szxwhx.com
Open in
urlscan Pro
203.205.224.59
Malicious Activity!
Public Scan
Effective URL: https://szxwhx.com/content/
Submission: On October 07 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by TrustAsia TLS RSA CA on September 13th 2021. Valid for: a year.
This is the only time szxwhx.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 62.171.138.241 62.171.138.241 | 51167 (CONTABO) (CONTABO) | |
1 | 203.205.224.59 203.205.224.59 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
9 | 34.209.177.61 34.209.177.61 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 52.92.144.177 52.92.144.177 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 192.124.249.52 192.124.249.52 | 30148 (SUCURI-SEC) (SUCURI-SEC) | |
3 | 142.250.184.228 142.250.184.228 | 15169 (GOOGLE) (GOOGLE) | |
1 | 52.35.158.16 52.35.158.16 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 142.250.185.195 142.250.185.195 | 15169 (GOOGLE) (GOOGLE) | |
2 | 172.217.23.99 172.217.23.99 | 15169 (GOOGLE) (GOOGLE) | |
22 | 8 |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
szxwhx.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-34-209-177-61.us-west-2.compute.amazonaws.com
tracepointllc.instascreen.net |
ASN16509 (AMAZON-02, US)
PTR: s3-us-west-2-w.amazonaws.com
taz-skin.s3.amazonaws.com |
ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10052.sucuri.net
www.stratospherenetworks.com |
ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f4.1e100.net
www.google.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-35-158-16.us-west-2.compute.amazonaws.com
idp.singlesignon.services |
ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f3.1e100.net
www.gstatic.com |
ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f99.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
instascreen.net
tracepointllc.instascreen.net |
130 KB |
6 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
329 KB |
3 |
google.com
www.google.com |
21 KB |
1 |
singlesignon.services
idp.singlesignon.services |
185 B |
1 |
stratospherenetworks.com
www.stratospherenetworks.com |
16 KB |
1 |
amazonaws.com
taz-skin.s3.amazonaws.com |
11 KB |
1 |
szxwhx.com
szxwhx.com |
2 KB |
1 |
hrdiaries.com
1 redirects
hrdiaries.com |
111 B |
22 | 8 |
Domain | Requested by | |
---|---|---|
9 | tracepointllc.instascreen.net |
szxwhx.com
|
4 | www.gstatic.com |
www.google.com
www.gstatic.com |
3 | www.google.com |
szxwhx.com
www.gstatic.com www.google.com |
2 | fonts.gstatic.com |
www.google.com
|
1 | idp.singlesignon.services |
szxwhx.com
|
1 | www.stratospherenetworks.com |
szxwhx.com
|
1 | taz-skin.s3.amazonaws.com |
szxwhx.com
|
1 | szxwhx.com | |
1 | hrdiaries.com | 1 redirects |
22 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
szxwhx.com TrustAsia TLS RSA CA |
2021-09-13 - 2022-09-12 |
a year | crt.sh |
*.instascreen.net Amazon |
2020-12-16 - 2022-01-14 |
a year | crt.sh |
*.s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2021-01-11 - 2022-02-11 |
a year | crt.sh |
stratospherenetworks.com Starfield Secure Certificate Authority - G2 |
2020-12-17 - 2021-12-17 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
*.singlesignon.services Amazon |
2021-08-07 - 2022-09-05 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
*.google.com GTS CA 1C3 |
2021-09-13 - 2021-11-20 |
2 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://szxwhx.com/content/
Frame ID: EA81898ABA72B1D365D9D23EB1096459
Requests: 15 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le8XbwUAAAAANWeNFdP-C4MpwjbSxsAKmKrHFUn&co=aHR0cHM6Ly9zenh3aHguY29tOjQ0Mw..&hl=de&v=-TriQeni1Ls-Mdq_ssN2cUL5&size=invisible&cb=ftn43xodd2n1
Frame ID: 1775269A7E0169E224C8CB1AAD3D8216
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Office - LoginPage URL History Show full URLs
-
https://hrdiaries.com/logon.php
HTTP 302
https://szxwhx.com/content/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery Migrate (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://hrdiaries.com/logon.php
HTTP 302
https://szxwhx.com/content/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
szxwhx.com/content/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
tracepointllc.instascreen.net/_libs/bootstrap_3.4.1/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
