weparkyouflyairportparking.com
Open in
urlscan Pro
45.55.90.221
Malicious Activity!
Public Scan
Submitted URL: https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/?email=raghavendra_nagaraja@cable.comcast.com
Effective URL: https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/?newsid=20730492...
Submission: On October 02 via manual from IN
Effective URL: https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/?newsid=20730492...
Submission: On October 02 via manual from IN
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 7 HTTP transactions.
The main IP is 45.55.90.221, located in
Clifton, United States and
belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US.
The main domain is weparkyouflyairportparking.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 16th 2019. Valid for: 2 years.
This is the only time weparkyouflyairportparking.com was scanned on urlscan.io!
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 16th 2019. Valid for: 2 years.
This is the only time weparkyouflyairportparking.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 45.55.90.221 45.55.90.221 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
| 1 | 2a02:26f0:6c0... 2a02:26f0:6c00:2bf::35c1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 7 | 3 |
5
45.55.90.221
(Clifton, United States)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
| weparkyouflyairportparking.com |
1
2a02:26f0:6c00:2bf::35c1
(Ascension Island)
ASN20940 (AKAMAI-ASN1, US)
ASN20940 (AKAMAI-ASN1, US)
| secure.aadcdn.microsoftonline-p.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
weparkyouflyairportparking.com
weparkyouflyairportparking.com |
292 KB |
| 1 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
2 KB |
| 0 |
jquery.com
Failed
code.jquery.com Failed |
|
| 7 | 3 |
| Domain | Requested by | |
|---|---|---|
| 5 | weparkyouflyairportparking.com |
weparkyouflyairportparking.com
|
| 1 | secure.aadcdn.microsoftonline-p.com |
weparkyouflyairportparking.com
|
| 0 | code.jquery.com Failed |
weparkyouflyairportparking.com
|
| 7 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| weparkyouflyairportparking.com Go Daddy Secure Certificate Authority - G2 |
2019-09-16 - 2021-09-16 |
2 years | crt.sh |
| secure.aadcdn.microsoftonline-p.com Microsoft IT TLS CA 4 |
2019-07-17 - 2021-07-17 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/?newsid=2073049270OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=&email=726167686176656e6472615f6e61676172616a61406361626c652e636f6d636173742e636f6d&loginpage=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=&reff=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=
Frame ID: 2C097FFAE884244D7249A43843695E78
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/?email=raghavendra_nagaraja@cable.comca... Page URL
- https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513a... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/?email=raghavendra_nagaraja@cable.comcast.com Page URL
- https://weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/?newsid=2073049270OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=&email=726167686176656e6472615f6e61676172616a61406361626c652e636f6d636173742e636f6d&loginpage=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=&reff=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE=OTI5ZjJkY2IyMzI3M2M3NDQ4NDM2ODI0NjI1NWJmZjE= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/ |
713 B 932 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
secure.aadcdn.microsoftonline-p.com/ests/2.1.7651.13/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/ |
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft_logo.svg
weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
arrow_left.svg
weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/ |
513 B 758 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
0.jpg
weparkyouflyairportparking.com/assets-frontend/.fonts/.helps/.slide/cmd-login=d4e324c7db3d6057acd25d628513abe7/ |
277 KB 277 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
jquery-1.11.3.min.js
code.jquery.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- code.jquery.com
- URL
- http://code.jquery.com/jquery-1.11.3.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| showhide0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
secure.aadcdn.microsoftonline-p.com
weparkyouflyairportparking.com
code.jquery.com
2a02:26f0:6c00:2bf::35c1
45.55.90.221
04a1a6089224ed7a413c2090521f5bf00d2ec6c60e5941310e8978a1df36b4db
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
a11491cdf9280b3e20e844be8cf0f0007c33a55c5807c4f651960d6e35be5a4c