nowsetup.hostfreeupgradingclear.date
Open in
urlscan Pro
162.255.117.134
Malicious Activity!
Public Scan
Effective URL: http://nowsetup.hostfreeupgradingclear.date/?pcl=iGrM8sFBmlwM38ZdQftVAZKzvTqNbtqRdtASpqqJ9LOGuXGtnf8_bs4VbDBAvkmq6YK1IsizWSxGg_zNv8YyXA..&ci...
Submission: On December 11 via manual from US
Summary
This is the only time nowsetup.hostfreeupgradingclear.date was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fake Flash UpdateDomain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 212.83.166.129 212.83.166.129 | 12876 (AS12876) (AS12876) | |
1 | 162.255.117.134 162.255.117.134 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
2 | 52.85.173.243 52.85.173.243 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 52.85.173.59 52.85.173.59 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
5 | 3 |
ASN12876 (AS12876, FR)
PTR: 212-83-166-129.rev.poneytelecom.eu
www.growing4update.download |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
nowsetup.hostfreeupgradingclear.date |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-173-243.fra6.r.cloudfront.net
js.bestquickcontentfiles.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-85-173-59.fra6.r.cloudfront.net
dqjqvx3jubsfz.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
cloudfront.net
dqjqvx3jubsfz.cloudfront.net |
33 KB |
2 |
bestquickcontentfiles.com
js.bestquickcontentfiles.com |
3 KB |
1 |
hostfreeupgradingclear.date
nowsetup.hostfreeupgradingclear.date |
|
1 |
growing4update.download
1 redirects
www.growing4update.download |
498 B |
5 | 4 |
Domain | Requested by | |
---|---|---|
2 | dqjqvx3jubsfz.cloudfront.net |
nowsetup.hostfreeupgradingclear.date
|
2 | js.bestquickcontentfiles.com |
nowsetup.hostfreeupgradingclear.date
|
1 | nowsetup.hostfreeupgradingclear.date | |
1 | www.growing4update.download | 1 redirects |
5 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.tagfactorysoftware.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://nowsetup.hostfreeupgradingclear.date/?pcl=iGrM8sFBmlwM38ZdQftVAZKzvTqNbtqRdtASpqqJ9LOGuXGtnf8_bs4VbDBAvkmq6YK1IsizWSxGg_zNv8YyXA..&cid=119cc39cdb9e655229eb61c81a9349d39c99c68f&sid=87433.012393333_109099_202940_1464785&v_id=NdGI5RlajcqYb9QB7qA7GTsGbV0X3XrGBSBqYCU5d8E.
Frame ID: (66D265C24490E260EE9B604BCAA5EBD7)
Requests: 5 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.growing4update.download/?pcl=aGWYDUXIWoNZ4en4OosZCKoKt5p7W4xAb6aoI8STAwc.&cid=119cc39cdb9e655229eb61...
HTTP 302
http://nowsetup.hostfreeupgradingclear.date/?pcl=iGrM8sFBmlwM38ZdQftVAZKzvTqNbtqRdtASpqqJ9LOGuXGtnf8_bs4VbDBAvkmq6YK1Isi... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Click here to update for latest version.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.growing4update.download/?pcl=aGWYDUXIWoNZ4en4OosZCKoKt5p7W4xAb6aoI8STAwc.&cid=119cc39cdb9e655229eb61c81a9349d39c99c68f&sid=87433.012393333_109099_202940_1464785
HTTP 302
http://nowsetup.hostfreeupgradingclear.date/?pcl=iGrM8sFBmlwM38ZdQftVAZKzvTqNbtqRdtASpqqJ9LOGuXGtnf8_bs4VbDBAvkmq6YK1IsizWSxGg_zNv8YyXA..&cid=119cc39cdb9e655229eb61c81a9349d39c99c68f&sid=87433.012393333_109099_202940_1464785&v_id=NdGI5RlajcqYb9QB7qA7GTsGbV0X3XrGBSBqYCU5d8E. Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
nowsetup.hostfreeupgradingclear.date/ Redirect Chain
|
11 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dl.min.js
js.bestquickcontentfiles.com/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apple.png
dqjqvx3jubsfz.cloudfront.net/lps/om_flash/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blue.png
dqjqvx3jubsfz.cloudfront.net/lps/om_flash/images/ |
32 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
d.min.js
js.bestquickcontentfiles.com/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fake Flash Update8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint object| dlobj function| dlfunc boolean| has_class object| list object| children number| j3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
nowsetup.hostfreeupgradingclear.date/ | Name: dist_id Value: 4626 |
|
nowsetup.hostfreeupgradingclear.date/ | Name: lp_id Value: 2350 |
|
nowsetup.hostfreeupgradingclear.date/ | Name: channel Value: affsys_pc_ieandedge |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dqjqvx3jubsfz.cloudfront.net
js.bestquickcontentfiles.com
nowsetup.hostfreeupgradingclear.date
www.growing4update.download
162.255.117.134
212.83.166.129
52.85.173.243
52.85.173.59
3e9b1e419ce53f556d21d94b8e3deb4cc772040d5b871a3fe1412f1d42fc0b49
56a225775b8fdda188c534222a1bb014794a30e9860f57e865a648b9802b442d
5851c6ce0f1a72400ab4707a69ba52250f5d1121bb67906035b583dbdfb488b6
8357177e4bf21637d2bbf401bbad0311e0420e88335e4216cc1090f36a320568
f32fcdc2c152df13186e0592493286d155458a8f812229e7c597e1a828fed085