lushproductions-au.com Open in urlscan Pro
37.120.140.168 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://url6606.verifyacc.deajooi.com/wf/click?upn=IFCEXs7RmjzeH32PUaO-2F-2FRLw1FNU09vdUk5LAUQWMClINDxWR3qaZStZPtCLipxGEpaqZR3eIfi3gZP...
Effective URL:
https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fi...
Submission: On October 25 via api (October 25th 2019, 2:57:57 pm UTC) from BE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 37.120.140.168, located in Bucharest, Romania and belongs to M247, GB. The main domain is lushproductions-au.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 30th 2019. Valid for: 3 months.

This is the only time lushproductions-au.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.123.54 167.89.123.54	11377 (SENDGRID) (SENDGRID - SendGrid)
1 1	67.212.165.250 67.212.165.250	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
2 8	37.120.140.168 37.120.140.168	9009 (M247) (M247)
2	2a00:1450:400... 2a00:1450:4001:81e::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
8	2

1 167.89.123.54 (United States) 1 redirects

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789123x54.outbound-mail.sendgrid.net

url6606.verifyacc.deajooi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.212.165.250 (Overland Park, United States) 1 redirects

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: peak.dnsnetservice.com

traigotodo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 37.120.140.168 (Bucharest, Romania) 2 redirects

ASN9009 (M247, GB)

lushproductions-au.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	lushproductions-au.com 2 redirects lushproductions-au.com	247 KB
2	googleapis.com ajax.googleapis.com	60 KB
1	traigotodo.com 1 redirects traigotodo.com	541 B
1	deajooi.com 1 redirects url6606.verifyacc.deajooi.com	284 B
8	4

	Domain	Requested by
8	lushproductions-au.com	2 redirects lushproductions-au.com
2	ajax.googleapis.com	lushproductions-au.com
1	traigotodo.com	1 redirects
1	url6606.verifyacc.deajooi.com	1 redirects
8	4

This site contains no links.

Subject Issuer	Validity	Valid
lushproductions-au.com cPanel, Inc. Certification Authority	`2019-09-30` - `2019-12-29`	3 months	crt.sh
*.googleapis.com GTS CA 1O1	`2019-10-10` - `2020-01-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 11EEE95CED445F30623E37710EF4979A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://url6606.verifyacc.deajooi.com/wf/click?upn=IFCEXs7RmjzeH32PUaO-2F-2FRLw1FNU09vdUk5LAUQWMClINDxWR3qaZStZPtC... HTTP 302
https://traigotodo.com/wp-admin/maint/?usrid=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/redirect/?subemail=&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.177425641... Page URL
https://lushproductions-au.com/puYdf/fzreset/findex.php?rand=13InboxLightaspxn.1774256418&email=aW5mb0BmYWJ... HTTP 302
https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418... Page URL

Detected technologies

Pure CSS (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+(?:([\d.])+\/)?pure(?:-min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

