magneticcopywriter.com
Open in
urlscan Pro
192.254.236.51
Malicious Activity!
Public Scan
Effective URL: http://magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/1c0996d3f6d6cd01e14fe9a70b0e.php?client_id=77Inboxas...
Submission: On September 12 via manual from US
Summary
This is the only time magneticcopywriter.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 75.126.81.66 75.126.81.66 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
1 8 | 192.254.236.51 192.254.236.51 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
8 | 3 |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: 42.51.7e4b.ip4.static.sl-reverse.com
excel-invoices.mybluemix.net |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
magneticcopywriter.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
magneticcopywriter.com
1 redirects
magneticcopywriter.com |
75 KB |
2 |
mybluemix.net
1 redirects
excel-invoices.mybluemix.net |
1 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
8 | magneticcopywriter.com |
1 redirects
magneticcopywriter.com
|
2 | excel-invoices.mybluemix.net | 1 redirects |
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.mybluemix.net DigiCert SHA2 Secure Server CA |
2017-04-13 - 2020-07-10 |
3 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/1c0996d3f6d6cd01e14fe9a70b0e.php?client_id=77Inboxaspxn3b20b7febf45b84f0766e702673f&Id3b20b7febf45b84f0766e702673f&doc9e4a7104f13da7541337e5dca00c&login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&jiv9e4a7104f13da7541337e5dca00c&xls1d&id=fav&doc
Frame ID: 94C4EDA32FA2D1B242CACEE1D254E0A5
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://excel-invoices.mybluemix.net/?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==
HTTP 302
https://excel-invoices.mybluemix.net/nd50j32r6yj2fz4no6mk1j68.php?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&13InboxL... Page URL
-
http://magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/?login=ZGF2aWQubC5nb3JtYW5AZ3NrL...
HTTP 302
http://magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/1c0996d3f6d6cd01e14fe9a70b0e.php... Page URL
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Microsoft ASP.NET (Web Frameworks) Expand
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
IIS (Web Servers) Expand
Detected patterns
- html /<input[^>]+name="__VIEWSTATE/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://excel-invoices.mybluemix.net/?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==
HTTP 302
https://excel-invoices.mybluemix.net/nd50j32r6yj2fz4no6mk1j68.php?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
-
http://magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==
HTTP 302
http://magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/1c0996d3f6d6cd01e14fe9a70b0e.php?client_id=77Inboxaspxn3b20b7febf45b84f0766e702673f&Id3b20b7febf45b84f0766e702673f&doc9e4a7104f13da7541337e5dca00c&login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&jiv9e4a7104f13da7541337e5dca00c&xls1d&id=fav&doc Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://excel-invoices.mybluemix.net/?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ== HTTP 302
- https://excel-invoices.mybluemix.net/nd50j32r6yj2fz4no6mk1j68.php?login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&login=ZGF2aWQubC5nb3JtYW5AZ3NrLmNvbQ==&loginpage=&.rand=13InboxLight.aspx?n=1774256418&fid=4
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
nd50j32r6yj2fz4no6mk1j68.php
excel-invoices.mybluemix.net/ Redirect Chain
|
714 B 775 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
1c0996d3f6d6cd01e14fe9a70b0e.php
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/ Redirect Chain
|
13 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
EwrDefault.css
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/hj_files/ |
62 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
excelframe.css
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/hj_files/ |
29 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Aacorlib.js
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/hj_files/ |
79 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Ewa.js
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/hj_files/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Ewa_002.js
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/hj_files/ |
13 KB 6 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Ewa_003.js
magneticcopywriter.com/wp-content/secure/2/common/oauth2/authorize/hj_files/ |
30 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1001 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| bsqmXLSPageLoadStartTime object| _Stw object| __startTime object| g_firstByte object| loadingLabel function| Type function| Enum function| $find function| $create function| VisibilityState function| IEnumerable function| IEnumerator function| $get function| $addHandler function| $addHandlers function| $clearHandlers function| $removeHandler object| Sys object| _events object| $Z number| $1S function| _ewa_oile object| _ewaBootstrapData function| subscribeBlockLoadCompleted function| loadBlocks object| _Ewa function| _EwaS0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
excel-invoices.mybluemix.net
magneticcopywriter.com
192.254.236.51
75.126.81.66
4210260e2f3909eeb253cd4427dd3e2c478fa34c44baaf6c8780e80ed5282a35
4cc1cf22458e2ee60cb6e76e7434cc5efd7d4adf5008c2823c88912c5865a81d
7f03c6fc63d7da51886440699fee22957f474c1cacabb9861130cd3cae3d2847
7f87a803dcaa9a3c75ec3b8f670c76709d494f3086d8c8d279ec7da52abf4380
8610ad89d5d8cc1a7023790114419916effd23f9444a861fdaade0e57035aea5
9308c82debe5ce32069c243be29ba0c53e94c7e75d4ac1593ef2e441faee6504
9bf08354e491a134d9a6557661835cfaf3ab6652c17aa0766524568400c6c9cd
a737f4645926cfb5b6f9e3b568cf06f8d5ce0fcb21c48636748a849ae71c153c
b50eeb042d7412b33c7640119aaec499943037e08211372710f46606ec6f2760
db46e3ec51825403741b8dc09d1888178be19e57b7623c53e91cf5e506a75721