energyhomeservice.com Open in urlscan Pro
104.21.44.46 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://email.r1.toughbuilt.autos/c/eJx0zsmWojwcBfCnwV15SJgXLhCMFBbI5AAbTyBhUAQkwVKf_jvd9vm6Nr39_3LvTTESzPFC0JYChPw5UAFCQTIFCPOxx6...
Effective URL:
https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
Submission: On September 12 via api (September 12th 2023, 11:08:31 am UTC) from AU — Scanned from AU

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 8 domains to perform 11 HTTP transactions. The main IP is 104.21.44.46, located in and belongs to CLOUDFLARENET, US. The main domain is energyhomeservice.com.
TLS certificate: Issued by GTS CA 1P5 on August 23rd 2023. Valid for: 3 months.

This is the only time energyhomeservice.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.102.239.211 34.102.239.211	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	208.75.122.11 208.75.122.11	40444 (ASN-CC) (ASN-CC)
1 1	23.32.5.95 23.32.5.95	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	104.21.0.124 104.21.0.124	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	13.35.147.115 13.35.147.115	16509 (AMAZON-02) (AMAZON-02)
1	18.67.111.45 18.67.111.45	16509 (AMAZON-02) (AMAZON-02)
6	104.21.44.46 104.21.44.46	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.2.184 104.17.2.184	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	5

1 34.102.239.211 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 211.239.102.34.bc.googleusercontent.com

email.r1.toughbuilt.autos	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.75.122.11 (United States) 1 redirects

ASN40444 (ASN-CC, US)
PTR: rs6.net

r20.rs6.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.32.5.95 (Sydney, Australia) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-32-5-95.deploy.static.akamaitechnologies.com

www.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.21.0.124 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

lhsupplychain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.147.115 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-35-147-115.syd1.r.cloudfront.net

findicons.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.67.111.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-111-45.syd62.r.cloudfront.net

images.freeimages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.21.44.46 (None, )

ASN13335 (CLOUDFLARENET, US)

energyhomeservice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.2.184 (None, )

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	energyhomeservice.com energyhomeservice.com	81 KB
2	cloudflare.com challenges.cloudflare.com — Cisco Umbrella Rank: 6423	11 KB
2	lhsupplychain.com 1 redirects lhsupplychain.com	5 KB
1	freeimages.com images.freeimages.com — Cisco Umbrella Rank: 192036	762 B
1	findicons.com 1 redirects findicons.com — Cisco Umbrella Rank: 490394	304 B
1	bing.com 1 redirects www.bing.com — Cisco Umbrella Rank: 76	425 B
1	rs6.net 1 redirects r20.rs6.net — Cisco Umbrella Rank: 7630	594 B
1	toughbuilt.autos 1 redirects email.r1.toughbuilt.autos	970 B
11	8

	Domain	Requested by
6	energyhomeservice.com	energyhomeservice.com
2	challenges.cloudflare.com	energyhomeservice.com challenges.cloudflare.com
2	lhsupplychain.com	1 redirects
1	images.freeimages.com	lhsupplychain.com
1	findicons.com	1 redirects
1	www.bing.com	1 redirects
1	r20.rs6.net	1 redirects
1	email.r1.toughbuilt.autos	1 redirects
11	8

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
lhsupplychain.com GTS CA 1P5	`2023-08-05` - `2023-11-03`	3 months	crt.sh
energyhomeservice.com GTS CA 1P5	`2023-08-23` - `2023-11-21`	3 months	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2023-08-18` - `2024-08-17`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
Frame ID: 0FE8F3F6104A8D7EDD856E1423319A41
Requests: 11 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qrz4l/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: A4B859F7B000F614D6AD050C64E6BC4F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

http://email.r1.toughbuilt.autos/c/eJx0zsmWojwcBfCnwV15SJgXLhCMFBbI5AAbTyBhUAQkwVKf_jvd9vm6Nr39_3LvTTESzPFC0J... HTTP 302
https://r20.rs6.net/tn.jsp?f=001RX0NXtx_SEDBTPMZD4JJibNeKEAWF998gQF93tUzkk5YveWlALQiw1uhuDFFbYSt... HTTP 302
https://www.bing.com/ck/a?!&&p=1dc3d91fbd3ccad2JmltdHM9MTY5Mzk1ODQwMCZpZ3VpZD0zY2QxMzU0NS1iODQ4LT... HTTP 302
https://lhsupplychain.com/sap-concur-solutions/index.htm Page URL
https://lhsupplychain.com/sap-concur-solutions/process.php HTTP 302
https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20= Page URL