da_tracepointllc.instascreen.net_skin.css
taz-skin.s3.amazonaws.com/_styles/skin/ |
11 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
is-layout.css
tracepointllc.instascreen.net/_styles/2.5/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
is-bootstrap-overrides.css
tracepointllc.instascreen.net/_styles/2.5/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
is-responsive.css
tracepointllc.instascreen.net/_styles/2.5/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
version2_5.css
tracepointllc.instascreen.net/_styles/2.5/ |
12 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.js
tracepointllc.instascreen.net/_scripts/jquery/ |
281 KB 83 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-migrate-3.3.2.js
tracepointllc.instascreen.net/_scripts/jquery/ |
25 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.focus-first.custom.js
tracepointllc.instascreen.net/_scripts/jquery/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginForm.js
tracepointllc.instascreen.net/_scripts/dialogs/login/ |
743 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office365-logo.png
www.stratospherenetworks.com/blog/wp-content/uploads/2018/08/ |
15 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
www.google.com/recaptcha/ |
884 B 1017 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookieV2
idp.singlesignon.services/ |
0 185 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ |
346 KB 136 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
anchor
www.google.com/recaptcha/api2/ Frame 1775 |
39 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles__ltr.css
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ Frame 1775 |
52 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__de.js
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ Frame 1775 |
346 KB 135 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 1775 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 1775 |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 1775 |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webworker.js
www.google.com/recaptcha/api2/ Frame 1775 |
102 B 134 B |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforexrselect boolean| originAgentCluster function| $ function| jQuery object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_9160762 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
tracepointllc.instascreen.net/ | Name: AWSALBCORS Value: Fd3zmUAqVPDRxVqdRH2Or8TScIcHR0LYWwkeru3QJR5vyBiN+oi5WWgCL0NARYATNI8GaGNRKDkFqxT4zRslvq5iCED8jupGqeAfzYwTZpyDjgyejoSYBwIe1/JS |
|
idp.singlesignon.services/ | Name: IS_IDP_DOMAIN_V2 Value: https://tracepointllc.instascreen.net |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=5; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
hrdiaries.com
idp.singlesignon.services
szxwhx.com
taz-skin.s3.amazonaws.com
tracepointllc.instascreen.net
www.google.com
www.gstatic.com
www.stratospherenetworks.com
142.250.184.228
142.250.185.195
172.217.23.99
192.124.249.52
203.205.224.59
34.209.177.61
52.35.158.16
52.92.144.177
62.171.138.241
00f4e86dab01cf17d3359501a678b8e95ab4979cd862ed2f33e86fca659d96f7
06ba07899128f9d1867859b80dd3e37563ee459962de62c028eeb52f9d325520
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
28cef70df91237002571f751148d45bb126a81b241be56d9f304f7d8706be505
2cd178996caabbdcced8251cb3585f63370fa4b079716a2bc2feb77ffee17969
37547108e6e692a44aedc4f86409c4cac00dd0c5b0ba6d9e7c78bffd8056cca4
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
427df41df87c7f471859732098954fcb08093fee9f3bd9870da6e92d7697c42f
4a2311c7d767b778b6d7d20c8491f7662df6fc221f3c9f252ddbf30226ed80be
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
70d09bb0c2e1e8a339ca246eaacd87798da00d824124f644e11eab481d1b5eb7
80077aeb0f8491965d3694cc4683a1ef9fb4aa503e41273edde9ba8bd7536e08
947550afa29811edf57354a2600ab9f3e507aa9bbdf7fd0e8ba8d8df5b5009db
af9f065153d56554beb74415f7d1c110f811cf123c075deb144d8742a9410c3a
b0236d5c7c5a438a04858e85fe41d24cdcc0cf55a99a45cd2dc36bef08905980
cc1e0a87136da48d3ffa0aa6a1edafe770623a3d82964be0beebfedddbe9f8d5
ce7022c65e728b9d09b583d73ef839326ad2704d9a12dde9e7eff3e1ebfe17b6
d505baf5e636170a70c2a42474600c2225dc1a13ce1846bac7f778e17ec09de2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855