metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz
Open in
urlscan Pro
139.59.255.208
Malicious Activity!
Public Scan
Effective URL: https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142dd7ee0c85
Submission: On September 16 via manual from CN — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 2nd 2021. Valid for: 3 months.
This is the only time metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 18.231.80.194 18.231.80.194 | 16509 (AMAZON-02) (AMAZON-02) | |
1 11 | 139.59.255.208 139.59.255.208 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
10 | 1 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-231-80-194.sa-east-1.compute.amazonaws.com
nt.embluemail.com |
ASN14061 (DIGITALOCEAN-ASN, US)
ansley.farazbamgostar.com | |
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
cloudns.nz
1 redirects
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
301 KB |
1 |
farazbamgostar.com
ansley.farazbamgostar.com |
23 KB |
1 |
embluemail.com
1 redirects
nt.embluemail.com |
226 B |
10 | 3 |
Domain | Requested by | |
---|---|---|
10 | metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
1 redirects
ansley.farazbamgostar.com
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz |
1 | ansley.farazbamgostar.com | |
1 | nt.embluemail.com | 1 redirects |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ansley.farazbamgostar.com R3 |
2021-09-16 - 2021-12-15 |
3 months | crt.sh |
www.metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz R3 |
2021-09-02 - 2021-12-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142dd7ee0c85
Frame ID: DE57E1DA65E3477AD39942B3938E8F71
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
7787654193B6740D2F4B71BF442550786142DD7F1F833Page URL History Show full URLs
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2...
HTTP 302
https://ansley.farazbamgostar.com/bWljaGFlbC56aHVAdHRpZ3JvdXAuY29t Page URL
-
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/$&ocYFNX4qO4aMwWIllCeztAL...
HTTP 302
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142dd7ee0c85 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fansley.farazbamgostar.com%2FbWljaGFlbC56aHVAdHRpZ3JvdXAuY29t
HTTP 302
https://ansley.farazbamgostar.com/bWljaGFlbC56aHVAdHRpZ3JvdXAuY29t Page URL
-
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/$&ocYFNX4qO4aMwWIllCeztALxOX4cDLQHfLTR6dXthnowhjV2SMRI8j3Spzi0f65fLOJ8hD1FYGlr3OrmcMmmrACpuTeCmG1YkfA7v8MQtjEVPizxCnOfGFSL3Ul9sGAIQ8kcK8Y9l5wo1h33XUi4hr7vrVZbgx3iljy1lCkluZa4SJlid2Ke4rstVIPcITt7CvHY22o0?client=bWljaGFlbC56aHVAdHRpZ3JvdXAuY29t
HTTP 302
https://metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/PS-6142dd7ee0c85 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://nt.embluemail.com/p/cl?data=8d9cg%2BSyaNP%2FaRwH0uUoq0p%2FUOMcKb%2FlnNafQmcO2U7h7k790gBhUSpjU2Cc5aJ%2BJL%2F8Q9Qe0SwNUiD20GnvLai5u9vMEKGwxhAyvrDtC4s%3D%21-%217j6gn%3A%21-%21https%3A%2F%2Fansley.farazbamgostar.com%2FbWljaGFlbC56aHVAdHRpZ3JvdXAuY29t HTTP 302
- https://ansley.farazbamgostar.com/bWljaGFlbC56aHVAdHRpZ3JvdXAuY29t
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
bWljaGFlbC56aHVAdHRpZ3JvdXAuY29t
ansley.farazbamgostar.com/ Redirect Chain
|
23 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
PS-6142dd7ee0c85
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ Redirect Chain
|
37 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d73270bf8138926bb32f714741541404456f76fd78d75
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/APP-J2LCOW/ |
103 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
528764fd732189f10f08d4d51b1446b4437bf77732675
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/o/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8dfd65076d521774f4177441843b54b73026fb81329f7
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/e/ |
513 B 634 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
18b3171d8b02492478571d735d624774465f0f734ff6b
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/jq/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7bf7f705724bf1343049b163d67d2445874f87d118562
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/boot/ |
50 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4441084570217675d79d74b123f861327645b8ff7fb3d
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/jm/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-87124376778549f4ff6173d0b168b0174324dbf75d524
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
api-546237b7b45667f71f310f8571d824412d4787d49b0f3
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/S6IoW0FnkD423LktQsTvNHqRc8J0lh40VV173sL5peJH2ax6uG/ |
227 KB 224 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| bootstrap string| email string| url function| sleep1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz/ | Name: PHPSESSID Value: edf5qcas2j57dp3iludgka9tvu |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ansley.farazbamgostar.com
metab8d4891bbb304bc7e0ab4b317af2508c.cloudns.nz
nt.embluemail.com
139.59.255.208
18.231.80.194
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2153866e55999639004f97af889ae0d95b3501363a48d11b9c2f7362cdad2941
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
587bc23de2f63be67ae2ad113f50b898a01104739a08fa589671895d6c7ded5b
a7057bebfff43e7281ca31da00d40bd88c8d02d1576b9c45891dd56a3853269a
be06dfa2765929402af9cff3400701941fffa9704210fbc518cb3e41c1bfc448
fb23209dbc5709c625b8103fdbc6914f5cb8df714c88e4dbc99f22cd18ebcde7