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

5
IPs

3
Countries

97 kB
Transfer

246 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://email.r1.toughbuilt.autos/c/eJx0zsmWojwcBfCnwV15SJgXLhCMFBbI5AAbTyBhUAQkwVKf_jvd9vm6Nr39_3LvTTESzPFC0JYChPw5UAFCQTIFCPOxx6TAjP-6QOvn5dSQ9zNVgYb0RlwU_dT9JQBEQ3lT0XccFz9SOtChBMW3MnqbaFfQ__n33p9Jeqc_Ov-IZs_IguSSKJIZXQDVkBWgAgBn9UI2dAkrhGqSDmCuEVwaGGo5JoRqqgKUWbOAIpREA0AgKgqAcyopZakSA1CqSqTEgiyOYM77qarzqWn5HE-8Z7N2UXM-sN-fQAJEIxTnI1PnHeUCRLybn9kgSKgUJFsUQXQU_SN_nOKVvUwCL7Nl121yn25W5gEZhl6FyJD47nW5KOmdHlrzK2y-wVRPNkJ5GnOLTrnC7r5xJ9byIo6wi91kfzOnzrR8q-kMWPTXk-4tjTG9u8EBHamch2l9ds8adD8_lOU-Lq0o7YJzrWzPZhFl6nMXNEpz-1TJyWTLleiuy_NR5l9mzVsnUtrkro6iB5YhA9l-l3na1DzElGkJy-U8OziYh1pBxsSl5to5Xtuw0BrSV2m4TrlTak8-ZiB3-32tV1bgx09jC6Y-5w9apuWLxJuycrRnc0rIqSJXXV0lycU_5rh-gfhgRa3I0guTy1v1dfPONIqeVRsgkoO7LlaS3zZOeDWH9Tqq9261qb-76QJx4ubpEZS2I3nedFt3ZVGsjFVDPZhiVeUxR24S-dn2Y2mGwStVJjWCWqN-PKdKLyOz_PJ3TQC7I33oeWai1Xbc2Gs_dIlzKqVt5ZwH7fUhxubaQ_BW9kOUoNq8BAA1-00wPNwUbbPdQzZkqboZ8taUhx7tuGpuDierjvTs0FihINkCVAtBstXoRThGnydHD6iB7l3R7VybWlcWM-Qljeb2kXWt7PZVt26cVEV-Ycj8lX9X1IJkfw_K7qSB1apXEuOpDte7W_e0uWllz32erHfGN19qMe9X2XiMvcr0Hetvh8TwiOd4rHBHGRVksRkpY_Oiv87Gxb-NL6zovwAAAP__2m9PFg HTTP 302
https://r20.rs6.net/tn.jsp?f=001RX0NXtx_SEDBTPMZD4JJibNeKEAWF998gQF93tUzkk5YveWlALQiw1uhuDFFbYStCeub5svN9vdCBk0r2nSJTVqAunACNCin92com_8MB9rYvJPWFXe4bQYhjJj72JI-5BVSfCRYnPjh5OjAcRZ6yUPi5iqI6d_AsBE0JGfjX4tLAhtlHR5lTv6r0M1BQs1ZVUZM7uix0Ys7Tsb4bZWHatQ7cdrTJeAGHXmlQc7idogYQGYtHf7ytrZ1bJoVh8gCPNSy9O1uobtxefYfzdSKfgH7yi_Td_gdm86ETTkNXbahz1SWCRl0sYks4fqgLqMjeRRyglPFdb1v80g3NliHQmApGGRhVJgKhwnuk2aTJbYX1fDH3MMuqGnfccE9EieM2Ya66tStFJTRNZO-BAQPzY5u6R27i6-yug8fRAfLNUiP2nXex8bZAFEOrKDGNQJdH_f3OgHjp7z-0SAGMF2qfopRTFhAkP1FiVKPpxJYFOZUx4943gq94OA4poFUt6AKW_ChR8ZWiCQ=&c=6RzdtaFI_H8Pe9FvncnUJDeCmsSsFMTi7JoRCmgDlzhlJSTgcbksFA==&ch=wp5U_71EEo5T9y6pmvJhoeiq7fotNtTGU9wtB7StoEZrXSMgANHCFA== HTTP 302
https://www.bing.com/ck/a?!&&p=1dc3d91fbd3ccad2JmltdHM9MTY5Mzk1ODQwMCZpZ3VpZD0zY2QxMzU0NS1iODQ4LTY3ZmUtMmFlOC0yNjNlYjllNDY2ODkmaW5zaWQ9NTE1Ng&ptn=3&hsh=3&fclid=3cd13545-b848-67fe-2ae8-263eb9e46689&u=a1aHR0cHM6Ly9saHN1cHBseWNoYWluLmNvbS9zYXAtY29uY3VyLXNvbHV0aW9ucy9pbmRleC5odG0 HTTP 302
https://lhsupplychain.com/sap-concur-solutions/index.htm Page URL
