rwhconstruct.com Open in urlscan Pro
67.225.191.79 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://rwhconstruct.com/Minemine/Ourtime/
Effective URL:
http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Submission: On June 06 via manual (June 6th 2018, 10:23:45 pm UTC) from US

Summary HTTP 13 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 67.225.191.79, located in Lansing, United States and belongs to LIQUIDWEB - Liquid Web, L.L.C, US. The main domain is rwhconstruct.com.

This is the only time rwhconstruct.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Ourtime.com (Online)

Domain & IP information

	IP Address	AS Autonomous System
7	67.225.191.79 67.225.191.79	32244 (LIQUIDWEB) (LIQUIDWEB - Liquid Web)
4	216.58.207.42 216.58.207.42	15169 (GOOGLE) (GOOGLE - Google LLC)
2	216.58.208.35 216.58.208.35	15169 (GOOGLE) (GOOGLE - Google LLC)
13	3

7 67.225.191.79 (Lansing, United States)

ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US)
PTR: host.r2az.com

rwhconstruct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 216.58.207.42 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s24-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.208.35 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s12-in-f35.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	rwhconstruct.com rwhconstruct.com	113 KB
4	googleapis.com fonts.googleapis.com	2 KB
2	gstatic.com fonts.gstatic.com	119 KB
13	3

	Domain	Requested by
7	rwhconstruct.com	rwhconstruct.com
4	fonts.googleapis.com	rwhconstruct.com
2	fonts.gstatic.com	rwhconstruct.com
13	3

This site contains links to these domains. Also see Links.

Domain
www.ourtime.com
www.match.com
www.matchmediagroup.com
www.chemistry.com
www.blackpeoplemeet.com
www.bbpeoplemeet.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Frame ID: AA0B013518A17A740412F2F0C0C49387
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://rwhconstruct.com/Minemine/Ourtime/ Page URL
http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

13
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

235 kB
Transfer

305 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ourtime.com/?notrack
Title: home

Search URL Search Domain Scan URL

URL: https://www.ourtime.com/v3/billing/
Title: billing

Search URL Search Domain Scan URL

URL: http://www.match.com/cp/careers/CurrentOpenings.html
Title: careers

Search URL Search Domain Scan URL

URL: http://www.matchmediagroup.com/
Title: advertise with us

Search URL Search Domain Scan URL

URL: http://www.match.com/
Title: Match.com

Search URL Search Domain Scan URL

URL: http://www.chemistry.com/
Title: Chemistry.com

Search URL Search Domain Scan URL

URL: http://www.blackpeoplemeet.com/?notrack
Title: Black Singles

Search URL Search Domain Scan URL

URL: http://www.bbpeoplemeet.com/?notrack
Title: Big and Beautiful

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rwhconstruct.com/Minemine/Ourtime/ Page URL
http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
rwhconstruct.com/Minemine/Ourtime/ 89 B
322 B 388ms
261ms Document
text/html 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://rwhconstruct.com/Minemine/Ourtime/
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache / PHP/5.6.36
Resource Hash: 590398c96a4f4fe1cc760974cb0f6a18a29fd44b8018085fdafde66c472941d8

Request headers

Host: rwhconstruct.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: AA0B013518A17A740412F2F0C0C49387

Response headers

Date: Wed, 06 Jun 2018 22:23:35 GMT
Server: Apache
X-Powered-By: PHP/5.6.36
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request ourtime.php Show response
rwhconstruct.com/Minemine/Ourtime/ 46 KB
46 KB 748ms
747ms Document
text/html 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache / PHP/5.6.36
Resource Hash: 6d6199b6ebd0059493f9321b7b12b210734bdc43af1a13a0e30fd89974822cff

Request headers

Host: rwhconstruct.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://rwhconstruct.com/Minemine/Ourtime/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: AA0B013518A17A740412F2F0C0C49387
Referer: http://rwhconstruct.com/Minemine/Ourtime/

