web.nitro-dev.ey.com Open in urlscan Pro
20.82.13.59 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://web.nitro-dev.ey.com/
Submission Tags: phishingrod
Submission: On June 15 via api (June 15th 2024, 9:15:50 am UTC) from DE — Scanned from NL

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 20.82.13.59, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is web.nitro-dev.ey.com.
TLS certificate: Issued by GeoTrust Global TLS RSA4096 SHA256 20... on January 28th 2024. Valid for: 6 months.

This is the only time web.nitro-dev.ey.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	20.82.13.59 20.82.13.59	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
5	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
9	3

1 20.82.13.59 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

web.nitro-dev.ey.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

appservice.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	azureedge.net appservice.azureedge.net — Cisco Umbrella Rank: 273589	16 KB
3	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 3086	148 KB
1	ey.com web.nitro-dev.ey.com	3 KB
9	3

	Domain	Requested by
5	appservice.azureedge.net	web.nitro-dev.ey.com
3	ajax.aspnetcdn.com	web.nitro-dev.ey.com
1	web.nitro-dev.ey.com
9	3

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid
web.nitro-dev.ey.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2024-01-28` - `2024-07-28`	6 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2024-06-06` - `2025-06-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://web.nitro-dev.ey.com/
Frame ID: 297C8689B8115BC72B87CE2D03D590C5
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Azure Static Web Apps - 403: Forbidden

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

167 kB
Transfer

353 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?linkid=2129797&clcid=0x409
Title: Learn more

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 403 Primary Request / Show response
web.nitro-dev.ey.com/ 2 KB
3 KB 218ms
56ms Document
text/html 20.82.13.59
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.nitro-dev.ey.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 20.82.13.59 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 6c35b837e90cf0625ae8338157e3ad5971048d77f048b261725b19480d2283f5

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store
content-type: text/html
date: Sat, 15 Jun 2024 09:15:45 GMT

GET
H2 200 bootstrap.min.css
ajax.aspnetcdn.com/ajax/bootstrap/5.2.3/css/ 190 KB
41 KB 78ms
19ms Stylesheet
text/css 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/bootstrap/5.2.3/css/bootstrap.min.css

Requested by

Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/48ED) /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Origin: https://web.nitro-dev.ey.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7187761
x-cache: HIT
content-length: 41560
x-xss-protection: 1; mode=block
last-modified: Thu, 01 Dec 2022 18:22:50 GMT
server: ECAcc (ama/48ED)
etag: "1085bebb15d91:0"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 main.css
appservice.azureedge.net/css/static-apps/v3/ 1 KB
805 B 83ms
18ms Stylesheet
text/css 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://appservice.azureedge.net/css/static-apps/v3/main.css
Requested by: Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/48B9) / ASP.NET
Resource Hash: 666dd97a683171808b9aaaf4a1ef11c97865df5046172fed704f70c78e940830

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 06:02:52 GMT
server: ECAcc (ama/48B9)
age: 221183
etag: "1d629b54d7f0a6e"
x-powered-by: ASP.NET
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
accept-ranges: bytes
content-length: 580
request-context: appId=cid-v1:b1f25d93-43a0-49c0-81e8-f6c8f295fc12

GET
H2 200 loc.min.js Show response
appservice.azureedge.net/scripts/static-apps/v3/ 23 B
242 B 82ms
17ms Script
application/javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://appservice.azureedge.net/scripts/static-apps/v3/loc.min.js
Requested by: Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/48B7) / ASP.NET
Resource Hash: bd6300f28f9701ddc7283d2e6629020fc7969e5064e4258a894fdd2ef6da666f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Origin: https://web.nitro-dev.ey.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
last-modified: Thu, 14 May 2020 06:27:34 GMT
server: ECAcc (ama/48B7)
age: 221084
etag: "1d629b8c0d64f17"
x-powered-by: ASP.NET
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 23
request-context: appId=cid-v1:b1f25d93-43a0-49c0-81e8-f6c8f295fc12

GET
H2 200 microsoft_azure_logo.svg
appservice.azureedge.net/images/static-apps/v3/ 5 KB
5 KB 85ms
20ms Image
image/svg+xml 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://appservice.azureedge.net/images/static-apps/v3/microsoft_azure_logo.svg
Requested by: Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/4903) / ASP.NET
Resource Hash: b4b809961668bd61715c146dfcf59b3d9ea9a1c6cc8091c29fa547302cddf3c1