https://lhsupplychain.com/sap-concur-solutions/process.php HTTP 302
https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://email.r1.toughbuilt.autos/c/eJx0zsmWojwcBfCnwV15SJgXLhCMFBbI5AAbTyBhUAQkwVKf_jvd9vm6Nr39_3LvTTESzPFC0JYChPw5UAFCQTIFCPOxx6TAjP-6QOvn5dSQ9zNVgYb0RlwU_dT9JQBEQ3lT0XccFz9SOtChBMW3MnqbaFfQ__n33p9Jeqc_Ov-IZs_IguSSKJIZXQDVkBWgAgBn9UI2dAkrhGqSDmCuEVwaGGo5JoRqqgKUWbOAIpREA0AgKgqAcyopZakSA1CqSqTEgiyOYM77qarzqWn5HE-8Z7N2UXM-sN-fQAJEIxTnI1PnHeUCRLybn9kgSKgUJFsUQXQU_SN_nOKVvUwCL7Nl121yn25W5gEZhl6FyJD47nW5KOmdHlrzK2y-wVRPNkJ5GnOLTrnC7r5xJ9byIo6wi91kfzOnzrR8q-kMWPTXk-4tjTG9u8EBHamch2l9ds8adD8_lOU-Lq0o7YJzrWzPZhFl6nMXNEpz-1TJyWTLleiuy_NR5l9mzVsnUtrkro6iB5YhA9l-l3na1DzElGkJy-U8OziYh1pBxsSl5to5Xtuw0BrSV2m4TrlTak8-ZiB3-32tV1bgx09jC6Y-5w9apuWLxJuycrRnc0rIqSJXXV0lycU_5rh-gfhgRa3I0guTy1v1dfPONIqeVRsgkoO7LlaS3zZOeDWH9Tqq9261qb-76QJx4ubpEZS2I3nedFt3ZVGsjFVDPZhiVeUxR24S-dn2Y2mGwStVJjWCWqN-PKdKLyOz_PJ3TQC7I33oeWai1Xbc2Gs_dIlzKqVt5ZwH7fUhxubaQ_BW9kOUoNq8BAA1-00wPNwUbbPdQzZkqboZ8taUhx7tuGpuDierjvTs0FihINkCVAtBstXoRThGnydHD6iB7l3R7VybWlcWM-Qljeb2kXWt7PZVt26cVEV-Ycj8lX9X1IJkfw_K7qSB1apXEuOpDte7W_e0uWllz32erHfGN19qMe9X2XiMvcr0Hetvh8TwiOd4rHBHGRVksRkpY_Oiv87Gxb-NL6zovwAAAP__2m9PFg HTTP 302
https://r20.rs6.net/tn.jsp?f=001RX0NXtx_SEDBTPMZD4JJibNeKEAWF998gQF93tUzkk5YveWlALQiw1uhuDFFbYStCeub5svN9vdCBk0r2nSJTVqAunACNCin92com_8MB9rYvJPWFXe4bQYhjJj72JI-5BVSfCRYnPjh5OjAcRZ6yUPi5iqI6d_AsBE0JGfjX4tLAhtlHR5lTv6r0M1BQs1ZVUZM7uix0Ys7Tsb4bZWHatQ7cdrTJeAGHXmlQc7idogYQGYtHf7ytrZ1bJoVh8gCPNSy9O1uobtxefYfzdSKfgH7yi_Td_gdm86ETTkNXbahz1SWCRl0sYks4fqgLqMjeRRyglPFdb1v80g3NliHQmApGGRhVJgKhwnuk2aTJbYX1fDH3MMuqGnfccE9EieM2Ya66tStFJTRNZO-BAQPzY5u6R27i6-yug8fRAfLNUiP2nXex8bZAFEOrKDGNQJdH_f3OgHjp7z-0SAGMF2qfopRTFhAkP1FiVKPpxJYFOZUx4943gq94OA4poFUt6AKW_ChR8ZWiCQ=&c=6RzdtaFI_H8Pe9FvncnUJDeCmsSsFMTi7JoRCmgDlzhlJSTgcbksFA==&ch=wp5U_71EEo5T9y6pmvJhoeiq7fotNtTGU9wtB7StoEZrXSMgANHCFA== HTTP 302
https://www.bing.com/ck/a?!&&p=1dc3d91fbd3ccad2JmltdHM9MTY5Mzk1ODQwMCZpZ3VpZD0zY2QxMzU0NS1iODQ4LTY3ZmUtMmFlOC0yNjNlYjllNDY2ODkmaW5zaWQ9NTE1Ng&ptn=3&hsh=3&fclid=3cd13545-b848-67fe-2ae8-263eb9e46689&u=a1aHR0cHM6Ly9saHN1cHBseWNoYWluLmNvbS9zYXAtY29uY3VyLXNvbHV0aW9ucy9pbmRleC5odG0 HTTP 302
https://lhsupplychain.com/sap-concur-solutions/index.htm