305 kB
Transfer

414 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://url6606.verifyacc.deajooi.com/wf/click?upn=IFCEXs7RmjzeH32PUaO-2F-2FRLw1FNU09vdUk5LAUQWMClINDxWR3qaZStZPtCLipxGEpaqZR3eIfi3gZPCXpUIwRvGNSxOXXTYWhcc7cevAg70SSYhmclWXb6-2FaKLIPqvV_0rSs0MUd8rrc2bLt3BTQP8scJfOPmVh9lTBvEPG381z2Gf3mF7O8iJ3XMWujbtl1MfcgWjaPLhYcypEO5KiYvShUTkg4Ng5YtWpQ9zdU-2BWUo2nqhGsIrye1Yz22QCZHDpznb3EnxpIK0fF95SkFWN5NGMq5FaH-2FXKKDalSr9VkMsBz-2F6vWNCdSvXiDZ-2B9zOSki2g-2BBcNLnYNejDTz9Q68UmRV1ivOYtmsAzaBT-2FlGy0-3D HTTP 302
https://traigotodo.com/wp-admin/maint/?usrid=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/redirect/?subemail=&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
https://lushproductions-au.com/puYdf/fzreset/findex.php?rand=13InboxLightaspxn.1774256418&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://url6606.verifyacc.deajooi.com/wf/click?upn=IFCEXs7RmjzeH32PUaO-2F-2FRLw1FNU09vdUk5LAUQWMClINDxWR3qaZStZPtCLipxGEpaqZR3eIfi3gZPCXpUIwRvGNSxOXXTYWhcc7cevAg70SSYhmclWXb6-2FaKLIPqvV_0rSs0MUd8rrc2bLt3BTQP8scJfOPmVh9lTBvEPG381z2Gf3mF7O8iJ3XMWujbtl1MfcgWjaPLhYcypEO5KiYvShUTkg4Ng5YtWpQ9zdU-2BWUo2nqhGsIrye1Yz22QCZHDpznb3EnxpIK0fF95SkFWN5NGMq5FaH-2FXKKDalSr9VkMsBz-2F6vWNCdSvXiDZ-2B9zOSki2g-2BBcNLnYNejDTz9Q68UmRV1ivOYtmsAzaBT-2FlGy0-3D HTTP 302
https://traigotodo.com/wp-admin/maint/?usrid=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/redirect/?subemail=&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ== HTTP 302
https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

jtgrqobka430i2m8gyw8hzo3.php Show response
lushproductions-au.com/puYdf/redirect/
Redirect Chain

http://url6606.verifyacc.deajooi.com/wf/click?upn=IFCEXs7RmjzeH32PUaO-2F-2FRLw1FNU09vdUk5LAUQWMClINDxWR3qaZStZPtCLipxGEpaqZR3eIfi3gZPCXpUIwRvGNSxOXXTYWhcc7cevAg70SSYhmclWXb6-2FaKLIPqvV_0rSs0MUd8rrc...
https://traigotodo.com/wp-admin/maint/?usrid=aW5mb0BmYWJyaWN0cmFkZS5iZQ==
https://lushproductions-au.com/puYdf/redirect/?subemail=&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==
https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav...

5 KB
5 KB

233ms
231ms

Document
text/html

37.120.140.168
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.120.140.168 Bucharest, Romania, ASN9009 (M247, GB),
Reverse DNS
Software: Apache /
Resource Hash: 08de4481ee6a9cc353e4fa97fb5edd2ba50b48f812c47b53cbfa664e5d881a6d

Request headers

Host: lushproductions-au.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=9bd6128ee8d83d77a98e5e272527f6e4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 25 Oct 2019 14:57:38 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 25 Oct 2019 14:57:37 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=9bd6128ee8d83d77a98e5e272527f6e4; path=/
Location: jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81e::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: lushproductions-au.com
URL: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 10 Oct 2019 08:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1319749
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Thu, 25 Jan 2018 15:33:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Oct 2020 08:21:50 GMT

GET
H/1.1 200
OK 15.gif
lushproductions-au.com/puYdf/redirect/ 6 KB
6 KB 39ms
39ms Image
image/gif 37.120.140.168
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lushproductions-au.com/puYdf/redirect/15.gif
Requested by: Host: lushproductions-au.com
URL: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.120.140.168 Bucharest, Romania, ASN9009 (M247, GB),
Reverse DNS
Software: Apache /
Resource Hash: 670a768d2e4f783853ac1428e8ffd0e6b089b4b1720e5aa999087084d4e529f9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 25 Oct 2019 14:57:38 GMT
Last-Modified: Mon, 30 Sep 2019 07:44:30 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5673

GET
H/1.1

200
OK

Primary Request 0xi3b8xt4cgnfosqjdzxny77.php Show response
lushproductions-au.com/puYdf/fzreset/
Redirect Chain

https://lushproductions-au.com/puYdf/fzreset/findex.php?rand=13InboxLightaspxn.1774256418&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==
https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav....

