metruhak.com Open in urlscan Pro
46.28.109.157  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request document.html Show response metruhak.com/nu/	1 MB 1 MB	287ms 40ms	Document text/html	46.28.109.157 WEDOS
General Check archive.org Show headers Download Go to Full URL https://metruhak.com/nu/document.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 46.28.109.157 Bilina, Czech Republic, ASN197019 (WEDOS, CZ), Reverse DNS Software Apache / Resource Hash 419cbbbe76b0044dbffab673d7a9334aedc775b620568bc11d4d9e370cffa2fb Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 1381358 Content-Type text/html Date Wed, 18 Jan 2023 06:19:30 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 06 Dec 2022 00:59:32 GMT Server Apache
GET DATA	200 OK	truncated /	24 KB 0		Stylesheet text/css
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a703345c40f5151b561a237137b1d08d21a785b35a376931b60f19c8db5d3143 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type text/css
GET DATA	200 OK	truncated /	28 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 35a9ad27911fa8884da750baefca6a1f0f8be43a33138f91473a00e623fdc80e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	121ms 23ms	Image image/svg+xml	2620:1ec:4e:1::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: metruhak.com URL: https://metruhak.com/nu/document.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4e:1::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language de-DE,de;q=0.9 Referer https://metruhak.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 Jan 2023 06:19:30 GMT content-encoding gzip x-azure-ref-originshield 0A2HHYwAAAADLQJMArI6XRoqvjvLY0cTkRlJBMjMxMDUwNDE4MDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 nzaLxFgP7ZB3dfMcaybWzw== x-cache TCP_HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D79B8373CB2849 x-azure-ref 0c4/HYwAAAADmezK1BUD0Sqp8t8bXels2RlJBMzFFREdFMDkwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id b2fbd25c-f01e-0004-59c5-169b7b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET DATA	200 OK	truncated /	809 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b75253d604ec779ef3766a10b43788744fb243f0a5697b47a0d372ce437aff2d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/jpeg
GET H/1.1	200 OK	document.html metruhak.com/nu/	1 MB 1 MB	34ms 34ms	Image text/html	46.28.109.157 WEDOS
General Check archive.org Show headers Download Go to Show image Full URL https://metruhak.com/nu/document.html Requested by Host: metruhak.com URL: https://metruhak.com/nu/document.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 46.28.109.157 Bilina, Czech Republic, ASN197019 (WEDOS, CZ), Reverse DNS Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://metruhak.com/nu/document.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 18 Jan 2023 06:19:30 GMT Last-Modified Tue, 06 Dec 2022 00:59:32 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1381358
GET H2	200	ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg aadcdn.msauth.net/ests/2.1/content/images/	915 B 613 B	65ms 24ms	Image image/svg+xml	2620:1ec:4e:1::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg Requested by Host: metruhak.com URL: https://metruhak.com/nu/document.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4e:1::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers accept-language de-DE,de;q=0.9 Referer https://metruhak.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 Jan 2023 06:19:30 GMT content-encoding gzip x-azure-ref-originshield 0TXrHYwAAAAB0KqTUplKcQZuH0l95kwvlRlJBMjMxMDUwNDE3MDI1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 HMwsHhNXdtrfirQDkzcqMA== x-cache TCP_HIT content-length 263 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:24 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D64101521A1ED5 x-azure-ref 0c4/HYwAAAADDi/oHge3mQbWAebuj1fh3RlJBMzFFREdFMDkwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id 7f61e768-401e-0083-766e-271d20000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H2	200	ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg aadcdn.msauth.net/ests/2.1/content/images/	915 B 594 B	65ms 24ms	Image image/svg+xml	2620:1ec:4e:1::60 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg Requested by Host: metruhak.com URL: https://metruhak.com/nu/document.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4e:1::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6 Request headers accept-language de-DE,de;q=0.9 Referer https://metruhak.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 18 Jan 2023 06:19:30 GMT content-encoding gzip x-azure-ref-originshield 0JVfHYwAAAAB+4HC1wEhuQZm6vVrXN2eHRlJBMjMxMDUwNDE4MDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 /a3y/mpA+HRaVAiPACrsog== x-cache TCP_HIT content-length 263 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:25:23 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D641015168A4FB x-azure-ref 0c4/HYwAAAAC8ILyvlc+sRZlCLeOCOPcNRlJBMzFFREdFMDkwOAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id 5a7db48b-501e-009a-16c5-28de11000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19
GET H/1.1	404 Not Found	sc_login.js metruhak.com/nu/	0 0	103ms 34ms	Script text/html	46.28.109.157 WEDOS
General Check archive.org Show headers Download Go to Full URL https://metruhak.com/nu/sc_login.js Requested by Host: metruhak.com URL: https://metruhak.com/nu/document.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 46.28.109.157 Bilina, Czech Republic, ASN197019 (WEDOS, CZ), Reverse DNS Software Apache / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://metruhak.com/nu/document.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Wed, 18 Jan 2023 06:19:30 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated Show response /	26 KB 0		Script application/x-javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 22a67790ce6b6632c0c1780e5c9edadfd7b5e306705213dfa36979d9508fe645 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type application/x-javascript
GET DATA	200 OK	truncated Show response /	87 KB 0		Script application/x-javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type application/x-javascript

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| forEach function| detect function| $ function| jQuery string| page function| hex_to_ascii string| tnk string| wrt

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://metruhak.com/nu/sc_login.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
metruhak.com
2620:1ec:4e:1::60
46.28.109.157
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
22a67790ce6b6632c0c1780e5c9edadfd7b5e306705213dfa36979d9508fe645
35a9ad27911fa8884da750baefca6a1f0f8be43a33138f91473a00e623fdc80e
419cbbbe76b0044dbffab673d7a9334aedc775b620568bc11d4d9e370cffa2fb
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
a703345c40f5151b561a237137b1d08d21a785b35a376931b60f19c8db5d3143
b75253d604ec779ef3766a10b43788744fb243f0a5697b47a0d372ce437aff2d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d