Request Chain 1

https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png HTTP 301
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

index.htm Show response
lhsupplychain.com/sap-concur-solutions/
Redirect Chain

http://email.r1.toughbuilt.autos/c/eJx0zsmWojwcBfCnwV15SJgXLhCMFBbI5AAbTyBhUAQkwVKf_jvd9vm6Nr39_3LvTTESzPFC0JYChPw5UAFCQTIFCPOxx6TAjP-6QOvn5dSQ9zNVgYb0RlwU_dT9JQBEQ3lT0XccFz9SOtChBMW3MnqbaFfQ__n33p...
https://r20.rs6.net/tn.jsp?f=001RX0NXtx_SEDBTPMZD4JJibNeKEAWF998gQF93tUzkk5YveWlALQiw1uhuDFFbYStCeub5svN9vdCBk0r2nSJTVqAunACNCin92com_8MB9rYvJPWFXe4bQYhjJj72JI-5BVSfCRYnPjh5OjAcRZ6yUPi5iqI6d_AsBE0J...
https://www.bing.com/ck/a?!&&p=1dc3d91fbd3ccad2JmltdHM9MTY5Mzk1ODQwMCZpZ3VpZD0zY2QxMzU0NS1iODQ4LTY3ZmUtMmFlOC0yNjNlYjllNDY2ODkmaW5zaWQ9NTE1Ng&ptn=3&hsh=3&fclid=3cd13545-b848-67fe-2ae8-263eb9e46689&...
https://lhsupplychain.com/sap-concur-solutions/index.htm

17 KB
5 KB

736ms
650ms

Document
text/html

104.21.0.124
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lhsupplychain.com/sap-concur-solutions/index.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.0.124 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 250ebbc8e5d32fd88a380fb1991563d97beab489ddee37b12acc427e6935bad4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8057b145bd76a801-SYD
content-encoding: br
content-type: text/html
date: Tue, 12 Sep 2023 11:08:26 GMT
last-modified: Wed, 06 Sep 2023 13:20:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JSKRBgr0iEKapIjYMDH6JGX%2ByD4rBXv3T2toxhVnOAjFFlhaAobEDqRvxbCtfmaTWm1nS0j9vGfAP9auHytM5Nl6FsKr6GVQlFxrhnZwb0HQQkwY3XsNgD9ilqzUEdizpDCqkw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

