fraudarmorplus.ezshield.com
Open in
urlscan Pro
45.60.123.236
Public Scan
Effective URL: https://fraudarmorplus.ezshield.com/ProvisionalResponseLandingPage2/tabid/10043/Default.aspx?id=412B0B3D6A42&utm_campaign=Engagement...
Submission: On January 16 via manual from US
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on August 16th 2019. Valid for: a year.
This is the only time fraudarmorplus.ezshield.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 12.130.131.168 12.130.131.168 | 21621 (RESPONSYS-2) (RESPONSYS-2 - Responsys Inc.) | |
4 | 45.60.123.236 45.60.123.236 | 19551 (INCAPSULA) (INCAPSULA - Incapsula Inc) | |
4 | 2 |
ASN21621 (RESPONSYS-2 - Responsys Inc., US)
PTR: secure.ezshield.com
secure.ezshield.com |
ASN19551 (INCAPSULA - Incapsula Inc, US)
fraudarmorplus.ezshield.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
ezshield.com
1 redirects
secure.ezshield.com fraudarmorplus.ezshield.com |
27 KB |
4 | 1 |
Domain | Requested by | |
---|---|---|
4 | fraudarmorplus.ezshield.com |
fraudarmorplus.ezshield.com
|
1 | secure.ezshield.com | 1 redirects |
4 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
fraudarmorplus.ezshield.com DigiCert SHA2 Extended Validation Server CA |
2019-08-16 - 2020-09-23 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://fraudarmorplus.ezshield.com/ProvisionalResponseLandingPage2/tabid/10043/Default.aspx?id=412B0B3D6A42&utm_campaign=Engagement.Identity_Report_C_NR_[01-20]&utm_source=EZShield&utm_medium=email
Frame ID: 19FF4AEDB815B83D49854CE7C505412C
Requests: 3 HTTP requests in this frame
Frame:
https://fraudarmorplus.ezshield.com/_Incapsula_Resource?CWUDNSAI=22&xinfo=6-28114219-0%200NNN%20RT%281579189185089%200%29%20q%280%20-1%20-1%200%29%20r%280%20-1%29%20B16%284%2c314%2c0%29%20U18&incident_id=128002130105081427-135403624313392470&edet=16&cinfo=04000000&rpinfo=0
Frame ID: 106773263F61A908F24481E8A8952150
Requests: 3 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://secure.ezshield.com/pub/cc?_ri_=X0Gzc2X%3DYQpglLjHJlTQGoPzdqvaaftzg8F8MihtOUdjgAENh07DrzcM1Azb5C...
HTTP 302
https://fraudarmorplus.ezshield.com/ProvisionalResponseLandingPage2/tabid/10043/Default.aspx?id=412B0B3D6A42&utm... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://secure.ezshield.com/pub/cc?_ri_=X0Gzc2X%3DYQpglLjHJlTQGoPzdqvaaftzg8F8MihtOUdjgAENh07DrzcM1Azb5Czbhmzfqwlzguzcb3ktErzamvtrtMWJFmPzaVXtpKX%3DSADRUSBR&_ei_=EmAyvjRdhMduEqdgmzryqzpPKTRPN2kb2qoFtZxaPYnku9R6qvBsQU7ziVPqicR8QKESj2CMnGlwt2Muaks6RtmxABOl8XJWx_znmsNMXjrFkAeGMB1v_BmOVby2cCyKNEIvSwTugAMcS5dOwGn3SNzvajL--2ZOMB2waphogBo97jf9m6wcseYykqlhY05hTEbFxE9G7exLNpfczIL8C9muC-97sW5d0ekg17x27PnT4NfgoU_8LzFT5gZwwLKzC4ogBCS48F_-7jqrjxy70Vgszj_Cm_c3_fvuPVy7rXWl2VA.