5 KB
5 KB

244ms
244ms

Document
text/html

37.120.140.168
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.120.140.168 Bucharest, Romania, ASN9009 (M247, GB),
Reverse DNS
Software: Apache /
Resource Hash: 60ca8f1d75c52eaeb37d8820b2de2dc0da95ff79d43f4149c1d71fad2c2fb2ba

Request headers

Host: lushproductions-au.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-origin
Referer: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=e52eb5533233f1cbc536fac8bb7af81f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Referer: https://lushproductions-au.com/puYdf/redirect/jtgrqobka430i2m8gyw8hzo3.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=aW5mb0BmYWJyaWN0cmFkZS5iZQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4

Response headers

Date: Fri, 25 Oct 2019 14:57:41 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 25 Oct 2019 14:57:41 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=e52eb5533233f1cbc536fac8bb7af81f; path=/
Location: 0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found grids-responsive-min.css
lushproductions-au.com/puYdf/fzreset/css/ 0
0 45ms
44ms Stylesheet
text/html 37.120.140.168
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://lushproductions-au.com/puYdf/fzreset/css/grids-responsive-min.css
Requested by: Host: lushproductions-au.com
URL: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.120.140.168 Bucharest, Romania, ASN9009 (M247, GB),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 25 Oct 2019 14:57:41 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK yahoo-main.css
lushproductions-au.com/puYdf/fzreset/css/ 226 KB
227 KB 39ms
39ms Stylesheet
text/css 37.120.140.168
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://lushproductions-au.com/puYdf/fzreset/css/yahoo-main.css
Requested by: Host: lushproductions-au.com
URL: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.120.140.168 Bucharest, Romania, ASN9009 (M247, GB),
Reverse DNS
Software: Apache /
Resource Hash: 41647db72064ad975a25396c8b33f94f864e304bb4d866527462b6292a196e89

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 25 Oct 2019 14:57:41 GMT
Last-Modified: Tue, 20 Aug 2019 18:26:41 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 231828

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:81e::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: lushproductions-au.com
URL: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://lushproductions-au.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 10 Oct 2019 08:21:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1319752
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Thu, 25 Jan 2018 15:33:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 09 Oct 2020 08:21:50 GMT

GET
H/1.1 200
OK download.png
lushproductions-au.com/puYdf/fzreset/ 3 KB
3 KB 90ms
46ms Image
image/png 37.120.140.168
M247

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lushproductions-au.com/puYdf/fzreset/download.png
Requested by: Host: lushproductions-au.com
URL: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.120.140.168 Bucharest, Romania, ASN9009 (M247, GB),
Reverse DNS
Software: Apache /
Resource Hash: e0379570e2e504edf3d66d1078e30e4a855af4b3a8689ee3c3b8ab291eccb184

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://lushproductions-au.com/puYdf/fzreset/0xi3b8xt4cgnfosqjdzxny77.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 25 Oct 2019 14:57:42 GMT
Last-Modified: Mon, 22 Jul 2019 08:04:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 2770

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			lushproductions-au.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: e52eb5533233f1cbc536fac8bb7af81f

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
lushproductions-au.com
traigotodo.com
url6606.verifyacc.deajooi.com
167.89.123.54
2a00:1450:4001:81e::200a
37.120.140.168
67.212.165.250
08de4481ee6a9cc353e4fa97fb5edd2ba50b48f812c47b53cbfa664e5d881a6d
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
41647db72064ad975a25396c8b33f94f864e304bb4d866527462b6292a196e89
60ca8f1d75c52eaeb37d8820b2de2dc0da95ff79d43f4149c1d71fad2c2fb2ba
670a768d2e4f783853ac1428e8ffd0e6b089b4b1720e5aa999087084d4e529f9
e0379570e2e504edf3d66d1078e30e4a855af4b3a8689ee3c3b8ab291eccb184

lushproductions-au.com Open in urlscan Pro 37.120.140.168 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

3 Countries

305 kBTransfer

414 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

lushproductions-au.com Open in urlscan Pro
37.120.140.168 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

305 kB
Transfer

414 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!