Redirect headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-origin: *
alt-svc: h3=":443"; ma=93600
cache-control: no-cache, must-revalidate
content-length: 0
date: Tue, 12 Sep 2023 11:08:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://lhsupplychain.com/sap-concur-solutions/index.htm
pragma: no-cache
x-cdn-traceid: 0.5b052017.1694516905.c4da75a
x-msedge-ref: Ref A: CD82DEAC83914DC19DFE9FE4716AF5B5 Ref B: SYD03EDGE1615 Ref C: 2023-09-12T11:08:25Z

GET
H2

200

microsoft_new_logo_alt.png
images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/
Redirect Chain

https://findicons.com/files/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png
https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

254 B
762 B

30ms
4ms

Image
image/png

18.67.111.45
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons

Requested by

Host: lhsupplychain.com
URL: https://lhsupplychain.com/sap-concur-solutions/index.htm

Protocol

Server

18.67.111.45 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-67-111-45.syd62.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Sun, 10 Sep 2023 11:52:31 GMT
via: 1.1 3468af8a053b0ff241626aed87444af8.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: SYD62-P2
age: 170156
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 254
x-xss-protection: 1; mode=block
referrer-policy: origin
last-modified: Tue, 20 Dec 2022 05:17:19 GMT
server: AmazonS3
etag: "57ab754695eb0a2c74201ecd6948c12f"
x-frame-options: DENY
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 6xvggpxlmmCZm5VlDUtC_YT06hnerx9rRlgJ74SiNYxUuP4Wk-_lDg==

Redirect headers

date: Mon, 04 Sep 2023 22:47:13 GMT
via: 1.1 ff9e105aa8810f98f1f8f9ec61929886.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: SYD1-C1
age: 649273
x-cache: Hit from cloudfront
location: https://images.freeimages.com/fic/images/icons/2796/metro_uinvert_dock/64/microsoft_new_logo_alt.png?ref=findicons
content-length: 0
x-amz-cf-id: hp7XFAiejcS97Wqe-i9mUH2HJEDA71I8zQ71a6krsB54MQrlVkd92w==

GET
H2

403

Primary Request Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20= Show response
energyhomeservice.com/
Redirect Chain

https://lhsupplychain.com/sap-concur-solutions/process.php
https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=

6 KB
5 KB

123ms
9ms

Document
text/html

104.21.44.46
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.44.46 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e12bfc26474194c3e2a33a602a5bf6611914930fb39691e7b47656bc2a92d0ab

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: null
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated: challenge
cf-ray: 8057b15f49a055bd-SYD
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Tue, 12 Sep 2023 11:08:29 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4BqNpBMKWG3ChOUy3HgxZxALiwVuftx9%2FdAc70xxVHce9F45fw7O2LdlkFSXaDmtxTGkL%2BnwXCO6rYU61SliqCL8kY2pe%2FX0Huqk5GuGypcqHEBY%2FKtWkKFy6RiYwlMDik1%2FPEysKFY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8057b15d1ef6a801-SYD
content-type: text/html; charset=UTF-8
date: Tue, 12 Sep 2023 11:08:29 GMT
location: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vev3lPR8fvjvEeF%2FFhQi287xvcxaGCCmRFIDWknaaJBJ%2BIosTOP9CYa3H8jv73R9W1adGX6FX5sU%2FWW%2FfF2EUGZYJIUvbhAUmvtbRCAq07wtTc41z%2B0I046dOrM6d02u%2FjYAIA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed

GET
H2 200 challenges.css
energyhomeservice.com/cdn-cgi/styles/ 6 KB
3 KB 4ms
4ms Stylesheet
text/css 104.21.44.46
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://energyhomeservice.com/cdn-cgi/styles/challenges.css

Requested by

Host: energyhomeservice.com
URL: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.44.46 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 11:08:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 05 Sep 2023 14:34:37 GMT
server: cloudflare
etag: W/"64f73c7d-19c8"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8057b15f79be55bd-SYD
expires: Tue, 12 Sep 2023 13:08:29 GMT

GET
H2 200 v1 Show response
energyhomeservice.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ 168 KB
57 KB 14ms
13ms Script
application/javascript 104.21.44.46
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://energyhomeservice.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8057b15f49a055bd
Requested by: Host: energyhomeservice.com
URL: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.44.46 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: df58f80e834ddb5b4146dc3a3c8f02d304caf1ab48f93260805a5bb4ebb2fe73

