rideprestige.co.ke Open in urlscan Pro
62.24.122.25 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php
Submission: On January 11 via automatic, source openphish (January 11th 2018, 12:22:24 am UTC)

Summary HTTP 6 Redirects Links 4 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 62.24.122.25, located in Kenya and belongs to Galileo-Kenya, KE. The main domain is rideprestige.co.ke.

This is the only time rideprestige.co.ke was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1	62.24.122.25 62.24.122.25		30994 (Galileo-K...) (Galileo-Kenya)
5	2a02:26f0:11a... 2a02:26f0:11a:399::34ef		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2

1 62.24.122.25 (Kenya)

ASN30994 (Galileo-Kenya, KE)
PTR: twiga.tamshi.com

rideprestige.co.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:11a:399::34ef (European Union)

ASN20940 (AKAMAI-ASN1, US)

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	gfx.ms auth.gfx.ms
1	rideprestige.co.ke rideprestige.co.ke
6	2

	Domain	Requested by
5	auth.gfx.ms	rideprestige.co.ke
1	rideprestige.co.ke
6	2

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php
Frame ID: (47F9E479E0063686174C88AD55EF87B)
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:^|\s)Python(?:\/([\d.]+))?/i
headers server /mod_python(?:\/([\d.]+))?/i

Perl (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_perl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_perl(?:\/([\d\.]+))?/i

mod_python (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_python(?:\/([\d.]+))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_perl(?:\/([\d\.]+))?/i
headers server /mod_python(?:\/([\d.]+))?/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

