www1.imaginativenews.xyz
Open in
urlscan Pro
2606:4700::6812:4895
Malicious Activity!
Public Scan
Effective URL: https://www1.imaginativenews.xyz/iwxb/sgvu/index-de-c-a-ch-c1.html?td=www.coilltetowerfinder.com&browser=Chrome&country=Switzerla...
Submission: On August 02 via manual from US
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on July 4th 2019. Valid for: a year.
This is the only time www1.imaginativenews.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 200.63.47.3 200.63.47.3 | 52284 (Panamaser...) (Panamaserver.com) | |
2 | 50.16.52.56 50.16.52.56 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 1 | 104.18.25.12 104.18.25.12 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
22 | 2606:4700::68... 2606:4700::6812:4895 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
24 | 2 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-16-52-56.compute-1.amazonaws.com
usa.odysseus-nua.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.coilltetowerfinder.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www1.imaginativenews.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
imaginativenews.xyz
www1.imaginativenews.xyz |
86 KB |
2 |
odysseus-nua.com
usa.odysseus-nua.com |
5 KB |
1 |
coilltetowerfinder.com
1 redirects
www.coilltetowerfinder.com |
2 KB |
1 |
progessive4usaamembers.com
1 redirects
progessive4usaamembers.com |
466 B |
24 | 4 |
Domain | Requested by | |
---|---|---|
22 | www1.imaginativenews.xyz |
usa.odysseus-nua.com
www1.imaginativenews.xyz |
2 | usa.odysseus-nua.com |
usa.odysseus-nua.com
|
1 | www.coilltetowerfinder.com | 1 redirects |
1 | progessive4usaamembers.com | 1 redirects |
24 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-07-04 - 2020-07-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www1.imaginativenews.xyz/iwxb/sgvu/index-de-c-a-ch-c1.html?td=www.coilltetowerfinder.com&browser=Chrome&country=Switzerland&city=Z%C3%BCrich&os=MacOS&pr=1159%20EUR&yp=0%20EUR&cep=IHRC1M6oy2_vXpze7WhL2c-TWUe9E-15IDEcfSpoim1bt5hiOzEFkEoFIj0H81J0CWFTXM2uHBZd3KQ-szDnn8OJgPw_Zi7aNwHyuoMa2eW7_XGTt6K-HUXozq365Kvb2GaFYdM2VB2LVE1J3KRmQbxOdmt_epgWxcZ7NjRmEjW-U6dmjRWQQTTXmsJP4ID8VmHa26aGX5xmelDIZYNmKUFcPcfP3vVm0J_Qj_Emp7fidJZrHhG5F6tV6_wtg16GVzYtkDgEcGfsLCtpOxLlpeLikqAZMj7wGgo_fXvgGx6v9rU5ps3KGcoEJYJ2fUBbsjHxRp71JA8OCO-yjcz_W_l8nB63voWiVTk2PbZy-jmSW22oReq9DE_FQ_Syha4hK2agovFXkWRUtVnZLhaAqy49lScs9uJk9uI89TIvUoL9HfEGYKf4X94JPK7cseyP0MjcITNVF1v7T78JuH0kl8TP7FrNyPs0yvztkKhOfhFOAMm69_K5bLoupqdF6h6_e9avMqzK62VYrJxjXidq4sptFkxMJ5G2HoLrIi5muIBGgcQqFRle_M_81h35CjmJe_qYrWGjsmAgye1sBmcPhtiQTVzqfDuhN0jkoZShTCI&lptoken=1591640975c491f512cc
Frame ID: 60B0B2F94F66EB092FA4AADFB4F8B72C
Requests: 24 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://progessive4usaamembers.com/
HTTP 302
http://usa.odysseus-nua.com/zcvisitor/9903ca0a-b534-11e9-88e5-0a8c973080c4?campaignid=edc26d00-1816-11e9... Page URL
- http://usa.odysseus-nua.com/zcredirect?visitid=9903ca0a-b534-11e9-88e5-0a8c973080c4&type=js&browserWidth... Page URL
-
http://www.coilltetowerfinder.com/zp-redirect?target=https%3A%2F%2Fwww1.imaginativenews.xyz%2Fiwxb%2Fsgvu%2Fin...
