URL: https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Submission: On June 18 via automatic, source openphish

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 192.249.126.156, located in Los Angeles, United States and belongs to IMH-WEST - InMotion Hosting, Inc., US. The main domain is imhafiz.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 1st 2019. Valid for: 3 months.
This is the only time imhafiz.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: GoDaddy (Online)

Domain & IP information

IP Address AS Autonomous System
3 192.249.126.156 22611 (IMH-WEST)
3 2.20.21.198 20940 (AKAMAI-ASN1)
10 3
Apex Domain
Subdomains
Transfer
3 wsimg.com
img1.wsimg.com
68 KB
3 imhafiz.info
imhafiz.info
73 KB
0 Failed
function sub() { [native code] }. Failed
10 3
Domain Requested by
3 img1.wsimg.com imhafiz.info
3 imhafiz.info imhafiz.info
0 pogijhnlcfmcppgimcaccdkmbedjkmhi Failed imhafiz.info
10 3
Subject Issuer Validity Valid
imhafiz.info
cPanel, Inc. Certification Authority
2019-05-01 -
2019-07-30
3 months crt.sh
*.wsimg.com
Starfield Secure Certificate Authority - G2
2018-09-25 -
2020-09-25
2 years crt.sh

This page contains 1 frames:

Primary Page: https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Frame ID: 9208E5D942DCEFB4B31DDA2EFFC9F982
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Sign In

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

10
Requests

60 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

141 kB
Transfer

431 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
imhafiz.info/workspace/redirect/
57 KB
16 KB
Document
General
Full URL
https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.249.126.156 Los Angeles, United States, ASN22611 (IMH-WEST - InMotion Hosting, Inc., US),
Reverse DNS
server.bd360news.com
Software
nginx/1.16.0 /
Resource Hash
4d40ba0e893435c6400aee7f2f4cc20f5abbb4ae34d5130fa63771a4c48cd9ea

Request headers

Host
imhafiz.info
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx/1.16.0
Date
Tue, 18 Jun 2019 20:05:18 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
X-Proxy-Cache
HIT
Content-Encoding
gzip
uxfont.woff2
img1.wsimg.com/ux/fonts/uxfont/1.4/
13 KB
13 KB
Font
General
Full URL
https://img1.wsimg.com/ux/fonts/uxfont/1.4/uxfont.woff2
Requested by
Host: imhafiz.info
URL: https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.21.198 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-21-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2ed3bfbad14aa95968f7c0ab2e2ad07a7aeb6f090d9d3e71f7a71b715e7583ff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Origin
https://imhafiz.info

Response headers

date
Tue, 18 Jun 2019 20:05:19 GMT
last-modified
Tue, 01 May 2018 17:31:42 GMT
access-control-allow-origin
*
etag
"b6f2e44472e1d31:0"
content-type
application/font-woff2
status
200
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
13212
expires
Wed, 17 Jun 2020 20:05:19 GMT
uxfont-2.woff2
img1.wsimg.com/ux/fonts/uxfont/1.4/
28 KB
29 KB
Font
General
Full URL
https://img1.wsimg.com/ux/fonts/uxfont/1.4/uxfont-2.woff2
Requested by
Host: imhafiz.info
URL: https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.21.198 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-21-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ff2b18fa1e758d5d886fd13dba0187c707ac8c8c8cacbab8b8e80d2da6aa5782

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Origin
https://imhafiz.info

Response headers

date
Tue, 18 Jun 2019 20:05:19 GMT
last-modified
Tue, 01 May 2018 17:31:42 GMT
access-control-allow-origin
*
etag
"54c3ca4472e1d31:0"
content-type
application/font-woff2
status
200
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
29092
expires
Wed, 17 Jun 2020 20:05:19 GMT
uxcore2.min.css
imhafiz.info/workspace/redirect/files/
266 KB
47 KB
Stylesheet
General
Full URL
https://imhafiz.info/workspace/redirect/files/uxcore2.min.css
Requested by
Host: imhafiz.info
URL: https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.249.126.156 Los Angeles, United States, ASN22611 (IMH-WEST - InMotion Hosting, Inc., US),
Reverse DNS
server.bd360news.com
Software
nginx/1.16.0 /
Resource Hash
5081567746c3df06e4ee93eb7dbf04e667e7daed3e0ae6119b51b790686d3f86