6
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

0 kB
Transfer

304 kB
Size

4
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1479722006%26rver%3d6.4.6456.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%26lc%3d2057%26id%3d292841%26mkt%3den-gb%26cbcxt%3dout%26fl%3dwld%26contextid%3d3120DC6F591A060F%26bk%3d1479722009&id=292841&uiflavor=web&uaid=2419581f135940218028ecd616c02d58&mkt=EN-GB&lc=2057&bk=1479722009
Title: Forgotten my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1479722006&rver=6.4.6456.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f&lc=2057&id=292841&mkt=en-gb&cbcxt=out&fl=wld&contextid=3120DC6F591A060F&ru=https://outlook.live.com/owa/&bk=1479722009&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-GB&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-GB&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set step2-authen.php Show response rideprestige.co.ke/wp-includes/js/hotverification/hotis/	17 KB 0	1294ms 174ms	Document text/html	62.24.122.25 Galileo-Kenya
General Check archive.org Show headers Download Go to Full URL http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php Protocol HTTP/1.1 Server 62.24.122.25 , Kenya, ASN30994 (Galileo-Kenya, KE), Reverse DNS twiga.tamshi.com Software Apache/2.2.15 (CentOS) DAV/2 mod_fcgid/2.3.7 PHP/5.4.45 mod_python/3.3.1 Python/2.6.6 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips SVN/1.6.11 mod_perl/2.0.4 Perl/v5.10.1 / PHP/5.6.25 Resource Hash `185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host rideprestige.co.ke Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Thu, 11 Jan 2018 00:22:14 GMT Content-Encoding gzip Server Apache/2.2.15 (CentOS) DAV/2 mod_fcgid/2.3.7 PHP/5.4.45 mod_python/3.3.1 Python/2.6.6 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips SVN/1.6.11 mod_perl/2.0.4 Perl/v5.10.1 X-Powered-By PHP/5.6.25 Vary Accept-Encoding Content-Type text/html; charset=UTF-8 Set-Cookie PHPSESSID=h9bqa3d57g7n7geqdtgoo37it7; path=/ Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=2, max=100 Content-Length 5226 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	Default2057.css auth.gfx.ms/16.000.26754.00.1/	74 KB 0	58ms 26ms	Stylesheet text/css	2a02:26f0:11a:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://auth.gfx.ms/16.000.26754.00.1/Default2057.css Requested by Host: rideprestige.co.ke URL: http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php Protocol HTTP/1.1 Server 2a02:26f0:11a:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027` Request headers Referer http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 11 Jan 2018 00:22:14 GMT Content-Encoding gzip Last-Modified Tue, 15 Nov 2016 09:04:22 GMT PPServer PPV: 30 H: BL2IDSPRTS1C002 V: 0 ETag "02f58411f3fd21:0" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=254888 Connection keep-alive Accept-Ranges bytes Content-Length 14670 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	DefaultLoginPaginatedStrings.EN-GB.js Show response auth.gfx.ms/16.000.26754.00.1/	11 KB 0	50ms 18ms	Script application/javascript	2a02:26f0:11a:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://auth.gfx.ms/16.000.26754.00.1/DefaultLoginPaginatedStrings.EN-GB.js Requested by Host: rideprestige.co.ke URL: http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php Protocol HTTP/1.1 Server 2a02:26f0:11a:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4` Request headers Referer http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 11 Jan 2018 00:22:14 GMT Content-Encoding gzip Last-Modified Tue, 15 Nov 2016 09:11:52 GMT PPServer PPV: 30 H: BL2IDSPRTS1C001 V: 0 ETag "0bc904d203fd21:0" Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=214218 Connection keep-alive Accept-Ranges bytes Content-Length 3794 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	DefaultLogin_PCore.js Show response auth.gfx.ms/16.000.26754.00.1/	190 KB 0	62ms 31ms	Script application/javascript	2a02:26f0:11a:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://auth.gfx.ms/16.000.26754.00.1/DefaultLogin_PCore.js Requested by Host: rideprestige.co.ke URL: http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php Protocol HTTP/1.1 Server 2a02:26f0:11a:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac` Request headers Referer http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 11 Jan 2018 00:22:14 GMT Content-Encoding gzip Last-Modified Thu, 17 Nov 2016 17:19:24 GMT PPServer PPV: 30 H: BL2IDSPRTS1A002 V: 0 ETag "036f1bdf640d21:0" Vary Accept-Encoding Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=249586 Transfer-Encoding chunked Connection keep-alive, Transfer-Encoding Accept-Ranges bytes Server Microsoft-IIS/8.5
GET H/1.1	200 OK	AppCentipede_Microsoft.svg auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/	7 KB 0	14ms 13ms	Image image/svg+xml	2a02:26f0:11a:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/AppCentipede_Microsoft.svg Requested by Host: rideprestige.co.ke URL: http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php Protocol HTTP/1.1 Server 2a02:26f0:11a:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625` Request headers Referer http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 11 Jan 2018 00:22:14 GMT Content-Encoding gzip Last-Modified Wed, 19 Oct 2016 12:11:50 GMT PPServer PPV: 30 H: BL2IDSPRTS1A001 V: 0 ETag "08785f812ad21:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=249560 Connection keep-alive Accept-Ranges bytes Content-Length 2946 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	Microsoft_Logotype_Gray.svg auth.gfx.ms/16.000.26754.00.1/images/	5 KB 0	14ms 14ms	Image image/svg+xml	2a02:26f0:11a:399::34ef AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.26754.00.1/images/Microsoft_Logotype_Gray.svg Requested by Host: rideprestige.co.ke URL: http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php Protocol HTTP/1.1 Server 2a02:26f0:11a:399::34ef , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash `356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f` Request headers Referer http://rideprestige.co.ke/wp-includes/js/hotverification/hotis/step2-authen.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Thu, 11 Jan 2018 00:22:14 GMT Content-Encoding gzip Last-Modified Wed, 19 Oct 2016 12:11:50 GMT PPServer PPV: 30 H: BL2IDSPRTS1A001 V: 0 ETag "08785f812ad21:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=254891 Connection keep-alive Accept-Ranges bytes Content-Length 2160 Server Microsoft-IIS/8.5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint object| PROOF number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| g_dtFirstByte object| g_objPageMode object| StringRepository boolean| __DefaultLoginPaginatedStrings function| webpackJsonp function| check

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			outlook.office365.com/	1970-01-18 17:21:08	Name: OIDC Value: 1
			outlook.office365.com/	1970-01-18 21:46:06	Name: ClientId Value: 83767013265849479B5A9209FD64A005
			outlook.office365.com/	1970-01-01 00:00:00	Name: OWAPF Value: v:16.2091.3.2460715&l:mouse
			rideprestige.co.ke/	1970-01-01 00:00:00	Name: PHPSESSID Value: h9bqa3d57g7n7geqdtgoo37it7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
rideprestige.co.ke
2a02:26f0:11a:399::34ef
62.24.122.25
185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995
356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f
8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac
bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625
c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4
ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027