HTTP 302
https://www1.imaginativenews.xyz/iwxb/sgvu/index-de-c-a-ch-c1.html?td=www.coilltetowerfinder.com&browser=Chro... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://progessive4usaamembers.com/
HTTP 302
http://usa.odysseus-nua.com/zcvisitor/9903ca0a-b534-11e9-88e5-0a8c973080c4?campaignid=edc26d00-1816-11e9-86dd-12077332b422 Page URL
- http://usa.odysseus-nua.com/zcredirect?visitid=9903ca0a-b534-11e9-88e5-0a8c973080c4&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false Page URL
-
http://www.coilltetowerfinder.com/zp-redirect?target=https%3A%2F%2Fwww1.imaginativenews.xyz%2Fiwxb%2Fsgvu%2Findex-de-c-a-ch-c1.html%3Ftd%3Dwww.coilltetowerfinder.com%26browser%3DChrome%26country%3DSwitzerland%26city%3DZ%25C3%25BCrich%26os%3DMacOS%26pr%3D1159%2520EUR%26yp%3D0%2520EUR%26cep%3DIHRC1M6oy2_vXpze7WhL2c-TWUe9E-15IDEcfSpoim1bt5hiOzEFkEoFIj0H81J0CWFTXM2uHBZd3KQ-szDnn8OJgPw_Zi7aNwHyuoMa2eW7_XGTt6K-HUXozq365Kvb2GaFYdM2VB2LVE1J3KRmQbxOdmt_epgWxcZ7NjRmEjW-U6dmjRWQQTTXmsJP4ID8VmHa26aGX5xmelDIZYNmKUFcPcfP3vVm0J_Qj_Emp7fidJZrHhG5F6tV6_wtg16GVzYtkDgEcGfsLCtpOxLlpeLikqAZMj7wGgo_fXvgGx6v9rU5ps3KGcoEJYJ2fUBbsjHxRp71JA8OCO-yjcz_W_l8nB63voWiVTk2PbZy-jmSW22oReq9DE_FQ_Syha4hK2agovFXkWRUtVnZLhaAqy49lScs9uJk9uI89TIvUoL9HfEGYKf4X94JPK7cseyP0MjcITNVF1v7T78JuH0kl8TP7FrNyPs0yvztkKhOfhFOAMm69_K5bLoupqdF6h6_e9avMqzK62VYrJxjXidq4sptFkxMJ5G2HoLrIi5muIBGgcQqFRle_M_81h35CjmJe_qYrWGjsmAgye1sBmcPhtiQTVzqfDuhN0jkoZShTCI%26lptoken%3D1591640975c491f512cc&caid=17c29376-f546-4a79-a0a5-6dffd34102bd&zpid=9903ca0a-b534-11e9-88e5-0a8c973080c4&cid=&rt=R
HTTP 302
https://www1.imaginativenews.xyz/iwxb/sgvu/index-de-c-a-ch-c1.html?td=www.coilltetowerfinder.com&browser=Chrome&country=Switzerland&city=Z%C3%BCrich&os=MacOS&pr=1159%20EUR&yp=0%20EUR&cep=IHRC1M6oy2_vXpze7WhL2c-TWUe9E-15IDEcfSpoim1bt5hiOzEFkEoFIj0H81J0CWFTXM2uHBZd3KQ-szDnn8OJgPw_Zi7aNwHyuoMa2eW7_XGTt6K-HUXozq365Kvb2GaFYdM2VB2LVE1J3KRmQbxOdmt_epgWxcZ7NjRmEjW-U6dmjRWQQTTXmsJP4ID8VmHa26aGX5xmelDIZYNmKUFcPcfP3vVm0J_Qj_Emp7fidJZrHhG5F6tV6_wtg16GVzYtkDgEcGfsLCtpOxLlpeLikqAZMj7wGgo_fXvgGx6v9rU5ps3KGcoEJYJ2fUBbsjHxRp71JA8OCO-yjcz_W_l8nB63voWiVTk2PbZy-jmSW22oReq9DE_FQ_Syha4hK2agovFXkWRUtVnZLhaAqy49lScs9uJk9uI89TIvUoL9HfEGYKf4X94JPK7cseyP0MjcITNVF1v7T78JuH0kl8TP7FrNyPs0yvztkKhOfhFOAMm69_K5bLoupqdF6h6_e9avMqzK62VYrJxjXidq4sptFkxMJ5G2HoLrIi5muIBGgcQqFRle_M_81h35CjmJe_qYrWGjsmAgye1sBmcPhtiQTVzqfDuhN0jkoZShTCI&lptoken=1591640975c491f512cc Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://progessive4usaamembers.com/ HTTP 302
- http://usa.odysseus-nua.com/zcvisitor/9903ca0a-b534-11e9-88e5-0a8c973080c4?campaignid=edc26d00-1816-11e9-86dd-12077332b422
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
9903ca0a-b534-11e9-88e5-0a8c973080c4
usa.odysseus-nua.com/zcvisitor/ Redirect Chain
|
1010 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
zcredirect
usa.odysseus-nua.com/ |
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index-de-c-a-ch-c1.html
www1.imaginativenews.xyz/iwxb/sgvu/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clean.css
www1.imaginativenews.xyz/iwxb/sgvu/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pw_ix.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
28 KB 28 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ixo.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
11 KB 11 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ix-s.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
9 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ix-g.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
8 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
like_user_1.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
958 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
like_user_2.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
890 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch17.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