Response headers

Date: Wed, 06 Jun 2018 22:23:35 GMT
Server: Apache
X-Powered-By: PHP/5.6.36
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK soa.js Show response
rwhconstruct.com/Minemine/Ourtime/ 20 KB
20 KB 253ms
127ms Script
application/javascript 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://rwhconstruct.com/Minemine/Ourtime/soa.js
Requested by: Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache /
Resource Hash: 847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rwhconstruct.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Last-Modified: Mon, 14 Jul 2014 11:24:16 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 20325

GET
H/1.1 200
OK css
fonts.googleapis.com/ 222 B
566 B 22ms
16ms Stylesheet
text/css 216.58.207.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=PT+Sans:400

Requested by

Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d

Protocol

HTTP/1.1

Server

216.58.207.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f10.1e100.net

Software

ESF /

Resource Hash

89f4f3a5b77e1243163423590ee589b08a70bd6a748cf3c8070e82b788a188c3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Wed, 06 Jun 2018 22:23:36 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 228 B
568 B 21ms
15ms Stylesheet
text/css 216.58.207.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=PT+Sans:700

Requested by

Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d

Protocol

HTTP/1.1

Server

216.58.207.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f10.1e100.net

Software

ESF /

Resource Hash

7423b89c0c9e3884dc651e1ce95899677d25d75b2040eb710e87f6b34668b4d7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Wed, 06 Jun 2018 22:23:36 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 230 B
567 B 20ms
15ms Stylesheet
text/css 216.58.207.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=PT+Sans:400italic

Requested by

Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d

Protocol

HTTP/1.1

Server

216.58.207.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f10.1e100.net

Software

ESF /

Resource Hash

ee9dbbb216e95348737b5b6087e1b3bffc27f39acfc67ede43e7a17fdcc7f785

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Wed, 06 Jun 2018 22:23:36 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 243 B
577 B 20ms
14ms Stylesheet
text/css 216.58.207.42
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=PT+Sans:700italic

Requested by

Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d

Protocol

HTTP/1.1

Server

216.58.207.42 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s24-in-f10.1e100.net

Software

ESF /

Resource Hash

070a25d4945d6d5cbdc9ec5b29a96a5fefc9177ab5661a94833870c334919b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Wed, 06 Jun 2018 22:23:36 GMT

GET
H/1.1 200
OK theme.css
rwhconstruct.com/Minemine/Ourtime/images/ 37 KB
37 KB 127ms
127ms Stylesheet
text/css 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://rwhconstruct.com/Minemine/Ourtime/images/theme.css
Requested by: Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache /
Resource Hash: 186b633bc385b3ab9cd9f4842b88143829ac6369e13c79ec9b753733197c43fc

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rwhconstruct.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Last-Modified: Thu, 28 Jan 2016 05:12:30 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 37885

GET
H/1.1 200
OK logo.png
rwhconstruct.com/Minemine/Ourtime/images/ 3 KB
3 KB 127ms
127ms Image
image/png 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rwhconstruct.com/Minemine/Ourtime/images/logo.png
Requested by: Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache /
Resource Hash: 00894af01726cb0e9bccda4b7ebd47ad378235257433cd39d6cb9a00f5a3cb28

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rwhconstruct.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Last-Modified: Thu, 28 Jan 2016 05:02:06 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2608

GET
H/1.1 200
OK errorarrow.png
rwhconstruct.com/Minemine/Ourtime/images/ 1 KB
1 KB 127ms
127ms Image
image/png 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rwhconstruct.com/Minemine/Ourtime/images/errorarrow.png
Requested by: Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache /
Resource Hash: 046db21cd1d820736a54e13070f6ce05ba348245a750ed6a32bbd92f104392d7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rwhconstruct.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Last-Modified: Thu, 28 Jan 2016 05:03:44 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1131

GET
H/1.1 200
OK jizaRExUiTo99u79D0KEwA.ttf
fonts.gstatic.com/s/ptsans/v9/ 94 KB
59 KB 12ms
7ms Font
font/ttf 216.58.208.35
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v9/jizaRExUiTo99u79D0KEwA.ttf

Requested by

Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d

Protocol

HTTP/1.1

Server

216.58.208.35 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s12-in-f35.1e100.net