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=?__cf_chl_rt_tk=o5zLE_oa.Q23MZ_Q2OwYkmOfzYcLNbJ_yNydQzk6Nh8-1694516909-0-gaNycGzNDBA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 11:08:30 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Agd81qQB6WsL%2BrBl%2BDwkFZtx%2BnhGIFq6oJEzBA7XUdfENwlAr9i3TtWmbOwtw%2FXDLlPjmodCehjHbOafLStWgYZnwVb9taB2Sa2ZxXvcP0X1OrTRdHoscjZ9XVyvDJGjLtGGx6EeGo4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8057b15f99cf55bd-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/b/8827f912/ 30 KB
11 KB 358ms
24ms Script
application/javascript 104.17.2.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/8827f912/api.js?onload=barZ0&render=explicit
Requested by: Host: energyhomeservice.com
URL: https://energyhomeservice.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8057b15f49a055bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.2.184 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bca2f8c54941086a530fdb19a3cf7cf753f3056066a7c665936810286937f421

Request headers

Referer
Origin: https://energyhomeservice.com
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 11:08:30 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 8057b161d95c5c10-SYD
alt-svc: h3=":443"; ma=86400

GET
H2 403 favicon.ico
energyhomeservice.com/ 6 KB
6 KB 8ms
8ms Image
text/html 104.21.44.46
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://energyhomeservice.com/favicon.ico

Requested by

Host: energyhomeservice.com
URL: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.21.44.46 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17473ef204ee595b0446639708f1eed8562722f529c4355625fcc394c4cd6737

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 11:08:30 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
alt-svc: h3=":443"; ma=86400
referrer-policy: same-origin
server: cloudflare
cross-origin-opener-policy: same-origin
cf-mitigated: challenge
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EcAhdiqtRMDf0tk5Z8IKKulMyurGZd1wMmKTVqhIock0IuFNc2jK5jwCDYzuSD7VjBbcF69M%2FthG3rooUCQYubjMGlOXsxCBVhvJ0wiz7UEHWQ%2FEADGqv3kX5rThG5YlhvnPhn8kErs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
origin-agent-cluster: ?1
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 8057b15fc9fa55bd-SYD
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
DATA 200
OK truncated
/ 586 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/png

GET
BLOB 200
OK f91dadaf-6bd8-46b4-b3b9-201d005a9280
https://energyhomeservice.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://energyhomeservice.com/f91dadaf-6bd8-46b4-b3b9-201d005a9280
Requested by: Host: energyhomeservice.com
URL: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H2 200 ded3b2581ca15f0 Show response
energyhomeservice.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1464791071:1694514332:kaHjUsbOWLYEuGS_hXhOiwBh9pMY6oebAywoSVseCaY/8057b15f49a055bd/ 10 KB
8 KB 29ms
28ms XHR
text/plain 104.21.44.46
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://energyhomeservice.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1464791071:1694514332:kaHjUsbOWLYEuGS_hXhOiwBh9pMY6oebAywoSVseCaY/8057b15f49a055bd/ded3b2581ca15f0
Requested by: Host: energyhomeservice.com
URL: https://energyhomeservice.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8057b15f49a055bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.44.46 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b26934a0319fdd03fb471c1380079c123f709962e7c7e8e6b4938f0bb5d1d789

Request headers

Referer: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
CF-Challenge: ded3b2581ca15f0
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 12 Sep 2023 11:08:30 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E4C7MfPX76HhkPcIF2yuo8etYwLv0Ef324DUNezH0FSCYBU%2FPyrEP8ZOItaZHOPj5WISncng0hrg%2Fy%2FBEmSQlFyoApVJAaFr8dkPv4ve9RSA9TqJIarAIQ6DBvq%2FaD%2BF2qmX%2Bk7fmbQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 8057b1609a7d55bd-SYD
alt-svc: h3=":443"; ma=86400
cf-chl-gen: ipbwklLD2MLp8jVSR2WLpLzRqEC5lMYk6Fj8+692rPSe+fzT8UFodNiKa2Xti5HC$xTLV0BmG9Z4C74D20rDU4g==

