vpsfile.com Open in urlscan Pro
2606:4700:30::681f:49c8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://vpsfile.com/wp-content/upgrade/60b3d/
Submission: On June 19 via automatic, source openphish (June 19th 2019, 6:04:37 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 8 domains to perform 17 HTTP transactions. The main IP is 2606:4700:30::681f:49c8, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is vpsfile.com.

This is the only time vpsfile.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:30:... 2606:4700:30::681f:49c8	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
17	3

8 2606:4700:30::681f:49c8 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

vpsfile.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

amazon-scama.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	vpsfile.com vpsfile.com	123 KB
1	blogspot.com amazon-scama.blogspot.com
0	getmyconfigplease.com Failed getmyconfigplease.com Failed
0	getmyfreetraffic.com Failed getmyfreetraffic.com Failed
0	setforconfigplease.com Failed setforconfigplease.com Failed
0	somelandingpage.com Failed somelandingpage.com Failed
0	setforspecialdomain.com Failed setforspecialdomain.com Failed
0	Failed function sub() { [native code] }. Failed
17	8

	Domain	Requested by
8	vpsfile.com	vpsfile.com
1	amazon-scama.blogspot.com	vpsfile.com
0	getmyconfigplease.com Failed	vpsfile.com
0	getmyfreetraffic.com Failed	vpsfile.com
0	setforconfigplease.com Failed	vpsfile.com
0	somelandingpage.com Failed	vpsfile.com
0	setforspecialdomain.com Failed	vpsfile.com
0	_ Failed	vpsfile.com
17	8

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.googleusercontent.com Google Internet Authority G3	`2019-05-21` - `2019-08-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://vpsfile.com/wp-content/upgrade/60b3d/
Frame ID: B57D56C2D737649FC35A1F4106DBF90A
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

17
Requests

6 %
HTTPS

100 %
IPv6

8
Domains

8
Subdomains

3
IPs

3
Countries

123 kB
Transfer

534 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://css.developmyredflag.top/pjquery.min.js?style=trim& HTTP 301
http://_/pjquery.min.js?style=trim&

Request Chain 1

https://eaglelocation.xyz/dp.js& HTTP 301
http://_/dp.js&

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response vpsfile.com/wp-content/upgrade/60b3d/	8 KB 2 KB	315ms 308ms	Document text/html	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b4f09cca6dfd3fef984309916a63852993d1db1a3044bb3865640a37a77dfc5b` Request headers Host vpsfile.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d6f94f4b765012d986d71887b15a396491560967461; expires=Thu, 18-Jun-20 18:04:21 GMT; path=/; domain=.vpsfile.com; HttpOnly Server cloudflare CF-RAY 4e976cc7efdec2f9-FRA Content-Encoding gzip
GET		pjquery.min.js _/ Redirect Chain https://css.developmyredflag.top/pjquery.min.js?style=trim& http://_/pjquery.min.js?style=trim&	0 0

GET		dp.js& _/ Redirect Chain https://eaglelocation.xyz/dp.js& http://_/dp.js&	0 0

GET		inherg42t2 setforspecialdomain.com/	0 0

GET		3gGykjDJ somelandingpage.com/	0 0

GET H/1.1	200 OK	style3.css vpsfile.com/wp-content/upgrade/60b3d/style/	168 KB 23 KB	27ms 22ms	Stylesheet text/css	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/style/style3.css Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `bcf1b6c1393473201b637b3d9738fc0ad599a52c7a998379d07ba01d6b75f4a9` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Thu, 10 Jan 2019 22:01:45 GMT Server cloudflare Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 4e976cca4f76c2f9-FRA Expires Wed, 19 Jun 2019 22:04:21 GMT
GET H/1.1	200 OK	style2.css vpsfile.com/wp-content/upgrade/60b3d/style/	39 KB 7 KB	21ms 12ms	Stylesheet text/css	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/style/style2.css Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `f395d4f7e16a56f78b3ebb62ce61a099e8c6f909bfae191927a20a36b5f6256c` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Thu, 10 Jan 2019 22:01:45 GMT Server cloudflare Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 4e976cca5f8dc2f9-FRA Expires Wed, 19 Jun 2019 22:04:21 GMT
GET H/1.1	500 Internal Server Error	style1.css vpsfile.com/wp-content/upgrade/60b3d/styel/	0 0	269ms 260ms	Stylesheet text/html	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/styel/style1.css Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT CF-Cache-Status MISS Server cloudflare Vary Accept-Encoding Content-Type text/html;charset=utf-8 Transfer-Encoding chunked Connection keep-alive CF-RAY 4e976cca5a58d6c1-FRA
GET H/1.1	200 OK	jquery.min.js Show response vpsfile.com/wp-content/upgrade/60b3d/js/	203 KB 47 KB	29ms 21ms	Script application/javascript	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/js/jquery.min.js Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `6bdeff0862704538574b01b747382986cc2cbee5fd6457ea4698d9dfa79c9499` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Mon, 04 Mar 2019 15:03:09 GMT Server cloudflare Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 4e976cca5c8f9716-FRA Expires Wed, 19 Jun 2019 22:04:21 GMT
GET H/1.1	200 OK	jquery.validate.min.js Show response vpsfile.com/wp-content/upgrade/60b3d/js/	81 KB 16 KB	25ms 17ms	Script application/javascript	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/js/jquery.validate.min.js Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `98f0cd445da9d3461ac82d942b77bfb734170c1975165f1ccd358dbcb681bfb2` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Mon, 04 Mar 2019 15:03:09 GMT Server cloudflare Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 4e976cca5ec5d70d-FRA Expires Wed, 19 Jun 2019 22:04:21 GMT
GET H/1.1	200 OK	sire.form.js Show response vpsfile.com/wp-content/upgrade/60b3d/js/	8 KB 1 KB	20ms 12ms	Script application/javascript	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://vpsfile.com/wp-content/upgrade/60b3d/js/sire.form.js Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `5770aab99e33b0e18f73c3a6937e7e02a0858ea03e410e5d36905a13fc0a7537` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Thu, 10 Jan 2019 22:01:45 GMT Server cloudflare Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 4e976cca5bc5c2a9-FRA Expires Wed, 19 Jun 2019 22:04:21 GMT
GET		b3we3grf23 setforconfigplease.com/	0 0

