likemag.win Open in urlscan Pro
2400:cb00:2048:1::681b:bdf7  Malicious Activity! Public Scan

URL: https://likemag.win/invest/2018/
Submission: On December 29 via manual from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 2400:cb00:2048:1::681b:bdf7, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is likemag.win.
TLS certificate: Issued by GlobalSign CloudSSL CA - SHA256 - G3 on December 21st 2017. Valid for: 6 months.
This is the only time likemag.win was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
5 2400:cb00:204... 13335 (CLOUDFLAR...)
5 1
Apex Domain
Subdomains
Transfer
5 likemag.win
likemag.win
5 1
Domain Requested by
5 likemag.win likemag.win
5 1

This site contains no links.

Subject Issuer Validity Valid
sni853852.cloudflaressl.com
GlobalSign CloudSSL CA - SHA256 - G3
2017-12-21 -
2018-06-23
6 months crt.sh

This page contains 1 frames:

Primary Page: https://likemag.win/invest/2018/
Frame ID: (F9FF7D0BB8BA8EEABC5D43B83B0C5EAE)
Requests: 5 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

0 kB
Transfer

184 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
likemag.win/invest/2018/
3 KB
0
Document
General
Full URL
https://likemag.win/invest/2018/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::681b:bdf7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7db612e14234179c734043ae309c2867a0033ab0b758926d91c443cba9065c4

Request headers

:path
/invest/2018/
accept-encoding
gzip, deflate
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
:authority
likemag.win
:scheme
https
:method
GET
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Fri, 29 Dec 2017 18:51:04 GMT
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
set-cookie
__cfduid=d28e33f106e4d791306a50c2f7b6c00101514573464; expires=Sat, 29-Dec-18 18:51:04 GMT; path=/; domain=.likemag.win; HttpOnly; Secure
cf-ray
3d4ef2d69b6964b7-FRA
Offices.png
likemag.win/invest/2018/index_files/
100 KB
0
Image
General
Full URL
https://likemag.win/invest/2018/index_files/Offices.png
Requested by
Host: likemag.win
URL: https://likemag.win/invest/2018/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::681b:bdf7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bcfe9fe79c7f81c19fcbfc6aeea52d3a245528d6895288c5286c6dc94ec793e8

Request headers

:path
/invest/2018/index_files/Offices.png
pragma
no-cache
cookie
__cfduid=d28e33f106e4d791306a50c2f7b6c00101514573464
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
likemag.win
referer
https://likemag.win/invest/2018/
:scheme
https
:method
GET
Referer
https://likemag.win/invest/2018/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Fri, 29 Dec 2017 18:51:04 GMT
cf-cache-status
HIT
last-modified
Fri, 29 Dec 2017 17:59:18 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=2419200
cf-ray
3d4ef2d6bb7d64b7-FRA
expires
Fri, 26 Jan 2018 18:51:04 GMT
top.PNG
likemag.win/invest/2018/index_files/
7 KB
0
Image
General
Full URL
https://likemag.win/invest/2018/index_files/top.PNG
Requested by
Host: likemag.win
URL: https://likemag.win/invest/2018/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::681b:bdf7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
94899530787b9cf2edef1187f8b94321ba7441d688064a9aade79089465b3921

Request headers

:path
/invest/2018/index_files/top.PNG
pragma
no-cache
cookie
__cfduid=d28e33f106e4d791306a50c2f7b6c00101514573464
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
likemag.win
referer
https://likemag.win/invest/2018/
:scheme
https
:method
GET
Referer
https://likemag.win/invest/2018/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Fri, 29 Dec 2017 18:51:04 GMT
cf-cache-status
HIT
last-modified
Fri, 29 Dec 2017 17:59:18 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
3d4ef2d6bb7e64b7-FRA
content-length
7584
expires
Fri, 29 Dec 2017 22:51:04 GMT
strip.png
likemag.win/invest/2018/index_files/
64 KB
0
Image
General
Full URL
https://likemag.win/invest/2018/index_files/strip.png
Requested by
Host: likemag.win
URL: https://likemag.win/invest/2018/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::681b:bdf7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2cb003c53468d0dc5fc78001b2c63d657694aec1aa25d223b8086c8747eaff1

Request headers

:path
/invest/2018/index_files/strip.png
pragma
no-cache
cookie
__cfduid=d28e33f106e4d791306a50c2f7b6c00101514573464
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
likemag.win
referer
https://likemag.win/invest/2018/
:scheme
https
:method
GET
Referer
https://likemag.win/invest/2018/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Fri, 29 Dec 2017 18:51:04 GMT
cf-cache-status
HIT
last-modified
Fri, 29 Dec 2017 17:59:18 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=2419200
cf-ray
3d4ef2d6bb7f64b7-FRA
expires
Fri, 26 Jan 2018 18:51:04 GMT
comodo_secure_seal_113x59_transp.png
likemag.win/invest/2018/index_files/
9 KB
0
Image
General
Full URL
https://likemag.win/invest/2018/index_files/comodo_secure_seal_113x59_transp.png
Requested by
Host: likemag.win
URL: https://likemag.win/invest/2018/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::681b:bdf7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
24c94b4ab339a9c7c23474bcef3443422d2b99b5d8d2d7d3911296c3ffef4cf2

Request headers

:path
/invest/2018/index_files/comodo_secure_seal_113x59_transp.png
pragma
no-cache
cookie
__cfduid=d28e33f106e4d791306a50c2f7b6c00101514573464
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
likemag.win
referer
https://likemag.win/invest/2018/
:scheme
https
:method
GET
Referer
https://likemag.win/invest/2018/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date
Fri, 29 Dec 2017 18:51:04 GMT
cf-cache-status
HIT
last-modified
Fri, 29 Dec 2017 17:59:18 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=2419200
cf-ray
3d4ef2d6bb8064b7-FRA
expires
Fri, 26 Jan 2018 18:51:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| validateusername function| validate

1 Cookies

Domain/Path Name / Value
.likemag.win/ Name: __cfduid
Value: d28e33f106e4d791306a50c2f7b6c00101514573464