leanvc.com
Open in
urlscan Pro
198.12.74.120
Malicious Activity!
Public Scan
URL:
https://leanvc.com/payment_account.html
Submission Tags: @ipnigh
Submission: On May 23 via api from GB
Submission Tags: @ipnigh
Submission: On May 23 via api from GB
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 6 HTTP transactions.
The main IP is 198.12.74.120, located in
Buffalo, United States and
belongs to AS-COLOCROSSING, US.
The main domain is leanvc.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 17th 2020. Valid for: 3 months.
This is the only time leanvc.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 17th 2020. Valid for: 3 months.
This is the only time leanvc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Craigslist (E-commerce)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 6 | 198.12.74.120 198.12.74.120 | 36352 (AS-COLOCR...) (AS-COLOCROSSING) | |
| 6 | 1 |
6
198.12.74.120
(Buffalo, United States)
ASN36352 (AS-COLOCROSSING, US)
PTR: ylh198-12-74-120dal.dmzdns.com
ASN36352 (AS-COLOCROSSING, US)
PTR: ylh198-12-74-120dal.dmzdns.com
| leanvc.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
leanvc.com
leanvc.com |
24 KB |
| 6 | 1 |
| Domain | Requested by | |
|---|---|---|
| 6 | leanvc.com |
leanvc.com
|
| 6 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.craigslist.org |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| leanvc.com cPanel, Inc. Certification Authority |
2020-05-17 - 2020-08-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://leanvc.com/payment_account.html
Frame ID: EEFFB2786E037F7B9816C097BF1697B2
Requests: 6 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
URL: http://www.craigslist.org/
Title: CL
Title: CL
Search URL Search Domain Scan URL
URL: https://www.craigslist.org/about/help/card_verification_number?lang=en&cc=us
Title: ?
Title: ?
Search URL Search Domain Scan URL
URL: https://www.craigslist.org/about/terms.of.use?lang=en&cc=us
Title: Terms of Use
Title: Terms of Use
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
payment_account.html
leanvc.com/ |
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
payment-1.0.1.css
leanvc.com/craigslist%20payment_files/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
amex_logo.png
leanvc.com/craigslist%20payment_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mc_logo.png
leanvc.com/craigslist%20payment_files/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
visa_logo.png
leanvc.com/craigslist%20payment_files/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
payment-1.0.1.js.download
leanvc.com/craigslist%20payment_files/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Craigslist (E-commerce)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
leanvc.com
198.12.74.120
1036615dc7846df6cd4d63b931ba9cd41cd415a4c28572f07932c06af7be2faf
6d55a6b1fb12e04e193940e47e5eff11c9366dfb0af759d24f48aacb3d7c2bd8
6f3edef304bbd0194b42f3cc433dc3749e495002e05c7885d205b17aeb9e1aa9
70f8725ed044a4938c7368f6618ceb76d8c67832e1d3fc62b31ff959dcc5ec76
d9ac88544d75b5aa734b1381a02d911863896626c831c6e206b97de043c20f55
fe30c54ce482017e7d391d5bfb0daf63f1b911a306a753f7302592d673b6e630