well-try.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2c0f:f598::4, located in South Africa and belongs to Web4Africa, ZA. The main domain is well-try.com.

This is the only time well-try.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) Office 365 (Online)

Domain & IP information

	IP Address		AS Autonomous System
7	2c0f:f598::4 2c0f:f598::4		327813 (Web4Africa) (Web4Africa)
7	1

7 2c0f:f598::4 (South Africa)

ASN327813 (Web4Africa, ZA)

well-try.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	well-try.com well-try.com	118 KB
7	1

	Domain	Requested by
7	well-try.com	well-try.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://well-try.com/office/new.html
Frame ID: 26300.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

118 kB
Transfer

119 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request new.html Show response well-try.com/office/	5 KB 5 KB	387ms 187ms	Document text/html	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Full URL http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `9777f783fdf3d0133f4272266e5214cc8b1646e3455ab55244e6fabe2dea5944` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Thu, 13 Apr 2017 20:47:30 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5463
GET H/1.1	200 OK	office.png well-try.com/office/	11 KB 11 KB	188ms 188ms	Image image/png	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Show image Full URL http://well-try.com/office/office.png Requested by Host: well-try.com URL: http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `fcacbe9443312a9ae8d582068921b00a14781c675024452286f2a14b0373b12d` Request headers Referer http://well-try.com/office/new.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Tue, 27 Sep 2016 12:47:14 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 10944
GET H/1.1	200 OK	word.png well-try.com/office/	6 KB 6 KB	369ms 187ms	Image image/png	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Show image Full URL http://well-try.com/office/word.png Requested by Host: well-try.com URL: http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `4068f2441ef1e7b31cf1b2f3136f35587b019b03e7e654c7dd0f830296eee8c7` Request headers Referer http://well-try.com/office/new.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Tue, 27 Sep 2016 12:47:36 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 6520
GET H/1.1	200 OK	validation.js Show response well-try.com/office/	97 B 97 B	369ms 187ms	Script application/javascript	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Full URL http://well-try.com/office/validation.js Requested by Host: well-try.com URL: http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `50c7ff69872c51c23a5a9a56e8d3605822f954bc91905a0c4e1e6679bf160cb4` Request headers Referer http://well-try.com/office/new.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Tue, 27 Sep 2016 12:47:18 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 97
GET H/1.1	200 OK	officelog.png well-try.com/office/	63 KB 63 KB	368ms 187ms	Image image/png	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Show image Full URL http://well-try.com/office/officelog.png Requested by Host: well-try.com URL: http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `d8747ec2f7f2781e5544af558f8a56bd18bbe9f50579d7efba243d109d66f31c` Request headers Referer http://well-try.com/office/new.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Tue, 27 Sep 2016 12:47:34 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 65015
GET H/1.1	200 OK	bac.jpg well-try.com/office/	32 KB 32 KB	370ms 188ms	Image image/jpeg	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Show image Full URL http://well-try.com/office/bac.jpg Requested by Host: well-try.com URL: http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `3f2e29d6e4c9b6817cc4e3ffe11cfe3a65119002ec63cfffd84ae3b124727e93` Request headers Referer http://well-try.com/office/new.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Tue, 27 Sep 2016 12:47:26 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 33222
GET H/1.1	200 OK	mmm.html well-try.com/office/	570 B 0	367ms 185ms	Image text/html	2c0f:f598::4 Web4Africa
General Check archive.org Show headers Download Go to Show image Full URL http://well-try.com/office/mmm.html Requested by Host: well-try.com URL: http://well-try.com/office/new.html Protocol HTTP/1.1 Server 2c0f:f598::4 , South Africa, ASN327813 (Web4Africa, ZA), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://well-try.com/office/new.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.101 Safari/537.36 Response headers Date Wed, 23 Aug 2017 22:13:36 GMT Last-Modified Tue, 27 Sep 2016 12:47:10 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 570

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) Office 365 (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

well-try.com
2c0f:f598::4
3f2e29d6e4c9b6817cc4e3ffe11cfe3a65119002ec63cfffd84ae3b124727e93
4068f2441ef1e7b31cf1b2f3136f35587b019b03e7e654c7dd0f830296eee8c7
50c7ff69872c51c23a5a9a56e8d3605822f954bc91905a0c4e1e6679bf160cb4
9777f783fdf3d0133f4272266e5214cc8b1646e3455ab55244e6fabe2dea5944
d8747ec2f7f2781e5544af558f8a56bd18bbe9f50579d7efba243d109d66f31c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcacbe9443312a9ae8d582068921b00a14781c675024452286f2a14b0373b12d

well-try.com Open in urlscan Pro 2c0f:f598::4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

118 kBTransfer

119 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

well-try.com Open in urlscan Pro
2c0f:f598::4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

118 kB
Transfer

119 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!