urlscan.io logo urlscan.io
SecurityTrails logo

www.plades.eu Open in urlscan Pro
89.46.104.40  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://omnibustechnologies.ca/vendor/s.php
Effective URL: http://www.plades.eu/wp-admin/maint/ec.edu.html
Submission: On March 10 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 89.46.104.40, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is www.plades.eu.
This is the only time www.plades.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 89.46.104.40 31034 (ARUBA-ASN)
6 4
Domain Requested by
2 www.plades.eu www.plades.eu
2 www.google-analytics.com omnibustechnologies.ca
2 omnibustechnologies.ca omnibustechnologies.ca
6 3

This site contains no links.

Subject Issuer Validity Valid
*.google-analytics.com
GTS CA 1O1		 2020-02-12 -
2020-05-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://www.plades.eu/wp-admin/maint/ec.edu.html
Frame ID: 9DCD6C60C7AAB721FE14C0D3A9DFA8D8
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://omnibustechnologies.ca/vendor/s.php Page URL
  2. http://www.plades.eu/wp-admin/maint/ec.edu.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

6
Requests

33 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

48 kB
Transfer

124 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://omnibustechnologies.ca/vendor/s.php Page URL
  2. http://www.plades.eu/wp-admin/maint/ec.edu.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • http://www.google-analytics.com/analytics.js HTTP 307
  • https://www.google-analytics.com/analytics.js
Request Chain 3
  • http://www.google-analytics.com/r/collect?v=1&_v=j81&a=1265577795&t=pageview&_s=1&dl=http%3A%2F%2Fomnibustechnologies.ca%2Fvendor%2Fs.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=2109710574&gjid=1690864291&cid=634763793.1583863817&tid=UA-33662315-1&_gid=1326723026.1583863817&_r=1&z=453760006 HTTP 307
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1265577795&t=pageview&_s=1&dl=http%3A%2F%2Fomnibustechnologies.ca%2Fvendor%2Fs.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=2109710574&gjid=1690864291&cid=634763793.1583863817&tid=UA-33662315-1&_gid=1326723026.1583863817&_r=1&z=453760006

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set s.php
omnibustechnologies.ca/vendor/ 		212 B
718 B 		Document
General
Check archive.org
Download Go to
Full URL
http://omnibustechnologies.ca/vendor/s.php
Protocol
HTTP/1.1
Server
2606:4700:3031::681f:55c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
be6ef747667ff46ea51ffe4b41c3dab000c466e3c807e10112257c994d73897a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Host
omnibustechnologies.ca
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Mar 2020 18:10:16 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d99db694f0f144f805b97aa1b12d8413e1583863815; expires=Thu, 09-Apr-20 18:10:15 GMT; path=/; domain=.omnibustechnologies.ca; HttpOnly; SameSite=Lax
X-Content-Type-Options
nosniff
Vary
Accept-Encoding,User-Agent
X-Server-Cache
false
CF-Cache-Status
DYNAMIC
Server
cloudflare
CF-RAY
571efdd0faf464af-FRA
Content-Encoding
gzip
yn588IfRtpbOyH1wHefkt47Zj0A.js
omnibustechnologies.ca/cdn-cgi/apps/head/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://omnibustechnologies.ca/cdn-cgi/apps/head/yn588IfRtpbOyH1wHefkt47Zj0A.js
Requested by
Host: omnibustechnologies.ca
URL: http://omnibustechnologies.ca/vendor/s.php
Protocol
HTTP/1.1
Server
2606:4700:3031::681f:55c5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cdb83859818bc896b57d8464a539a13e8b055fb987f2502eb5a26f9a1a45498