HTTP 302
https://fraudarmorplus.ezshield.com/ProvisionalResponseLandingPage2/tabid/10043/Default.aspx?id=412B0B3D6A42&utm_campaign=Engagement.Identity_Report_C_NR_[01-20]&utm_source=EZShield&utm_medium=email Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Default.aspx
fraudarmorplus.ezshield.com/ProvisionalResponseLandingPage2/tabid/10043/ Redirect Chain
|
851 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
fraudarmorplus.ezshield.com/ |
131 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
fraudarmorplus.ezshield.com/ |
1 B 35 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
fraudarmorplus.ezshield.com/ Frame 1067 |
11 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 1067 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 1067 |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
fraudarmorplus.ezshield.com/ | Name: ___utmvc Value: hAlCWXFmGCvDp2ze2FMDGNprhfU+ZMKXykompiAq89otZW9P5tUXv0y96OlwBjYJxjvs3LeQXE56jzQOMeO1k6nssdg4o3C/TsaH51avAbs2h2ayRZO0os9+mizUDJtSHrRuG7ejIlhAGfQa+zXIl8RHq0tZWB3TzPWNh6ODRX5zc3gX1tyhb5DZAUEtfITOONUrjRZLUf+DdITfXt/3A0bswbJibCy9ELwlQpYobwIg2igQqI20ukHj5ht/0u8XmXJ86f1+DbmR3ySu1wNmlEfP4Rd6Hmub6WjOdYOPeWi5GmK18c6zmZwjsnieSAGpFdwUlVQPfxhCCU9mu6uf1vnvrIFm0aiswonyiiXfsHFAt8WErLH5qvB9U7Uyac0G8Z6GGoTW4+ljJYfC68So913ByjnjKLjP6CtZ4yAa9KECULlKej0IVkcF/ycLTwd0XlxYaYJg8GUm/qcwuMUBiPQE2Xbv2yhwOkcgn4ap1SYZed8mmeQiNpgAUsf8IdEX8NguzPCm5qZAjLydtJv0KGTJmQ8hPW+9d4m87GRTLIgWXJzEByUAa8aVqlD2FCOqfO1NB0pOoPkQPNlv4Pq37eimqZPKlxESIEaAYgMEMir0GMaLFbv860lZQ+K2EpP0Hqp+tKmfLk1g++axZQfzFEjicBExzWJLICrQ6N8DmePDA+QGUlJA/pgv6LcauhqzATvfv1PoZCyDjsMgw013Vca4CdIlwGkb5+NJ0hL29lKa9Q+uXoR/JF2ZkgTGXqNyKP8EDC4SOF8SEH2/xDCNmXTjo7p3mheVgg4g9sTTp/YZoEw0lsxXAmqu9s/lKq6nb34uB18e4I10hJGhKqlhTbB+1nLCPnv0qIRJpNRY3W29r5KsT94m3B/bXyVcNT6dSTuOIRSKrrvkomjRXuSI4qG+g0afaC1lYGgAYqaqtDNb2VeKhaqYbtc9ARJ6wyORh5m76/RxCZA6BqicngrlDgnXo4/IX/vLh6lTaSIIH1AjWfZCsRblbeCV/SkHCXIuNQ4CKyn1iEcbyEh1donSN4DcuGknzC1HVkqNPwdnFd1Z66J9twqLoLznS5eYl9yL4YD8y2xaiDav9spM/+4hsuwhLAp9nI3zbHUzl94qvbuawWQA3U0eH77ARNmXzEB2NxlR6dse4h2ftb80FhfQtibJQulN6U8tckf1ZYUgdPtAwSinzR778OpOBpQzbssTgkDNldmhCmAIK74TjyfOgEUvUFXtMGn35eCqvHYfMV+aaeSgFAVv5HUtpiJbXuJCHxqCXWN4pAoQ37RLTfKxOGZLJ5evbWYyK9N2lD/NzBFv35Zsm2vB+ZUl//GWOl9gN4ZQm5a6L+wkmIdIS5zyI/PvAVYVAS6daMjD7sw61jLPwuA5jlnPA/MnrqxVaUwNb46W068KtdjVvhcz8EuNvMssgcM8CsHbj7efk11lHyREZPiGe+o0OI22g1Jowgvm8vBurjlfmNU2e5sUprdQ4QzQW9Gho/J2vGhJyLEMYVbE+cX5XUBAHryj92RM0uVX4wP/v1ssZGlnZXN0PTEwODQ4OSxzPWExNzU4MjlkODM5Yzc4NjVhMDg3ODQ3YWE1OTRiMjgxYjA2ODk5OWRhNTlkOTE5YzllOTQ5ZTdmNzBhOWE0NjE3ZDZjODU4NTgwNzE3NTcx |
|
.ezshield.com/ | Name: incap_ses_128_1888799 Value: A2GPJmZacElTHmhXQsHGAcGDIF4AAAAAOY9WhrskOEPz2Eajmacaqg== |
|
.ezshield.com/ | Name: visid_incap_1888799 Value: 9J+l16cqQmmIG6MuUtehRMGDIF4AAAAAQUIPAAAAAAAHoeuRXKciXmD14q7Z44Sx |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fraudarmorplus.ezshield.com
secure.ezshield.com
12.130.131.168
45.60.123.236
1923596c5ac3134783a42479d4fc4edf3c654b10e4122b62209950636a129e9b
2a3adae47bb76198fcf4b01de9735803944f7e9c5766e316a2048459be137fdb
319e64e17fc7abe48cf91f1ca2ad7c30ae19ba567c4bc485aa9b2c0ebaa82ba7
7b50694451592ee45ab4426afb035555eb0d3d927c49e9a403e0f5f714dc179d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fe8c82a06480431454e7ea0bfae59c970b2f00062a21dc8d2973cfacb5f9f889