Submitted URL: https://shitcord.com/
Effective URL: http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
Submission Tags: phishingrod
Submission: On May 12 via api from DE — Scanned from AU

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 76.223.26.96, located in and belongs to . The main domain is ww38.shitcord.com.
This is the only time ww38.shitcord.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 103.224.182.242 133618 (TRELLIAN-...)
1 76.223.26.96 ()
5 3
Apex Domain
Subdomains
Transfer
5 shitcord.com
shitcord.com
ww38.shitcord.com
16 KB
0 parkingcrew.net Failed
c.parkingcrew.net Failed
5 2
Domain Requested by
4 shitcord.com 1 redirects shitcord.com
1 ww38.shitcord.com shitcord.com
0 c.parkingcrew.net Failed ww38.shitcord.com
5 3

This site contains no links.

Subject Issuer Validity Valid
allsoporganicbutcher.com.au
R3
2024-03-12 -
2024-06-10
3 months crt.sh

This page contains 1 frames:

Primary Page: http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
Frame ID: EF5FBC106A99DAF6E681C9CEB452F750
Requests: 5 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://shitcord.com/ Page URL
  2. http://shitcord.com/?fp=abad09965cf383d6fbca3be83c37146f HTTP 307
    https://shitcord.com/?fp=abad09965cf383d6fbca3be83c37146f HTTP 302
    http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8 HTTP 307
    https://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8 HTTP 307
    http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8 Page URL

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

15 kB
Transfer

51 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://shitcord.com/ Page URL
  2. http://shitcord.com/?fp=abad09965cf383d6fbca3be83c37146f HTTP 307
    https://shitcord.com/?fp=abad09965cf383d6fbca3be83c37146f HTTP 302
    http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8 HTTP 307
    https://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8 HTTP 307
    http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
shitcord.com/
1 KB
864 B
Document
General
Full URL
https://shitcord.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.224.182.242 , Australia, ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU),
Reverse DNS
lb-182-242.above.com
Software
Apache /
Resource Hash
1412dd84e8febb29c176d91cfe4e28166def7f997c152d81d3f33c9c09804a57

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

connection
close
content-encoding
gzip
content-length
569
content-type
text/html; charset=UTF-8
date
Sun, 12 May 2024 00:14:56 GMT
server
Apache
vary
Accept-Encoding
iife.min.js
shitcord.com/js/fingerprint/
33 KB
14 KB
Script
General
Full URL
https://shitcord.com/js/fingerprint/iife.min.js
Requested by
Host: shitcord.com
URL: https://shitcord.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
103.224.182.242 , Australia, ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU),
Reverse DNS
lb-182-242.above.com
Software
Apache /
Resource Hash
c6bc28686490aba34a53ab3b709afa1fd73c21e60feb25608b09f23efe170089

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shitcord.com/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 12 May 2024 00:14:57 GMT
content-encoding
gzip
last-modified
Mon, 20 Nov 2023 05:36:39 GMT
server
Apache
etag
"85c0-60a8edebfa7c0-gzip"
vary
Accept-Encoding
content-type
application/javascript
connection
close
accept-ranges
bytes
content-length
14345
favicon.ico
shitcord.com/
94 B
170 B
Other
General
Full URL
https://shitcord.com/favicon.ico
Protocol
HTTP/1.0
Security
TLS 1.3, , AES_256_GCM
Server
103.224.182.242 , Australia, ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU),
Reverse DNS
lb-182-242.above.com
Software
/
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://shitcord.com/
Accept-Language
en-AU,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

cache-control
no-cache
content-type
text/html
Primary Request /
ww38.shitcord.com/
Redirect Chain
  • http://shitcord.com/?fp=abad09965cf383d6fbca3be83c37146f
  • https://shitcord.com/?fp=abad09965cf383d6fbca3be83c37146f
  • http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
  • https://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
  • http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
16 KB
0
Document
General
Full URL
http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
Requested by
Host: shitcord.com
URL: https://shitcord.com/
Protocol
HTTP/1.1
Server
76.223.26.96 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept-Language
en-AU,en;q=0.9;q=0.9
Referer
https://shitcord.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Accept-CH
viewport-width dpr device-memory rtt downlink ect ua ua-full-version ua-platform ua-platform-version ua-arch ua-model ua-mobile
Accept-CH-Lifetime
30
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sun, 12 May 2024 00:15:01 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Adblock-Key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_MYvjuuOUBM5UJOft7BHmCLaRjEeZ7pYvCBiRWD4VJNRqLuHxikEr6QtuB8Xd1i4HcyE9GlXovZYJYapaeZxdFQ==
X-Buckets
bucket003
X-Domain
shitcord.com
X-Language
english
X-Subdomain
ww38
X-Template
tpl_CleanPeppermintBlack_twoclick

Redirect headers

Location
http://ww38.shitcord.com/?subid1=20240512-1014-5815-898c-ccac0efd23c8
Non-Authoritative-Reason
HttpsUpgrades
sale_form.js
c.parkingcrew.net/scripts/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
c.parkingcrew.net
URL
http://c.parkingcrew.net/scripts/sale_form.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
shitcord.com/ Name: __tad
Value: 1715472896.4417854

1 Console Messages

Source Level URL
Text
network error URL: https://shitcord.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.parkingcrew.net
shitcord.com
ww38.shitcord.com
c.parkingcrew.net
103.224.182.242
76.223.26.96
1412dd84e8febb29c176d91cfe4e28166def7f997c152d81d3f33c9c09804a57
c6bc28686490aba34a53ab3b709afa1fd73c21e60feb25608b09f23efe170089