GET		14xBSB getmyfreetraffic.com/	0 0

GET		dBnwdh getmyfreetraffic.com/	0 0

GET		get.php getmyconfigplease.com/	0 0

GET H2	200	/ amazon-scama.blogspot.com/	0 0	189ms 144ms	Image text/html	2a00:1450:4001:820::2001 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://amazon-scama.blogspot.com/ Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/style/style3.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png vpsfile.com/wp-content/upgrade/60b3d/style/img/	26 KB 26 KB	13ms 13ms	Image image/png	2606:4700:30::681f:49c8 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://vpsfile.com/wp-content/upgrade/60b3d/style/img/AmazonUIBaseCSS-sprite_1x-28bd59af93d9b1c745bb0aca4de58763b54df7cf._V2_.png Requested by Host: vpsfile.com URL: http://vpsfile.com/wp-content/upgrade/60b3d/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::681f:49c8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d` Request headers Referer http://vpsfile.com/wp-content/upgrade/60b3d/style/style3.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 19 Jun 2019 18:04:21 GMT CF-Cache-Status HIT Last-Modified Thu, 10 Jan 2019 22:01:45 GMT Server cloudflare Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 4e976ccc388ad6c1-FRA Content-Length 26119 Expires Wed, 19 Jun 2019 22:04:21 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: _
URL: http://_/pjquery.min.js?style=trim&

Domain: _
URL: http://_/dp.js&

Domain: setforspecialdomain.com
URL: https://setforspecialdomain.com/inherg42t2?type=in&frm=scr&

Domain: somelandingpage.com
URL: https://somelandingpage.com/3gGykjDJ?frm=script&_cid=0000000000000

Domain: setforconfigplease.com
URL: https://setforconfigplease.com/b3we3grf23?type=b3&frm=script&_cid=3

Domain: getmyfreetraffic.com
URL: https://getmyfreetraffic.com/14xBSB?frm=script&_cid=78e53b67-f56a-d14b-37f4-f8495a3e5731

Domain: getmyfreetraffic.com
URL: https://getmyfreetraffic.com/dBnwdh?frm=script&_cid=d3dd6230-286b-9d76-853e-0fc75e602b15&1549209895545

Domain: getmyconfigplease.com
URL: https://getmyconfigplease.com/get.php?r=s

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.vpsfile.com/	1970-01-19 10:21:43	Name: __cfduid Value: de42735d98d21dea4d1e96ca9e150ffcc1560967461

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

_
amazon-scama.blogspot.com
getmyconfigplease.com
getmyfreetraffic.com
setforconfigplease.com
setforspecialdomain.com
somelandingpage.com
vpsfile.com
_
getmyconfigplease.com
getmyfreetraffic.com
setforconfigplease.com
setforspecialdomain.com
somelandingpage.com
2606:4700:30::681f:49c8
2a00:1450:4001:820::2001
5770aab99e33b0e18f73c3a6937e7e02a0858ea03e410e5d36905a13fc0a7537
6bdeff0862704538574b01b747382986cc2cbee5fd6457ea4698d9dfa79c9499
98f0cd445da9d3461ac82d942b77bfb734170c1975165f1ccd358dbcb681bfb2
b4f09cca6dfd3fef984309916a63852993d1db1a3044bb3865640a37a77dfc5b
bcf1b6c1393473201b637b3d9738fc0ad599a52c7a998379d07ba01d6b75f4a9
e1283c0339d0393ebf45c02a0b34618f572b82eb5dbda366385498ae01413d3d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f395d4f7e16a56f78b3ebb62ce61a099e8c6f909bfae191927a20a36b5f6256c

vpsfile.com Open in urlscan Pro 2606:4700:30::681f:49c8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

6 %HTTPS

100 %IPv6

8 Domains

8 Subdomains

3 IPs

3 Countries

123 kBTransfer

534 kBSize

1 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

38 JavaScript Global Variables

1 Cookies

Indicators

vpsfile.com Open in urlscan Pro
2606:4700:30::681f:49c8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

6 %
HTTPS

100 %
IPv6

8
Domains

8
Subdomains

3
IPs

3
Countries

123 kB
Transfer

534 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!