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
last-modified: Thu, 14 May 2020 23:05:20 GMT
server: ECAcc (ama/4903)
age: 220287
etag: "1d62a4423c0eaea"
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/svg+xml
accept-ranges: bytes
content-length: 4842
request-context: appId=cid-v1:b1f25d93-43a0-49c0-81e8-f6c8f295fc12

GET
H2 200 staticapps.svg
appservice.azureedge.net/images/static-apps/v3/ 8 KB
8 KB 83ms
19ms Image
image/svg+xml 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://appservice.azureedge.net/images/static-apps/v3/staticapps.svg
Requested by: Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/4898) / ASP.NET
Resource Hash: af633c8781d0e41fb1787e2709ff7926a0519c80a80bdd057021e00e1b48dda2

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
last-modified: Wed, 06 May 2020 23:54:28 GMT
server: ECAcc (ama/4898)
age: 354069
etag: "1d62401ad980da8"
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/svg+xml
accept-ranges: bytes
content-length: 8104
request-context: appId=cid-v1:b1f25d93-43a0-49c0-81e8-f6c8f295fc12

GET
H2 200 jquery-3.7.1.min.js Show response
ajax.aspnetcdn.com/ajax/jquery/ 85 KB
86 KB 19ms
18ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jquery/jquery-3.7.1.min.js

Requested by

Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/48E4) /

Resource Hash

fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Origin: https://web.nitro-dev.ey.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 30 Aug 2023 17:30:02 GMT
server: ECAcc (ama/48E4)
age: 7187908
etag: "096f9b67dbd91:0"
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 87533
x-xss-protection: 1; mode=block

GET
H2 200 bootstrap.min.js Show response
ajax.aspnetcdn.com/ajax/bootstrap/5.2.3/ 59 KB
22 KB 33ms
33ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/bootstrap/5.2.3/bootstrap.min.js

Requested by

Host: web.nitro-dev.ey.com
URL: https://web.nitro-dev.ey.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/48EF) /

Resource Hash

9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Origin: https://web.nitro-dev.ey.com
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7187759
x-cache: HIT
content-length: 22241
x-xss-protection: 1; mode=block
last-modified: Thu, 01 Dec 2022 18:23:25 GMT
server: ECAcc (ama/48EF)
etag: "78c98a0b25d91:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 favicon.svg
appservice.azureedge.net/images/static-apps/v3/ 2 KB
2 KB 18ms
17ms Other
image/svg+xml 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://appservice.azureedge.net/images/static-apps/v3/favicon.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/48D6) / ASP.NET
Resource Hash: 30efd61236d5f5fe2b02866f3b822ce9224d2315814fac05da9b7bfc76ca2e3f

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://web.nitro-dev.ey.com/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 15 Jun 2024 09:15:46 GMT
last-modified: Thu, 14 May 2020 06:02:26 GMT
server: ECAcc (ama/48D6)
age: 220436
etag: "1d629b53dffc29a"
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/svg+xml
accept-ranges: bytes
content-length: 1946
request-context: appId=cid-v1:b1f25d93-43a0-49c0-81e8-f6c8f295fc12

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://web.nitro-dev.ey.com/ Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
appservice.azureedge.net
web.nitro-dev.ey.com
152.199.19.160
20.82.13.59
2606:2800:133:206e:1315:22a5:2006:24fd
30efd61236d5f5fe2b02866f3b822ce9224d2315814fac05da9b7bfc76ca2e3f
666dd97a683171808b9aaaf4a1ef11c97865df5046172fed704f70c78e940830
6c35b837e90cf0625ae8338157e3ad5971048d77f048b261725b19480d2283f5
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
af633c8781d0e41fb1787e2709ff7926a0519c80a80bdd057021e00e1b48dda2
b4b809961668bd61715c146dfcf59b3d9ea9a1c6cc8091c29fa547302cddf3c1
bd6300f28f9701ddc7283d2e6629020fc7969e5064e4258a894fdd2ef6da666f
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

web.nitro-dev.ey.com Open in urlscan Pro 20.82.13.59 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

167 kBTransfer

353 kBSize

0 Cookies

1 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

web.nitro-dev.ey.com Open in urlscan Pro
20.82.13.59 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

167 kB
Transfer

353 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions