www.saturntreeseven.com
Open in
urlscan Pro
40.64.96.70
Malicious Activity!
Public Scan
Effective URL: https://www.saturntreeseven.com/o-jfxl-e61-c1fc1d6ad0f1e353d9706e36edaeb482
Submission: On May 07 via manual from US — Scanned from US
Summary
TLS certificate: Issued by R3 on March 26th 2022. Valid for: 3 months.
This is the only time www.saturntreeseven.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 6 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 69.30.196.250 69.30.196.250 | 32097 (WII) (WII) | |
1 | 40.64.96.70 40.64.96.70 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3033::6815:3f36 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:809::2008 | 15169 (GOOGLE) (GOOGLE) | |
4 | 2600:9000:216... 2600:9000:2162:d400:7:5868:a100:21 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 35.188.42.15 35.188.42.15 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2607:f8b0:400... 2607:f8b0:4006:824::2003 | 15169 (GOOGLE) (GOOGLE) | |
4 | 52.25.42.41 52.25.42.41 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:816::200e | 15169 (GOOGLE) (GOOGLE) | |
18 | 10 |
ASN32097 (WII, US)
PTR: passrearm.com
gjwhrkyosrt_ghu40326660.denistryworldspace.org.uk |
ASN15169 (GOOGLE, US)
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN16509 (AMAZON-02, US)
ds2r9mr2r4h38.cloudfront.net |
ASN15169 (GOOGLE, US)
PTR: 15.42.188.35.bc.googleusercontent.com
sentry.io |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-25-42-41.us-west-2.compute.amazonaws.com
api.optoutsystem.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
optoutsystem.com
api.optoutsystem.com — Cisco Umbrella Rank: 141449 |
1 KB |
4 |
cloudfront.net
ds2r9mr2r4h38.cloudfront.net |
255 KB |
2 |
gstatic.com
fonts.gstatic.com |
32 KB |
2 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1448 |
78 KB |
1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 101 |
20 KB |
1 |
sentry.io
sentry.io — Cisco Umbrella Rank: 386 |
413 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 142 |
40 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1095 |
22 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 111 |
1 KB |
1 |
saturntreeseven.com
www.saturntreeseven.com — Cisco Umbrella Rank: 403367 |
3 KB |
1 |
denistryworldspace.org.uk
1 redirects
gjwhrkyosrt_ghu40326660.denistryworldspace.org.uk |
329 B |
18 | 11 |
Domain | Requested by | |
---|---|---|
4 | api.optoutsystem.com |
ds2r9mr2r4h38.cloudfront.net
|
4 | ds2r9mr2r4h38.cloudfront.net |
www.saturntreeseven.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | use.fontawesome.com |
www.saturntreeseven.com
use.fontawesome.com |
1 | www.google-analytics.com |
ds2r9mr2r4h38.cloudfront.net
|
1 | sentry.io |
ds2r9mr2r4h38.cloudfront.net
|
1 | www.googletagmanager.com |
www.saturntreeseven.com
|
1 | maxcdn.bootstrapcdn.com |
www.saturntreeseven.com
|
1 | fonts.googleapis.com |
www.saturntreeseven.com
|
1 | www.saturntreeseven.com | |
1 | gjwhrkyosrt_ghu40326660.denistryworldspace.org.uk | 1 redirects |
18 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.saturntreeseven.com R3 |
2022-03-26 - 2022-06-24 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-04-18 - 2022-07-11 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-04-18 - 2022-07-11 |
3 months | crt.sh |
*.cloudfront.net Amazon |
2022-02-01 - 2023-01-31 |
a year | crt.sh |
sentry.io DigiCert SHA2 Secure Server CA |
2020-06-02 - 2022-06-07 |
2 years | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-04-18 - 2022-07-11 |
3 months | crt.sh |
*.optoutsystem.com Amazon |
2021-07-30 - 2022-08-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.saturntreeseven.com/o-jfxl-e61-c1fc1d6ad0f1e353d9706e36edaeb482
Frame ID: BB28630DD654906B4C458C98A9E20405
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
UnsubscribePage URL History Show full URLs
-
http://gjwhrkyosrt_ghu40326660.denistryworldspace.org.uk/send.asp?campagain=0XsjI:eu8Hcn-3484845038;unP8ZQKGRW5pMY;eln29fLQYHZvpxP;72...
HTTP 302
https://www.saturntreeseven.com/o-jfxl-e61-c1fc1d6ad0f1e353d9706e36edaeb482 Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://gjwhrkyosrt_ghu40326660.denistryworldspace.org.uk/send.asp?campagain=0XsjI:eu8Hcn-3484845038;unP8ZQKGRW5pMY;eln29fLQYHZvpxP;7230;16523408-H900aacy-227;8029921-4crr-ZnazzGunw23ew7ornhglnegqrftvazbqry_bet-aMXTSPCkKU:wLFEOdxJsPH-1q7hemj-Aeob-onxregnlybe28w23ew7tznvy_pbz-ZczQLvX07kn3e8HOlVRgBuPChA9aKfoW1Jt2iyEN
HTTP 302
https://www.saturntreeseven.com/o-jfxl-e61-c1fc1d6ad0f1e353d9706e36edaeb482 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
o-jfxl-e61-c1fc1d6ad0f1e353d9706e36edaeb482
www.saturntreeseven.com/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.3.1/css/ |
48 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
104 KB 40 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.702664aa.chunk.css
ds2r9mr2r4h38.cloudfront.net/static/css/ |
45 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.449a4c7a.chunk.css
ds2r9mr2r4h38.cloudfront.net/static/css/ |
1 KB 991 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.d2eaece3.chunk.js
ds2r9mr2r4h38.cloudfront.net/static/js/ |
743 KB 220 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.b4479a76.chunk.js
ds2r9mr2r4h38.cloudfront.net/static/js/ |
31 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
sentry.io/api/1314267/envelope/ |
2 B 413 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-solid-900.woff2
use.fontawesome.com/releases/v5.3.1/webfonts/ |
66 KB 66 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
optout-key
api.optoutsystem.com/auth/legacy/ |
386 B 656 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
optout-key
api.optoutsystem.com/auth/legacy/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
optout-page
api.optoutsystem.com/campaigns/188884/ |
216 B 485 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
optout-page
api.optoutsystem.com/campaigns/188884/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
task.url
Submitted on
May 7th 2022, 7:13:51 pm
UTC —
From United States
Threats:
Malware
Phishing
Misc
Comment: Infected with URL:Blacklist. See report at https://sitecheck.sucuri.net/results/GJWHRKYOSRT_ghu40326660.denistryworldspace.org.uk/send.asp?q=campagain%3D0XsjI%3Aeu8Hcn-3484845038%3BunP8ZQKGRW5pMY%3Beln29fLQYHZvpxP%3B7230%3B16523408-H900aacy-227%3B8029921-4crr-ZnazzGunw23ew7ornhglnegqrftvazbqry_bet-aMXTSPCkKU%3AwLFEOdxJsPH-1q7hemj-Aeob-onxregnlybe28w23ew7tznvy_pbz-ZczQLvX07kn3e8HOlVRgBuPChA9aKfoW1Jt2iyEN
Malicious
task.url
Submitted on
May 7th 2022, 7:11:03 pm
UTC —
From United States
Threats:
Misc
Comment: Malicious 3xx redirect stack sent to spam trap.
Malicious
page.url
Submitted on
May 7th 2022, 7:10:21 pm
UTC —
From United States
Threats:
Scam
Misc
Comment: Known Spam / Spam Propagator: URL was sent to spam trap and is a known Fraudulent unsubscribe form which propagates further spam.
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| gtag object| dataLayer object| webpackJsonpapp function| setImmediate function| clearImmediate object| regeneratorRuntime object| __SENTRY__ object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.saturntreeseven.com/ | Name: _ga Value: GA1.2.1224344566.1651950520 |
|
.saturntreeseven.com/ | Name: _gid Value: GA1.2.1304875929.1651950520 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.optoutsystem.com
ds2r9mr2r4h38.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
gjwhrkyosrt_ghu40326660.denistryworldspace.org.uk
maxcdn.bootstrapcdn.com
sentry.io
use.fontawesome.com
www.google-analytics.com
www.googletagmanager.com
www.saturntreeseven.com
2600:9000:2162:d400:7:5868:a100:21
2606:4700:3033::6815:3f36
2606:4700::6812:acf
2607:f8b0:4006:809::2008
2607:f8b0:4006:80d::200a
2607:f8b0:4006:816::200e
2607:f8b0:4006:824::2003
35.188.42.15
40.64.96.70
52.25.42.41
69.30.196.250
174ea411ff84f44d42de685ddff61ca2b450bc460398198a11075d0aae005415
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
2ddefcdc9f260c5ffeb93fed110fe9d929028226f9a2d8a4934ea52b546e9640
40a1e611dc3e99056b8e82467158554de115bc6fa92f6a415212b166bb03e542
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
604dcf1f11698655f75046bb92f98aaa9477e1c16b01c5fc415e78794393ffb9
6f2d854134de1059d8b13013f014a4584e7f0753616bd03edc7819db9f8bba98
a0cdfb5e840b2e2e4df1de9f0425c5026f803015f519eb3b01ae3fb1077f9678
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a457ba690103704778a8a2c1714436a5b1d96fed6a4a597161b93ac6121388bd
a7027327bf430603b54bb644a0a41becfa633e877d1890ec119b83896e3fca3c
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc1e629c1b1cdc9acb04dd5bd0224364f7f1ef6775e96f257cb940f915d23baf
ca3ea16761b7d443c64cfd99dd1cf8aa84790a25bb4709582935956fe71d014d
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
f0a724916f34e142f962ec6dcbda3a927e0e218fdc53cdaf0d2932827f70f757