Software

sffe /

Resource Hash

ed3b51f6240250bb0427957fc3fa326a1a1140acbc31d8f162a568346b8366da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=PT+Sans:400
Origin: http://rwhconstruct.com

Response headers

Date: Thu, 08 Feb 2018 19:39:42 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 11 Oct 2017 18:24:45 GMT
Server: sffe
Age: 10205034
Vary: Accept-Encoding
Content-Type: font/ttf
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 59457
X-XSS-Protection: 1; mode=block
Expires: Fri, 08 Feb 2019 19:39:42 GMT

GET
H/1.1 200
OK headerbg.jpg
rwhconstruct.com/Minemine/Ourtime/images/ 5 KB
5 KB 127ms
127ms Image
image/jpeg 67.225.191.79
Liquid Web

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://rwhconstruct.com/Minemine/Ourtime/images/headerbg.jpg
Requested by: Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d
Protocol: HTTP/1.1
Server: 67.225.191.79 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS: host.r2az.com
Software: Apache /
Resource Hash: 3f6c8f3a0506ab9f82c38efb24dddc8810b23fb1d8abdfafd108411f352a42f1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: rwhconstruct.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://rwhconstruct.com/Minemine/Ourtime/images/theme.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://rwhconstruct.com/Minemine/Ourtime/images/theme.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 22:23:36 GMT
Last-Modified: Thu, 28 Jan 2016 05:12:04 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 4988

GET
H/1.1 200
OK jizfRExUiTo99u79B_mh0O6tKA.ttf
fonts.gstatic.com/s/ptsans/v9/ 98 KB
61 KB 13ms
8ms Font
font/ttf 216.58.208.35
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/ptsans/v9/jizfRExUiTo99u79B_mh0O6tKA.ttf

Requested by

Host: rwhconstruct.com
URL: http://rwhconstruct.com/Minemine/Ourtime/ourtime.php?727768636f6e7374727563742e636f6d

Protocol

HTTP/1.1

Server

216.58.208.35 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s12-in-f35.1e100.net

Software

sffe /

Resource Hash

ae254009a380ca9b7aa7a4be4170da94f2035a84c15de80aa827aeee819d5971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=PT+Sans:700
Origin: http://rwhconstruct.com

Response headers

Date: Thu, 24 May 2018 20:14:06 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 11 Oct 2017 18:24:54 GMT
Server: sffe
Age: 1130970
Vary: Accept-Encoding
Content-Type: font/ttf
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 61655
X-XSS-Protection: 1; mode=block
Expires: Fri, 24 May 2019 20:14:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Ourtime.com (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
rwhconstruct.com
216.58.207.42
216.58.208.35
67.225.191.79
00894af01726cb0e9bccda4b7ebd47ad378235257433cd39d6cb9a00f5a3cb28
046db21cd1d820736a54e13070f6ce05ba348245a750ed6a32bbd92f104392d7
070a25d4945d6d5cbdc9ec5b29a96a5fefc9177ab5661a94833870c334919b08
186b633bc385b3ab9cd9f4842b88143829ac6369e13c79ec9b753733197c43fc
3f6c8f3a0506ab9f82c38efb24dddc8810b23fb1d8abdfafd108411f352a42f1
590398c96a4f4fe1cc760974cb0f6a18a29fd44b8018085fdafde66c472941d8
6d6199b6ebd0059493f9321b7b12b210734bdc43af1a13a0e30fd89974822cff
7423b89c0c9e3884dc651e1ce95899677d25d75b2040eb710e87f6b34668b4d7
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
89f4f3a5b77e1243163423590ee589b08a70bd6a748cf3c8070e82b788a188c3
ae254009a380ca9b7aa7a4be4170da94f2035a84c15de80aa827aeee819d5971
ed3b51f6240250bb0427957fc3fa326a1a1140acbc31d8f162a568346b8366da
ee9dbbb216e95348737b5b6087e1b3bffc27f39acfc67ede43e7a17fdcc7f785

rwhconstruct.com Open in urlscan Pro 67.225.191.79 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

235 kBTransfer

305 kBSize

0 Cookies

8 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

rwhconstruct.com Open in urlscan Pro
67.225.191.79 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

235 kB
Transfer

305 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!