joysewingsch.us - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3034::6815:395b, located in United States and belongs to CLOUDFLARENET, US. The main domain is joysewingsch.us.
TLS certificate: Issued by GTS CA 1P5 on June 23rd 2023. Valid for: 3 months.

This is the only time joysewingsch.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3033::ac43:be0d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3034::6815:395b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	141.95.145.162 141.95.145.162	16276 (OVH) (OVH)
1	2607:f8b0:400... 2607:f8b0:4006:817::2008	15169 (GOOGLE) (GOOGLE)
6	3

1 2606:4700:3033::ac43:be0d (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

joysewingsch.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3034::6815:395b (United States)

ASN13335 (CLOUDFLARENET, US)

joysewingsch.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.145.162 (France)

ASN16276 (OVH, FR)
PTR: ns31492538.ip-141-95-145.eu

blog.waalaxy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:817::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	joysewingsch.us 1 redirects joysewingsch.us	21 KB
1	google-analytics.com ssl.google-analytics.com — Cisco Umbrella Rank: 483	17 KB
1	waalaxy.com blog.waalaxy.com	8 KB
6	3

	Domain	Requested by
5	joysewingsch.us	1 redirects joysewingsch.us
1	ssl.google-analytics.com	joysewingsch.us
1	blog.waalaxy.com	joysewingsch.us
6	3

This site contains no links.

Subject Issuer	Validity	Valid
joysewingsch.us GTS CA 1P5	`2023-06-23` - `2023-09-21`	3 months	crt.sh
waalaxy.com R3	`2023-06-22` - `2023-09-20`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://joysewingsch.us/trhryuukjiykil/
Frame ID: 7FDCEEB00B1080D9D21E35CAA1E1E910
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Consulting Partner

Page URL History Show full URLs

http://joysewingsch.us/trhryuukjiykil/ HTTP 301
https://joysewingsch.us/trhryuukjiykil/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

45 kB
Transfer

75 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://joysewingsch.us/trhryuukjiykil/ HTTP 301
https://joysewingsch.us/trhryuukjiykil/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
joysewingsch.us/trhryuukjiykil/
Redirect Chain

http://joysewingsch.us/trhryuukjiykil/
https://joysewingsch.us/trhryuukjiykil/

3 KB
2 KB

260ms
183ms

Document
text/html

2606:4700:3034::6815:395b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://joysewingsch.us/trhryuukjiykil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:395b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.29 PleskLin
Resource Hash: 5fd611b916670492c6020e3587baea7d28730b9de2d04c1fc78db8320d603e42

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7de68b1fbba72876-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 28 Jun 2023 14:15:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K5tsV9ymOGAaICFSeCANjnoPqb4cNvdZqsCG5OnWkqOqU9hzyLYRqpBArRgg%2BRY0T2LbPg1EtPpL7sgR7XZ1LxlWc4RBNAAMZ6l9L8czSMnY7oI%2FzrIe6cGME%2BM24pKuWkN%2BZo2RsSnZGMZngmk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.29 PleskLin

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 7de68b1e6b83da93-MIA
Connection: keep-alive
Content-Type: text/html
Date: Wed, 28 Jun 2023 14:15:43 GMT
Location: https://joysewingsch.us/trhryuukjiykil/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6dp%2BRCqhXNS5cEm2XoppiQgREEcGMw8NbE51bb7cT%2FL%2FPvH2U61tI0COU1aoH3HdFP%2FgSSDOt8ClUkjqkcrJ4naC%2FqeREa5lI4FKFf%2FLB5pAn4T91yDhl08XRt9ytHIske%2F%2BGtHYgr24aO6po4o%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

GET
H2 200 logo-linkedin-actuel.jpg
blog.waalaxy.com/wp-content/uploads/2021/01/ 8 KB
8 KB 501ms
144ms Image
image/webp 141.95.145.162
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.waalaxy.com/wp-content/uploads/2021/01/logo-linkedin-actuel.jpg
Requested by: Host: joysewingsch.us
URL: https://joysewingsch.us/trhryuukjiykil/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 141.95.145.162 , France, ASN16276 (OVH, FR),
Reverse DNS: ns31492538.ip-141-95-145.eu
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 6142edab73141d0cc2a5a98257d464f7862e811619d2286ae251551960b922f8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://joysewingsch.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 14:15:43 GMT
last-modified: Mon, 13 Dec 2021 18:04:47 GMT
server: Apache/2.4.41 (Ubuntu)
vary: Accept,Accept-Encoding
content-type: image/webp
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 7972

GET
H2 200 destination_6459423e6d3287c0279b9a95fd98206b.jpg
joysewingsch.us/trhryuukjiykil/images/ 17 KB
17 KB 183ms
178ms Image
image/jpeg 2606:4700:3034::6815:395b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joysewingsch.us/trhryuukjiykil/images/destination_6459423e6d3287c0279b9a95fd98206b.jpg
Requested by: Host: joysewingsch.us
URL: https://joysewingsch.us/trhryuukjiykil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:395b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 30191280dc4c3a43f3f3fefa3698eef441974c66cea0f977debb335ec12255d8

Request headers

accept-language: en-US,en;q=0.9
Referer: https://joysewingsch.us/trhryuukjiykil/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 14:15:43 GMT
cf-cache-status: MISS
last-modified: Wed, 18 Jan 2017 14:19:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "587f7972-42dd"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kXSj92UC3poVppll55p5rQk9lUHu88ozmn1urrPztm5STAmz7PMNFwzy1O0w%2FyyyOGY%2BdGWC6%2BAY8A5PQYaL84SQXzhW2JqEsTwg1oRJMfszywVC%2ByQAAUIqv7dB8A1oHC3X%2FodAmDQg3X9HxNM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 7de68b20fd742876-MIA
alt-svc: h3=":443"; ma=86400
content-length: 17117

GET
H2 404 background.jpg
joysewingsch.us/trhryuukjiykil/ 808 B
808 B 168ms
159ms Image
text/html 2606:4700:3034::6815:395b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joysewingsch.us/trhryuukjiykil/background.jpg
Requested by: Host: joysewingsch.us
URL: https://joysewingsch.us/trhryuukjiykil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:395b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

accept-language: en-US,en;q=0.9
Referer: https://joysewingsch.us/trhryuukjiykil/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 14:15:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 23 Jun 2023 09:14:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yk1ev6gpLBIn60YMW9RYcgJxYQBz8YnZN2wrDgW7P8aP%2B%2BYY8KXWVWYsx1gTSJc%2B1D5SpvNrYhTBxuDmSQxkOWxkVrrdj4hGCc5GWjnVyEE%2FNcDtT%2B3%2B3BbyjdCafO8Lo61o43qZ6XvW%2BLg1FSc%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 7de68b211dc12876-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 404 grayBars.gif
joysewingsch.us/images/ 808 B
808 B 168ms
160ms Image
text/html 2606:4700:3034::6815:395b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joysewingsch.us/images/grayBars.gif
Requested by: Host: joysewingsch.us
URL: https://joysewingsch.us/trhryuukjiykil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:395b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

accept-language: en-US,en;q=0.9
Referer: https://joysewingsch.us/trhryuukjiykil/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Wed, 28 Jun 2023 14:15:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 23 Jun 2023 09:14:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u2iSDy8lewkMrODk2EXrVNKzlpCTy%2BHznWKwhUQP7NTFcOrxUb%2B2NtDatQssIav%2FoqC6x05qAeEuRfk9oLiDYa33Wio9Py0H%2Bsdac%2Fh4HQWkSJa2rpEkANM%2Ffq1HxEXCsW70hpMHplCc9YfPhcw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 7de68b211dc22876-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 220ms
64ms Script
text/javascript 2607:f8b0:4006:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: joysewingsch.us
URL: https://joysewingsch.us/trhryuukjiykil/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2008 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://joysewingsch.us/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 28 Jun 2023 12:31:52 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6231
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17168
expires: Wed, 28 Jun 2023 14:31:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://joysewingsch.us/trhryuukjiykil/(Line 119) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://joysewingsch.us/trhryuukjiykil/(Line 119) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ssl.google-analytics.com/ga.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://joysewingsch.us/trhryuukjiykil/background.jpg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://joysewingsch.us/images/grayBars.gif Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.waalaxy.com
joysewingsch.us
ssl.google-analytics.com
141.95.145.162
2606:4700:3033::ac43:be0d
2606:4700:3034::6815:395b
2607:f8b0:4006:817::2008
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
30191280dc4c3a43f3f3fefa3698eef441974c66cea0f977debb335ec12255d8
5fd611b916670492c6020e3587baea7d28730b9de2d04c1fc78db8320d603e42
6142edab73141d0cc2a5a98257d464f7862e811619d2286ae251551960b922f8
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

joysewingsch.us Open in urlscan Pro 2606:4700:3034::6815:395b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

75 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

45 kBTransfer

75 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

joysewingsch.us Open in urlscan Pro
2606:4700:3034::6815:395b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

45 kB
Transfer

75 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!