preferredelectricdirectory.online Open in urlscan Pro
192.163.196.244 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cashnecc.services/
Effective URL:
https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Submission: On April 04 via manual (April 4th 2022, 3:23:56 pm UTC) from DE — Scanned from ES

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 9 HTTP transactions. The main IP is 192.163.196.244, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is preferredelectricdirectory.online.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 4th 2022. Valid for: 3 months.

This is the only time preferredelectricdirectory.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	169.62.226.194 169.62.226.194	36351 (SOFTLAYER) (SOFTLAYER)
4	192.163.196.244 192.163.196.244	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
2	192.229.221.185 192.229.221.185	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
9	4

1 169.62.226.194 (United States) 1 redirects

ASN36351 (SOFTLAYER, US)
PTR: hs11.name.tools

cashnecc.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.163.196.244 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: server.preferredelectricdirectory.online

preferredelectricdirectory.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.229.221.185 (United States)

ASN15133 (EDGECAST, US)

logincdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	preferredelectricdirectory.online preferredelectricdirectory.online	418 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	msauth.net logincdn.msauth.net — Cisco Umbrella Rank: 2481	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 45	1 KB
1	cashnecc.services 1 redirects cashnecc.services	137 B
9	5

	Domain	Requested by
4	preferredelectricdirectory.online	preferredelectricdirectory.online
2	fonts.gstatic.com	fonts.googleapis.com
2	logincdn.msauth.net	preferredelectricdirectory.online
1	fonts.googleapis.com	preferredelectricdirectory.online
1	cashnecc.services	1 redirects
9	5

This site contains no links.

Subject Issuer	Validity	Valid
preferredelectricdirectory.online cPanel, Inc. Certification Authority	`2022-04-04` - `2022-07-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh
identitycdn.msauth.net DigiCert SHA2 Secure Server CA	`2021-05-13` - `2022-05-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-03-17` - `2022-06-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Frame ID: 88CC6918C65A05ED2D8BF07F16F073CF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Page

Page URL History Show full URLs

https://cashnecc.services/ HTTP 301
https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

454 kB
Transfer

460 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cashnecc.services/ HTTP 301
https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.php Show response
preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/
Redirect Chain

https://cashnecc.services/
https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php

21 KB
21 KB

644ms
185ms

Document
text/html

192.163.196.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.163.196.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: server.preferredelectricdirectory.online
Software: Apache /
Resource Hash: 46d1d01c897c680da82a3f7644e75e827a45821cf017b3b34a2f88f4ccfef926

Request headers

Accept-Language: es-ES,es;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 04 Apr 2022 15:23:49 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

Redirect headers

content-length: 284
content-type: text/html; charset=iso-8859-1
date: Mon, 04 Apr 2022 15:23:48 GMT
location: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
server: Apache

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 200ms
71ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Requested by

Host: preferredelectricdirectory.online
URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3fa49132cfd4ae80349a262b643fc4f9afa40c41a56032d7e05c3500f4ec9313

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: es-ES,es;q=0.9
Referer: https://preferredelectricdirectory.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 14:13:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 04 Apr 2022 15:23:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 04 Apr 2022 15:23:49 GMT

GET
H2 200 microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
logincdn.msauth.net/shared/1.0/content/images/ 1 KB
1 KB 243ms
49ms Image
image/png 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
Requested by: Host: preferredelectricdirectory.online
URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mrs/CB75) /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Accept-Language: es-ES,es;q=0.9
Referer: https://preferredelectricdirectory.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 04 Apr 2022 15:23:49 GMT
content-md5: 7ZyesNzhfXUr7eprWs2m2Q==
age: 23878616
x-cache: HIT
content-length: 1057
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:51 GMT
server: ECAcc (mrs/CB75)
etag: 0x8D79ED29CFA130A
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 1296fd44-c01e-006e-410b-6f9d98000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK arrow.png
preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/ 386 B
627 B 178ms
178ms Image
image/png 192.163.196.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/arrow.png
Requested by: Host: preferredelectricdirectory.online
URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.163.196.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: server.preferredelectricdirectory.online
Software: Apache /
Resource Hash: 14c49a1fd81e6a716111d74dc2b08f2cf6a4f54a202c0d17a394639a78b3437e