906 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch12.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch13.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
878 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch14.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
940 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch15.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch16.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ch11.jpg
www1.imaginativenews.xyz/iwxb/sgvu/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clip_footer_3.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer_right.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
4 KB 4 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu_2x.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
96 B 389 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notify_2x.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
154 B 308 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spin_prize2.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
3 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
action_icons_20px_2x.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
1 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comment_action_2x.png
www1.imaginativenews.xyz/iwxb/sgvu/ |
534 B 745 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| getURLParameter function| dateOffset string| page string| brand function| exit_a1 number| conMid object| mydate number| year number| month number| day number| weekday number| count object| headline object| topDate object| today object| con object| whCon object| dWheel object| button object| device object| first object| second function| setButtonHeight function| spin function| autospin2 function| autospin1 function| countdown1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www1.imaginativenews.xyz/ | Name: __cfduid Value: da1cc2d0a09c1a88c58a7571b04455ea91564757313 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' |
X-Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
progessive4usaamembers.com
usa.odysseus-nua.com
www.coilltetowerfinder.com
www1.imaginativenews.xyz
104.18.25.12
200.63.47.3
2606:4700::6812:4895
50.16.52.56
0ab3f25c35ee587c44481bfed03e42861711d69b1990ec9ee15f3052df15212e
0c5ab4d82953c75353f423cd3c7d348b7cac91e360cfcc4b1c510f8f749825c4
0f577f943953e0e189a6ae873a6124557741f2b1b829ef69268232d2bd1c3d45
199f6ae8518681f58fe56553710092878ec34bd63a279680ef5060229dbf054a
2537f403052dbfa55192a9fd403ded7d39cb1e13d441558e91ad1eb62529f68b
39720efaecb9e2103ba0e4604ed1c3066786c1c5a6688ba8636c46c08036d434
590013bbb57c0e8702722b161e08062123b5619e460147363062fa7562ec007a
592c2f44dadf2ce19d1656611d4648d3093944e2064c396dfe7fa06b3ab4b00f
59db3ae0bdc235b78511854ea6e0d9b542bf170852bbd6a1eccceca25d78fba6
64623f42e1680dc54b1b5793898493354fe860bea5a8045d41a338efe88b6fca
9a0dcf9aaa169200206b3392e0fc135ccf9775e299ea5b2aa92b8e801d0ba6dc
9fb56184675ae0433f32bbd4a908cdeac4169a63e0d7c5fb507b123ab4c62504
b6e1695c80d5b398b46c750f765f0a34f8d875bfec3069668f02a58bfe7d1d9d
c0c0d7409264ab4d2bbe3879778b5ec125effdd7782c83b00df0da335ae8c0fb
c2544a2da8deb6f0eeee50349d98c48f3162e1e8af475036c2f8757fc31a5d38
cd3c1dbd015ee6c0fec4529e804254659272a3c975b342d93382d6ce50b1e3c4
d2851b57743dcb3656e1cf18e199d1f79d21a4c43686ebe10c47e7a4458292b2
ddc183a8e340a6eb798841f0ba3a079106e45274b7210837e1ebe0c4332cf5da
e20089dc91dc5e7c08fe8511ad068afc9ed428acb5b556f4bc3705c93851ef00
e4b5f35b5d3a6abf16d463502e5e7b904aa5eb4f39a92c496e9ecbc7df2c9a8b
e8f5e0b9ec70412d7c28dd5d28d163b249d8f01526da1bf3943e261afefaab68
f3a675245b04458b6ddfc882273ca0a01bfe52b9dc5a8b87a76f71950e8bc2ae
fafc87c41ff49a7a48177417b4bad79d619238f063a6458049c2df08792af3d3
fe171f8715eb5aed3d1b2cfbb3f7a5ee7a58ac8d8cd88c8c62f30c9d13d12796