Request headers

Referer
https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 18 Jun 2019 20:05:19 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jun 2019 01:48:13 GMT
Server
nginx/1.16.0
ETag
W/"5d0059dd-4260a"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=604800, public, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
X-Proxy-Cache
STATIC/TYPE
Expires
Tue, 25 Jun 2019 20:05:19 GMT
utilityheader.min.css
imhafiz.info/workspace/redirect/files/
38 KB
10 KB
Stylesheet
General
Full URL
https://imhafiz.info/workspace/redirect/files/utilityheader.min.css
Requested by
Host: imhafiz.info
URL: https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.249.126.156 Los Angeles, United States, ASN22611 (IMH-WEST - InMotion Hosting, Inc., US),
Reverse DNS
server.bd360news.com
Software
nginx/1.16.0 /
Resource Hash
5bf7bac0c0e8f21899430b2e63b20da9ce2e7717889341fc1cb5c836453a2f2b

Request headers

Referer
https://imhafiz.info/workspace/redirect/?email=jim%40thejimburkefamily.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 18 Jun 2019 20:05:19 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jun 2019 01:48:13 GMT
Server
nginx/1.16.0
ETag
W/"5d0059dd-9998"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=604800, public, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
X-Proxy-Cache
STATIC/TYPE
Expires
Tue, 25 Jun 2019 20:05:19 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
316798ddb9d835066f727ac3af8969a5ca00adfe3b0042c0d8076bc5ab05567e

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
text/plain;charset=US-ASCII
font_9qmmi8b8jsxxbt9.woff
pogijhnlcfmcppgimcaccdkmbedjkmhi/res/
0
0

font_9qmmi8b8jsxxbt9.ttf
pogijhnlcfmcppgimcaccdkmbedjkmhi/res/
0
0

font_9qmmi8b8jsxxbt9.woff
pogijhnlcfmcppgimcaccdkmbedjkmhi/res/
0
0

font_9qmmi8b8jsxxbt9.ttf
pogijhnlcfmcppgimcaccdkmbedjkmhi/res/
0
0

gdsherpa-regular.woff2
img1.wsimg.com/ux/fonts/sherpa/1.0/
26 KB
26 KB
Font
General
Full URL
https://img1.wsimg.com/ux/fonts/sherpa/1.0/gdsherpa-regular.woff2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.20.21.198 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-20-21-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4e729cb03aae3843f08d49b187de566cce586da0b384787cc304dbe43a713b70

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://imhafiz.info/workspace/redirect/files/uxcore2.min.css
Origin
https://imhafiz.info

Response headers

date
Tue, 18 Jun 2019 20:05:19 GMT
last-modified
Thu, 21 Dec 2017 23:08:07 GMT
access-control-allow-origin
*
etag
"ec1d1690b07ad31:0"
content-type
application/font-woff2
status
200
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
26620
expires
Wed, 17 Jun 2020 20:05:19 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pogijhnlcfmcppgimcaccdkmbedjkmhi
URL
chrome-extension://pogijhnlcfmcppgimcaccdkmbedjkmhi/res/font_9qmmi8b8jsxxbt9.woff
Domain
pogijhnlcfmcppgimcaccdkmbedjkmhi
URL
chrome-extension://pogijhnlcfmcppgimcaccdkmbedjkmhi/res/font_9qmmi8b8jsxxbt9.ttf
Domain
pogijhnlcfmcppgimcaccdkmbedjkmhi
URL
chrome-extension://pogijhnlcfmcppgimcaccdkmbedjkmhi/res/font_9qmmi8b8jsxxbt9.woff
Domain
pogijhnlcfmcppgimcaccdkmbedjkmhi
URL
chrome-extension://pogijhnlcfmcppgimcaccdkmbedjkmhi/res/font_9qmmi8b8jsxxbt9.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: GoDaddy (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies