greedyheadhunters.com
Open in
urlscan Pro
74.212.182.201
Malicious Activity!
Public Scan
Submitted URL: http://askulcorporation.tt.omtrdc.net/m2/askulcorporation/ubox/page?mbox=club_f_storage_storage05&mboxDefault=https%3A%2F%2Furlz.fr%2F...
Effective URL: http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/Up-dating.php?country.x=PL-Poland&ACCT.x=ID-GOV=PA32419...
Submission: On August 09 via manual from AU
Effective URL: http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/Up-dating.php?country.x=PL-Poland&ACCT.x=ID-GOV=PA32419...
Submission: On August 09 via manual from AU
Summary
This website contacted 1 IPs
in 2 countries
across 3 domains to perform 6 HTTP transactions.
The main IP is 74.212.182.201, located in
Farmingville, United States and
belongs to TWRS-NYC, US.
The main domain is greedyheadhunters.com.
This is the only time greedyheadhunters.com was scanned on urlscan.io!
This is the only time greedyheadhunters.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Australian Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 54.194.111.119 54.194.111.119 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 1 | 2606:4700:303... 2606:4700:3038::681f:ab2 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 3 9 | 74.212.182.201 74.212.182.201 | 26878 (TWRS-NYC) (TWRS-NYC) | |
| 6 | 1 |
1
54.194.111.119
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-111-119.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-111-119.eu-west-1.compute.amazonaws.com
| askulcorporation.tt.omtrdc.net |
9
74.212.182.201
(Farmingville, United States)
ASN26878 (TWRS-NYC, US)
PTR: mail.chen.us
ASN26878 (TWRS-NYC, US)
PTR: mail.chen.us
| greedyheadhunters.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
greedyheadhunters.com
3 redirects
greedyheadhunters.com |
122 KB |
| 1 |
urlz.fr
1 redirects
urlz.fr |
351 B |
| 1 |
omtrdc.net
1 redirects
askulcorporation.tt.omtrdc.net |
220 B |
| 6 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | greedyheadhunters.com |
3 redirects
greedyheadhunters.com
|
| 1 | urlz.fr | 1 redirects |
| 1 | askulcorporation.tt.omtrdc.net | 1 redirects |
| 6 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/Up-dating.php?country.x=PL-Poland&ACCT.x=ID-GOV=PA324194.99.105.99=ScrPg=044e04b6d79cbf4486e59ed033f77bb18a987b4020b6e5ed027b41490929df68
Frame ID: 91CFA37149C3E11B0CD3B96F585D9933
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://askulcorporation.tt.omtrdc.net/m2/askulcorporation/ubox/page?mbox=club_f_storage_storage05&mboxDefault=http...
HTTP 302
https://urlz.fr/dAES HTTP 302
http://greedyheadhunters.com/session/ HTTP 302
http://greedyheadhunters.com/session/newdir.php HTTP 302
http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60 HTTP 301
http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/ Page URL
- http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/Up-dating.php?country.x=PL-Poland&A... Page URL
Detected technologies
Windows Server
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://askulcorporation.tt.omtrdc.net/m2/askulcorporation/ubox/page?mbox=club_f_storage_storage05&mboxDefault=https%3A%2F%2Furlz.fr%2FdAES
HTTP 302
https://urlz.fr/dAES HTTP 302
http://greedyheadhunters.com/session/ HTTP 302
http://greedyheadhunters.com/session/newdir.php HTTP 302
http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60 HTTP 301
http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/ Page URL
- http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/Up-dating.php?country.x=PL-Poland&ACCT.x=ID-GOV=PA324194.99.105.99=ScrPg=044e04b6d79cbf4486e59ed033f77bb18a987b4020b6e5ed027b41490929df68 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://askulcorporation.tt.omtrdc.net/m2/askulcorporation/ubox/page?mbox=club_f_storage_storage05&mboxDefault=https%3A%2F%2Furlz.fr%2FdAES HTTP 302
- https://urlz.fr/dAES HTTP 302
- http://greedyheadhunters.com/session/ HTTP 302
- http://greedyheadhunters.com/session/newdir.php HTTP 302
- http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60 HTTP 301
- http://greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/ Redirect Chain
|
286 B 575 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
Up-dating.php
greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/ |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
image.css
greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/img/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
user.png
greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pass.png
greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
backlog.png
greedyheadhunters.com/session/21b667b7a2273bd2ac948d0e0af40d60/img/ |
102 KB 102 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Australian Government (Government)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| submit object| el_down string| Name function| GFG_Fun1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| greedyheadhunters.com/ | Name: PHPSESSID Value: d0dbdd3d1074e313e643358e6f5e77ca |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
askulcorporation.tt.omtrdc.net
greedyheadhunters.com
urlz.fr
2606:4700:3038::681f:ab2
54.194.111.119
74.212.182.201
0db100b94e87ba4d2397d0f164b596919fe53afefd0951e7198420b519476c1f
29420f5a41440dd070c9d7d7db9e46fef751dd8a9250df31fac108c4713c7805
2f59e0255a37e34f2e6baebdf85d3c5c8cac5e86538f96e8d8f300ddbce0caa4
930454fc381be1c509f36e915cc59171c0cc516975fb4dfc5ed16284f3c23d7a
c4cc933872f10b2d6f77cb739b1737d34b9c8e9045357058c86b0776e44e077f
f8663632e01dc47537ca44469fd83d03ba4234e1d32f7d8fb44b04e3c4bc128d