GET
H2 200 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qrz4l/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame A4B8 0
0 325ms
15ms Document
text/html 104.17.2.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qrz4l/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/8827f912/api.js?onload=barZ0&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.2.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8057b1642e66a953-SYD
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 11:08:30 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

POST
H2 200 ded3b2581ca15f0 Show response
energyhomeservice.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1464791071:1694514332:kaHjUsbOWLYEuGS_hXhOiwBh9pMY6oebAywoSVseCaY/8057b15f49a055bd/ 2 KB
2 KB 17ms
16ms XHR
text/html 104.21.44.46
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://energyhomeservice.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1464791071:1694514332:kaHjUsbOWLYEuGS_hXhOiwBh9pMY6oebAywoSVseCaY/8057b15f49a055bd/ded3b2581ca15f0
Requested by: Host: energyhomeservice.com
URL: https://energyhomeservice.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8057b15f49a055bd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.44.46 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ce7e40ed5b8464a1999076d084cba195d0fc8386f5200422f942272b836968c

Request headers

Referer: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20=
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
CF-Challenge: ded3b2581ca15f0
Content-type: application/x-www-form-urlencoded

Response headers

cf-chl-out: m/fGetIy1vb5kb1NZ2F6ROYOH1eowZ+XUeNPtHedrSaQZ+ocSOYEcF0jCWOOPIl4lRiyogEJV3WXMN9eCNMJUt2/QApKIBhpnmEjNL7Cy/A=$topsJ1a5eNOA9szQtaWpWA==
cf-chl-out-s: ahLicQXRQkmf31YDQxPtIJjoIzVjCo3ZqUpHuPg0lN6BphpeWwwSbYkLo/GnCCs+PMKmtTp3kTCVUnkLW4+V3KhNFTV0F3GZGZTKp2ck1DhLI9E5vOf5ujSS3rX61sZuRXoA0Y17dHVOU575zRfGDQ==$XmArPy+svXNQBOk01hzp1Q==
date: Tue, 12 Sep 2023 11:08:30 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d6T%2F9tSZs%2FPd%2BzspGz2nmrBCXHBDA3%2F%2BUVXLOeIU4mKQEBgA7BH%2F6fltxvKNV6AwuFC2vbaL68yb%2BK9%2Bh4ZHXa0tCpfmJLFAT7yMlXwJYwa%2Fvclm14p7d0lp86O%2FJBdnX4WC8pHCDIo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 8057b1657cca55bd-SYD
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://energyhomeservice.com/Mc2FyYS5hcmdhbmVzZUBpcmVzcy5jb20= Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://energyhomeservice.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
email.r1.toughbuilt.autos
energyhomeservice.com
findicons.com
images.freeimages.com
lhsupplychain.com
r20.rs6.net
www.bing.com
104.17.2.184
104.21.0.124
104.21.44.46
13.35.147.115
18.67.111.45
208.75.122.11
23.32.5.95
34.102.239.211
0ce7e40ed5b8464a1999076d084cba195d0fc8386f5200422f942272b836968c
17473ef204ee595b0446639708f1eed8562722f529c4355625fcc394c4cd6737
2267d1822dbefc10c25e17d1fa4a6d9331e5a126e2483c5aff542d6107ebca36
250ebbc8e5d32fd88a380fb1991563d97beab489ddee37b12acc427e6935bad4
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
b26934a0319fdd03fb471c1380079c123f709962e7c7e8e6b4938f0bb5d1d789
bca2f8c54941086a530fdb19a3cf7cf753f3056066a7c665936810286937f421
df58f80e834ddb5b4146dc3a3c8f02d304caf1ab48f93260805a5bb4ebb2fe73
e12bfc26474194c3e2a33a602a5bf6611914930fb39691e7b47656bc2a92d0ab
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

energyhomeservice.com Open in urlscan Pro 104.21.44.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

82 %HTTPS

0 %IPv6

8 Domains

8 Subdomains

5 IPs

3 Countries

97 kBTransfer

246 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

energyhomeservice.com Open in urlscan Pro
104.21.44.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

5
IPs

3
Countries

97 kB
Transfer

246 kB
Size

0
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!