mwnxg.masculinezone.net
Open in
urlscan Pro
2a05:d018:244:5200::ab
Malicious Activity!
Public Scan
Effective URL: https://mwnxg.masculinezone.net/c/f82757e39b1a28a9?s1=12852&s2=1035419&j1=1&j3=1
Submission: On April 06 via manual from MK
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on February 17th 2020. Valid for: 3 months.
This is the only time mwnxg.masculinezone.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3032::681c:1dae | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a05:d018:244... 2a05:d018:244:5200::ab | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 2.16.186.115 2.16.186.115 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
13 | 4 |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-115.deploy.static.akamaitechnologies.com
cdn-aimi.akamaized.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
akamaized.net
cdn-aimi.akamaized.net |
2 MB |
1 |
gstatic.com
fonts.gstatic.com |
14 KB |
1 |
googleapis.com
fonts.googleapis.com |
487 B |
1 |
masculinezone.net
mwnxg.masculinezone.net |
3 KB |
1 |
gaytechfinder.tech
1 redirects
gaytechfinder.tech |
786 B |
13 | 5 |
Domain | Requested by | |
---|---|---|
10 | cdn-aimi.akamaized.net |
mwnxg.masculinezone.net
|
1 | fonts.gstatic.com |
mwnxg.masculinezone.net
|
1 | fonts.googleapis.com |
mwnxg.masculinezone.net
|
1 | mwnxg.masculinezone.net | |
1 | gaytechfinder.tech | 1 redirects |
13 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.masculinezone.net Let's Encrypt Authority X3 |
2020-02-17 - 2020-05-17 |
3 months | crt.sh |
a248.e.akamai.net DigiCert Secure Site ECC CA-1 |
2019-08-13 - 2020-08-12 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mwnxg.masculinezone.net/c/f82757e39b1a28a9?s1=12852&s2=1035419&j1=1&j3=1
Frame ID: F0C76F02C30DD556AA145E9C16CA7DA4
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://gaytechfinder.tech/web/sean-cody-pass.php
HTTP 302
https://mwnxg.masculinezone.net/c/f82757e39b1a28a9?s1=12852&s2=1035419&j1=1&j3=1 Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://gaytechfinder.tech/web/sean-cody-pass.php
HTTP 302
https://mwnxg.masculinezone.net/c/f82757e39b1a28a9?s1=12852&s2=1035419&j1=1&j3=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
f82757e39b1a28a9
mwnxg.masculinezone.net/c/ Redirect Chain
|
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
cdn-aimi.akamaized.net/landings/149299/1551970288/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.min.js
cdn-aimi.akamaized.net/landings/149299/1551970288/js/ |
252 KB 75 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
function.js
cdn-aimi.akamaized.net/landings/149299/1551970288/js/ |
765 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
767 B 487 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no.png
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yes.png
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
642 KB 642 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern.png
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.jpg
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
394 KB 395 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.jpg
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
396 KB 396 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.jpg
cdn-aimi.akamaized.net/landings/149299/1551970288/images/ |
403 KB 404 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery number| chromeVersion boolean| exit3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mwnxg.masculinezone.net/ | Name: scriptHash Value: 200148_12852_1035419 |
|
mwnxg.masculinezone.net/ | Name: unique_id Value: 5e5240853af04187753300 |
|
mwnxg.masculinezone.net/ | Name: unique_2810725 Value: unique_2810725 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-aimi.akamaized.net
fonts.googleapis.com
fonts.gstatic.com
gaytechfinder.tech
mwnxg.masculinezone.net
2.16.186.115
2606:4700:3032::681c:1dae
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a05:d018:244:5200::ab
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
26536020d96f2e286b5b3172554b51b4a80ad8c51fb4f589b061a1c8eb1faf33
322d600431f53fb186989dad7e4ed1365b0d3012a808cd114390855a0dce16a6
452eb955c14bff0f815d78d2ff1a041dec32aa23db4616c8dfa261d3fe57d4e3
556db7f77fd0417fb370578131157a19d82561d2d2fff00f255e2b91f9034962
5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004
6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43
8d87f3fb7aa5eb440a473e8b3a8a9d669acce3014b2ec82fcae4193dee362f51
97de6409e63b099ac04fba91eeaa10d66ac75341e56853debf5445ac29668062
abe878254336b78ae45b4e275f1415f6c735b81e6aa55fcc6951d033e24aaf9c
b4723b5b14abe7a2062b65bf79b4d5d1e575e786a439e61ff95a38e7e9e140e9
edd62f7fecd3d7aee2267610abfdb981f03137cd725addcf0e18132873b8d00c
fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1