Request headers

Accept-Language: es-ES,es;q=0.9
Referer: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 15:23:49 GMT
Last-Modified: Tue, 15 Mar 2022 07:50:32 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 386

GET
H2 200 cred_option_fido_498a4d7bb984e5436a52c8b52f3ab0f7.svg
logincdn.msauth.net/shared/1.0/content/images/credentialoptions/ 2 KB
1 KB 242ms
48ms Image
image/svg+xml 192.229.221.185
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logincdn.msauth.net/shared/1.0/content/images/credentialoptions/cred_option_fido_498a4d7bb984e5436a52c8b52f3ab0f7.svg
Requested by: Host: preferredelectricdirectory.online
URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (mrs/CB1E) /
Resource Hash: baba68bc58bec8e111c09c81844d8153b2e2f9c9deefb579eff6cfb16f8d052b

Request headers

Accept-Language: es-ES,es;q=0.9
Referer: https://preferredelectricdirectory.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 04 Apr 2022 15:23:49 GMT
content-encoding: gzip
content-md5: OTDdq2Q+clps8ulNYJAscg==
age: 26907797
x-cache: HIT
content-length: 853
x-ms-lease-status: unlocked
last-modified: Wed, 22 Jan 2020 00:32:47 GMT
server: ECAcc (mrs/CB1E)
etag: 0x8D79ED29B1E496C
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 7f2da57c-001e-0048-677e-530508000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 200
OK jquery.js Show response
preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/ 86 KB
86 KB 178ms
178ms Script
application/javascript 192.163.196.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/jquery.js
Requested by: Host: preferredelectricdirectory.online
URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.163.196.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: server.preferredelectricdirectory.online
Software: Apache /
Resource Hash: 412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb

Request headers

Accept-Language: es-ES,es;q=0.9
Referer: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 15:23:49 GMT
Last-Modified: Tue, 15 Mar 2022 07:03:04 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 88147

GET
H/1.1 200
OK bg.avif
preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/ 310 KB
310 KB 312ms
178ms Image
application/octet-stream 192.163.196.244
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/bg.avif
Requested by: Host: preferredelectricdirectory.online
URL: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.163.196.244 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: server.preferredelectricdirectory.online
Software: Apache /
Resource Hash: 9e40a39dd04393b67873e179861a8fc47d57f7870d39b3d6c042506987dfb980

Request headers

Accept-Language: es-ES,es;q=0.9
Referer: https://preferredelectricdirectory.online/BUSINESS-DOCUMENT-FOLDER/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

Date: Mon, 04 Apr 2022 15:23:49 GMT
Last-Modified: Tue, 15 Mar 2022 08:35:20 GMT
Server: Apache
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 317679

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 189ms
62ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://preferredelectricdirectory.online
Accept-Language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 30 Mar 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 422850
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 30 Mar 2023 17:56:19 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 204ms
76ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://preferredelectricdirectory.online
Accept-Language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Fri, 01 Apr 2022 01:46:21 GMT
x-content-type-options: nosniff
age: 308248
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 01 Apr 2023 01:46:21 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cashnecc.services
fonts.googleapis.com
fonts.gstatic.com
logincdn.msauth.net
preferredelectricdirectory.online
169.62.226.194
192.163.196.244
192.229.221.185
2a00:1450:4001:803::2003
2a00:1450:4001:82b::200a
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
14c49a1fd81e6a716111d74dc2b08f2cf6a4f54a202c0d17a394639a78b3437e
3fa49132cfd4ae80349a262b643fc4f9afa40c41a56032d7e05c3500f4ec9313
412b8ff9c5ab32b9019fcd84bcd4a54c0e265a14528474f4ee45b27a20abeaeb
46d1d01c897c680da82a3f7644e75e827a45821cf017b3b34a2f88f4ccfef926
9e40a39dd04393b67873e179861a8fc47d57f7870d39b3d6c042506987dfb980
baba68bc58bec8e111c09c81844d8153b2e2f9c9deefb579eff6cfb16f8d052b
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

preferredelectricdirectory.online Open in urlscan Pro 192.163.196.244 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

454 kBTransfer

460 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

preferredelectricdirectory.online Open in urlscan Pro
192.163.196.244 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

454 kB
Transfer

460 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!