
timeout=5, max=100
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Date
Thu, 16 Nov 2023 09:22:48 GMT
Server
Lucy
Content-Type
text/html; charset=iso-8859-1
Location
https://file.nsandi.tech/obfuscate?path=js/events.js
Cache-Control
max-age=1
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
301
Expires
Thu, 16 Nov 2023 09:22:49 GMT
style.css
file.nsandi.tech/public/campaign/661/825/11/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://file.nsandi.tech/public/campaign/661/825/11/style.css
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
15dcfc0185969b2e117f75885b377b57e23f06387f933d34fc1e7a7b3faf5f15

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://file.nsandi.tech/80vu0kbd5lf0fp6b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 09:22:48 GMT
Content-Encoding
gzip
Last-Modified
Wed, 25 Oct 2023 08:15:03 GMT
Server
Lucy
ETag
"92e-608860d61ae04-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
756
logo.png
file.nsandi.tech/public/campaign/661/825/11/static/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://file.nsandi.tech/public/campaign/661/825/11/static/logo.png
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
20bf8e95743ad0b8eaad3d92cbcd88bd7ce77633dcf6244817ed12365d4e06ce

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://file.nsandi.tech/80vu0kbd5lf0fp6b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 09:22:48 GMT
Last-Modified
Wed, 11 Oct 2023 12:01:40 GMT
Server
Lucy
ETag
"509-6076f96121af7"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1289
obfuscate
file.nsandi.tech/
Redirect Chain
  • https://file.nsandi.tech/js/timeme.min.js
  • https://file.nsandi.tech/obfuscate?path=js/timeme.min.js
4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://file.nsandi.tech/obfuscate?path=js/timeme.min.js
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://file.nsandi.tech/80vu0kbd5lf0fp6b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 16 Nov 2023 09:22:48 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
4210
Keep-Alive
timeout=5, max=99
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Date
Thu, 16 Nov 2023 09:22:48 GMT
Server
Lucy
Content-Type
text/html; charset=iso-8859-1
Location
https://file.nsandi.tech/obfuscate?path=js/timeme.min.js
Cache-Control
max-age=1
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
305
Expires
Thu, 16 Nov 2023 09:22:49 GMT
obfuscate
file.nsandi.tech/
Redirect Chain
  • https://file.nsandi.tech/js/time-tracker.js
  • https://file.nsandi.tech/obfuscate?path=js/time-tracker.js
2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://file.nsandi.tech/obfuscate?path=js/time-tracker.js
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
ce5b41bb9e310321a957d16cbd21b476c2f68454eb3eb6c5f79a3f3e823908c0

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://file.nsandi.tech/80vu0kbd5lf0fp6b
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 16 Nov 2023 09:22:48 GMT
Server
Lucy
Access-Control-Allow-Methods
*
Content-Type
text/javascript;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
1597
Keep-Alive
timeout=5, max=99
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Redirect headers

Date
Thu, 16 Nov 2023 09:22:48 GMT
Server
Lucy
Content-Type
text/html; charset=iso-8859-1
Location
https://file.nsandi.tech/obfuscate?path=js/time-tracker.js
Cache-Control
max-age=1
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
307
Expires
Thu, 16 Nov 2023 09:22:49 GMT
background.svg
file.nsandi.tech/public/campaign/661/825/11/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://file.nsandi.tech/public/campaign/661/825/11/background.svg
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/public/campaign/661/825/11/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://file.nsandi.tech/public/campaign/661/825/11/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date
Thu, 16 Nov 2023 09:22:48 GMT
Last-Modified
Wed, 11 Oct 2023 12:01:18 GMT
Server
Lucy
ETag
"748-6076f94c24abe"
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1864
track-time
file.nsandi.tech/scenario/ 		0
589 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://file.nsandi.tech/scenario/track-time
Requested by
Host: file.nsandi.tech
URL: https://file.nsandi.tech/80vu0kbd5lf0fp6b
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
159.69.148.11 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mail.khipuawareness.com
Software
Lucy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://file.nsandi.tech/80vu0kbd5lf0fp6b
accept-language
de-CH,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 16 Nov 2023 09:22:49 GMT
Server
Lucy
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
*
Content-Type
text/html; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
*
Content-Length
0
Keep-Alive
timeout=5, max=96
Expires
Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| lucyDispatchEvent object| TimeMe boolean| injected function| trackTime function| sendUserActivityTimeData function| runChromeTimeTracker function| isChrome

2 Cookies

Domain/Path Name / Value
file.nsandi.tech/ Name: PHPSESSID
Value: 33hstjeijtocki18oalo09r7c6
file.nsandi.tech/ Name: link
Value: 80vu0kbd5lf0fp6b