Request headers

Referer
http://omnibustechnologies.ca/vendor/s.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Mar 2020 18:10:16 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Age
259
CF-RAY
571efdd50e1564af-FRA
Connection
keep-alive
Content-Length
2025
x-amz-id-2
9acVcik13D1Rh9vI2tZvw9rzsdIMJvHDL8vom2ELfd0WFqzwmWkY/BeaplQ+YPkbyYv3XurV/+s=
Last-Modified
Thu, 20 Jul 2017 22:57:37 GMT
Server
cloudflare
ETag
"da86cc62142e797ce718ce84a831fe87"
Vary
Accept-Encoding
x-amz-request-id
B334E6D1D75562D6
Cache-Control
public, max-age=31536000
x-amz-version-id
Lf4EvDb7f.NGTWJzwAlKEzXyitq1r4od
Accept-Ranges
bytes
Content-Type
application/javascript; charset=utf-8
analytics.js
www.google-analytics.com/
Redirect Chain
  • http://www.google-analytics.com/analytics.js
  • https://www.google-analytics.com/analytics.js
44 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: omnibustechnologies.ca
URL: http://omnibustechnologies.ca/vendor/s.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://omnibustechnologies.ca/vendor/s.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 06 Feb 2020 00:21:02 GMT
server
Golfe2
age
5805
date
Tue, 10 Mar 2020 16:33:31 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
18174
expires
Tue, 10 Mar 2020 18:33:31 GMT

Redirect headers

Location
https://www.google-analytics.com/analytics.js
Non-Authoritative-Reason
HSTS
collect
www.google-analytics.com/r/
Redirect Chain
  • http://www.google-analytics.com/r/collect?v=1&_v=j81&a=1265577795&t=pageview&_s=1&dl=http%3A%2F%2Fomnibustechnologies.ca%2Fvendor%2Fs.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&...
  • https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1265577795&t=pageview&_s=1&dl=http%3A%2F%2Fomnibustechnologies.ca%2Fvendor%2Fs.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0...
35 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1265577795&t=pageview&_s=1&dl=http%3A%2F%2Fomnibustechnologies.ca%2Fvendor%2Fs.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=2109710574&gjid=1690864291&cid=634763793.1583863817&tid=UA-33662315-1&_gid=1326723026.1583863817&_r=1&z=453760006
Requested by
Host: omnibustechnologies.ca
URL: http://omnibustechnologies.ca/vendor/s.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://omnibustechnologies.ca/vendor/s.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 10 Mar 2020 18:10:16 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1265577795&t=pageview&_s=1&dl=http%3A%2F%2Fomnibustechnologies.ca%2Fvendor%2Fs.php&ul=en-us&de=UTF-8&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=2109710574&gjid=1690864291&cid=634763793.1583863817&tid=UA-33662315-1&_gid=1326723026.1583863817&_r=1&z=453760006
Non-Authoritative-Reason
HSTS
Primary Request ec.edu.html
www.plades.eu/wp-admin/maint/ 		57 KB
26 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.plades.eu/wp-admin/maint/ec.edu.html
Protocol
HTTP/1.1
Server
89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1030.aruba.it
Software
aruba-proxy /
Resource Hash
10004b85131d90347c3241700b4246922323babc4b373934bfd4a553280dbd56

Request headers

Host
www.plades.eu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://omnibustechnologies.ca/vendor/s.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://omnibustechnologies.ca/vendor/s.php

Response headers

Server
aruba-proxy
Date
Tue, 10 Mar 2020 18:10:18 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Last-Modified
Tue, 10 Mar 2020 17:06:30 GMT
ETag
W/"e5a7-5a083241de3a3"
X-ServerName
ipvsproxy16.ad.aruba.it
Content-Encoding
gzip
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

Referer
http://www.plades.eu/wp-admin/maint/ec.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer
http://www.plades.eu/wp-admin/maint/ec.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

Referer
http://www.plades.eu/wp-admin/maint/ec.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

Referer
http://www.plades.eu/wp-admin/maint/ec.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer
http://www.plades.eu/wp-admin/maint/ec.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
segoeui-regular.ttf
www.plades.eu/owa/auth/15.1.1779/themes/resources/ 		425 B
484 B 		Font
General
Check archive.org
Download Go to
Full URL
http://www.plades.eu/owa/auth/15.1.1779/themes/resources/segoeui-regular.ttf
Requested by
Host: www.plades.eu
URL: http://www.plades.eu/wp-admin/maint/ec.edu.html
Protocol
HTTP/1.1
Server
89.46.104.40 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
webx1030.aruba.it
Software
aruba-proxy /
Resource Hash
61f802670ec21bc2914d612ac5aa7de2457ed1cc42e745d52ce6323f1010c7fe

Request headers

Origin
http://www.plades.eu
Referer
http://www.plades.eu/wp-admin/maint/ec.edu.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-ServerName
ipvsproxy16.ad.aruba.it
Date
Tue, 10 Mar 2020 18:10:19 GMT
Content-Encoding
gzip
Server
aruba-proxy
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff