invercomhn.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 166.62.71.224, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is invercomhn.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 12th 2022. Valid for: a year.

This is the only time invercomhn.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 7	166.62.71.224 166.62.71.224		26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
6	2

7 166.62.71.224 (United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-71-224.ip.secureserver.net

invercomhn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	invercomhn.com 1 redirects invercomhn.com	25 KB
6	1

	Domain	Requested by
7	invercomhn.com	1 redirects invercomhn.com
6	1

This site contains no links.

Subject Issuer	Validity	Valid
invercomhn.com Go Daddy Secure Certificate Authority - G2	`2022-03-12` - `2023-03-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://invercomhn.com/Homelo@/
Frame ID: 8D90ED3B94DA9EA5A05B5654EA171FC5
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home Page

Page URL History Show full URLs

https://invercomhn.com/Homelo@ HTTP 301
https://invercomhn.com/Homelo@/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

25 kB
Transfer

95 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://invercomhn.com/Homelo@ HTTP 301
https://invercomhn.com/Homelo@/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response invercomhn.com/Homelo@/ Redirect Chain https://invercomhn.com/Homelo@ https://invercomhn.com/Homelo@/	31 KB 5 KB	210ms 210ms	Document text/html	166.62.71.224 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://invercomhn.com/Homelo@/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 166.62.71.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-166-62-71-224.ip.secureserver.net Software Apache / Resource Hash `5d284cf89b22e32c005350386d5c5775116a643cd7ab01bf7ec1ae0224d863d8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-encoding br content-length 5035 content-type text/html date Fri, 24 Jun 2022 15:05:07 GMT etag "c560938-7b26-5df3e9d71ca80-br" last-modified Wed, 18 May 2022 00:48:26 GMT server Apache vary Accept-Encoding Redirect headers content-length 239 content-type text/html; charset=iso-8859-1 date Fri, 24 Jun 2022 15:05:06 GMT location https://invercomhn.com/Homelo@/ server Apache
GET H2	200	cass.css invercomhn.com/Homelo@/script/	42 KB 9 KB	193ms 192ms	Stylesheet text/css	166.62.71.224 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://invercomhn.com/Homelo@/script/cass.css Requested by Host: invercomhn.com URL: https://invercomhn.com/Homelo@/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 166.62.71.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-166-62-71-224.ip.secureserver.net Software Apache / Resource Hash `1ba1c6d27de8802fd245b330edc6d03ba3355c9349ea7395ab72a58f99bbccd2` Request headers accept-language de-DE,de;q=0.9 Referer https://invercomhn.com/Homelo@/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Fri, 24 Jun 2022 15:05:07 GMT content-encoding br last-modified Tue, 13 Apr 2021 07:09:08 GMT server Apache etag "c840c31-a8c3-5bfd54e690d00-br" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 8708
GET H2	404	jquery-1.6.1.min.js invercomhn.com/Homelo@/script/	0 0	313ms 312ms	Script text/html	166.62.71.224 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://invercomhn.com/Homelo@/script/jquery-1.6.1.min.js Requested by Host: invercomhn.com URL: https://invercomhn.com/Homelo@/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 166.62.71.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-166-62-71-224.ip.secureserver.net Software Apache / PHP/7.4.29 Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://invercomhn.com/Homelo@/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Fri, 24 Jun 2022 15:05:07 GMT content-encoding br server Apache x-powered-by PHP/7.4.29 content-length 1 vary Accept-Encoding content-type text/html; charset=utf-8
GET H2	200	mail.png invercomhn.com/Homelo@/folder/	3 KB 3 KB	184ms 183ms	Image image/png	166.62.71.224 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Show image Full URL https://invercomhn.com/Homelo@/folder/mail.png Requested by Host: invercomhn.com URL: https://invercomhn.com/Homelo@/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 166.62.71.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-166-62-71-224.ip.secureserver.net Software Apache / Resource Hash `19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208` Request headers accept-language de-DE,de;q=0.9 Referer https://invercomhn.com/Homelo@/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Fri, 24 Jun 2022 15:05:07 GMT last-modified Fri, 03 May 2019 22:15:08 GMT server Apache accept-ranges bytes etag "c58021a-bfa-5880315593300" content-length 3066 content-type image/png
GET H2	200	yahoo_en-US_f_p_bestfit_2x.png invercomhn.com/Homelo@/images/	3 KB 3 KB	183ms 183ms	Image image/png	166.62.71.224 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Show image Full URL https://invercomhn.com/Homelo@/images/yahoo_en-US_f_p_bestfit_2x.png Requested by Host: invercomhn.com URL: https://invercomhn.com/Homelo@/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 166.62.71.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-166-62-71-224.ip.secureserver.net Software Apache / Resource Hash `19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208` Request headers accept-language de-DE,de;q=0.9 Referer https://invercomhn.com/Homelo@/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Fri, 24 Jun 2022 15:05:07 GMT last-modified Tue, 13 Apr 2021 07:05:46 GMT server Apache accept-ranges bytes etag "c5a03d3-bfa-5bfd5425ec680" content-length 3066 content-type image/png
GET H2	200	caso.js Show response invercomhn.com/Homelo@/script/	15 KB 5 KB	190ms 190ms	Script application/javascript	166.62.71.224 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL https://invercomhn.com/Homelo@/script/caso.js Requested by Host: invercomhn.com URL: https://invercomhn.com/Homelo@/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 166.62.71.224 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-166-62-71-224.ip.secureserver.net Software Apache / Resource Hash `59ba7fa766459347638f02c14daace7058ac4767fcb3a67ebfc4f93e539a9e7d` Request headers accept-language de-DE,de;q=0.9 Referer https://invercomhn.com/Homelo@/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Fri, 24 Jun 2022 15:05:07 GMT content-encoding br last-modified Tue, 13 Apr 2021 07:14:52 GMT server Apache etag "c840c30-3ce3-5bfd562ea1300-br" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 4829
GET DATA	200 OK	truncated /	650 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1a540d6790659adf104de6f73b3be7526e1729da358976fa63f366e2ca01c58d` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://invercomhn.com/Homelo@/script/jquery-1.6.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

invercomhn.com
166.62.71.224
19b644434cfa9f5d12e1e90a3c2d062aacf27da9ecbe8393df77383ab3c00208
1a540d6790659adf104de6f73b3be7526e1729da358976fa63f366e2ca01c58d
1ba1c6d27de8802fd245b330edc6d03ba3355c9349ea7395ab72a58f99bbccd2
59ba7fa766459347638f02c14daace7058ac4767fcb3a67ebfc4f93e539a9e7d
5d284cf89b22e32c005350386d5c5775116a643cd7ab01bf7ec1ae0224d863d8

invercomhn.com Open in urlscan Pro 166.62.71.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

25 kBTransfer

95 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

invercomhn.com Open in urlscan Pro
166.62.71.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

25 kB
Transfer

95 kB
Size

0
Cookies

6 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!