highestsocietydesigns.com Open in urlscan Pro
69.49.245.95  Malicious Activity! Public Scan

Submitted URL: http://email.mailgun.gingrapp.com/c/eJxkzE1qwzAQQOHTjHc10vwlWmgREuseY1vYAssViQo9fkm32X7w3hotC4oOOXrV4NRp4GGPFFyeWZUuvMocQlhWoivxZT...
Effective URL: https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
Submission: On November 21 via manual from GB — Scanned from GB

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 2 HTTP transactions. The main IP is 69.49.245.95, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is highestsocietydesigns.com.
TLS certificate: Issued by R3 on November 21st 2022. Valid for: 3 months.
This is the only time highestsocietydesigns.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Intuit (Financial)

Domain & IP information

IP Address AS Autonomous System
1 1 34.86.85.56 396982 (GOOGLE-CL...)
1 1 192.185.131.188 19871 (NETWORK-S...)
1 69.49.245.95 19871 (NETWORK-S...)
1 52.1.22.171 14618 (AMAZON-AES)
2 3
Apex Domain
Subdomains
Transfer
1 easycounter.com
www.easycounter.com — Cisco Umbrella Rank: 366368
577 B
1 highestsocietydesigns.com
highestsocietydesigns.com
1 MB
1 snt.com.gt
snt.com.gt
321 B
1 gingrapp.com
email.mailgun.gingrapp.com — Cisco Umbrella Rank: 948752
318 B
2 4
Domain Requested by
1 www.easycounter.com highestsocietydesigns.com
1 highestsocietydesigns.com
1 snt.com.gt 1 redirects
1 email.mailgun.gingrapp.com 1 redirects
2 4
Subject Issuer Validity Valid
cpanel.highestsocietydesigns.com
R3
2022-11-21 -
2023-02-19
3 months crt.sh
easycounter.com
R3
2022-09-14 -
2022-12-13
3 months crt.sh

This page contains 2 frames:

Primary Page: https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
Frame ID: 60ED47B5BBD9D2BFFEFFF835EFA55E55
Requests: 12 HTTP requests in this frame

Frame: data://truncated
Frame ID: 6DD8F1F9F99B54D8F797CD2DA9D8E6EA
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

QuickBooks Login - Sign in to QuickBooks to manage your business

Page URL History Show full URLs

  1. http://email.mailgun.gingrapp.com/c/eJxkzE1qwzAQQOHTjHc10vwlWmgREuseY1vYAssViQo9fkm32X7w3hotC4oOOXrV4NRp4GGPFF... HTTP 302
    http://snt.com.gt/xml.php?email=adam@cappsie.com HTTP 302
    https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

1446 kB
Transfer

1479 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://email.mailgun.gingrapp.com/c/eJxkzE1qwzAQQOHTjHc10vwlWmgREuseY1vYAssViQo9fkm32X7w3hotC4oOOXrV4NRp4GGPFFyeWZUuvMocQlhWoivxZTFl03koER0ieu89ydV7h9PEt4fc9SuJSrgL0gTsqpVj-znHrZzb01obl-86HHHvvQHdABNgep39zePWAdNvPca2N6CU3y3Qw1arwG6x1l4l_w-e8RP_AgAA___QjjuF HTTP 302
    http://snt.com.gt/xml.php?email=adam@cappsie.com HTTP 302
    https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
highestsocietydesigns.com/wp-images/data/QuickB2022/
Redirect Chain
  • http://email.mailgun.gingrapp.com/c/eJxkzE1qwzAQQOHTjHc10vwlWmgREuseY1vYAssViQo9fkm32X7w3hotC4oOOXrV4NRp4GGPFFyeWZUuvMocQlhWoivxZTFl03koER0ieu89ydV7h9PEt4fc9SuJSrgL0gTsqpVj-znHrZzb01obl-86HHHvvQHdA...
  • http://snt.com.gt/xml.php?email=adam@cappsie.com
  • https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
1 MB
1 MB
Document
General
Full URL
https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
69.49.245.95 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
69-49-245-95.webhostbox.net
Software
Apache /
Resource Hash
b5fc24804d23a6f3b7e34a53fb1d79e64d17f32a28c14ad00befc5dd81f29e62

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
en-GB,en;q=0.9

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 21 Nov 2022 21:21:49 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked

Redirect headers

Connection
Upgrade, Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 21 Nov 2022 21:21:49 GMT
Keep-Alive
timeout=5, max=75
Location
https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
Server
Apache
Upgrade
h2,h2c
counter.php
www.easycounter.com/
298 B
577 B
Script
General
Full URL
https://www.easycounter.com/counter.php?v0yage,intuit
Requested by
Host: highestsocietydesigns.com
URL: https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.1.22.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-22-171.compute-1.amazonaws.com
Software
nginx/1.14.2 /
Resource Hash
74bd7f5840b6c9b765cb39ba8e685a9106b35377b477f4fdea87104005761cf8

Request headers

accept-language
en-GB,en;q=0.9
Referer
https://highestsocietydesigns.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Mon, 21 Nov 2022 21:21:51 GMT
Last-Modified
Mon, 21 Nov 2022 21:21:51 +0000
Server
nginx/1.14.2
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Expires
0
truncated
/
7 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f56397c9087c7b3ae7db0d3bb82e72509b0199473de582b5e150f5ab813dfb08

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
17 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa1d1bc2f0a6e97080c32b4b7e165f8a6ada915096053cea230264285e063adc

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
970 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2e7317ae96b8a80eee681587ec023281d419698e1ec24cb3684fd25449b2a909

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d05f9a2597ad4131cf44dc9eed709ccaa35783d0965725f15fe0a093a34513e5

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
758 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c6c31f15a87e2e3a29f5469a6c8fb4d02ed58b78abc3e677768ea920f50967a4

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
939c6b29184de55f68333beb5fe0b80af8d30815d1f429575029d00bf6e12627

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
9 KB
9 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c8278b56794c389919d388951c5fa4dc07a388e16eb7055d675b0b916acc70e5

Request headers

Referer
Origin
https://highestsocietydesigns.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0a64227a29465d4e11fdbc843caf73309286dab8b414ee12118554a863f62658

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
9 KB
9 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f76664b1313cdfbbf1aeddd340deb2f070ff993bda8bba26395da7a8af6af6fd

Request headers

Referer
Origin
https://highestsocietydesigns.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/
9 KB
9 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
817789f8b4ae153258be7067cb01f30e80b018238d8861ffcf693ae7dc11a696

Request headers

Referer
Origin
https://highestsocietydesigns.com
accept-language
en-GB,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
application/octet-stream
truncated
/ Frame 6DD8
81 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Request headers

accept-language
en-GB,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Intuit (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| savepage_ShadowLoader

0 Cookies

25 Console Messages

Source Level URL
Text
security error URL: https://highestsocietydesigns.com/wp-images/data/QuickB2022/?user=adam@cappsie.com
Message:
Refused to execute script from 'https://www.easycounter.com/counter.php?v0yage,intuit' because its MIME type ('image/png') is not executable.
other warning URL: about:srcdoc(Line 1)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 2)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 5)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 8)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 9)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 11)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 16)
Message:
<link rel=preload> has an invalid `href` value
security error URL: about:srcdoc(Line 16)
Message:
Blocked script execution in 'about:srcdoc' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
security error URL: about:srcdoc(Line 16)
Message:
Blocked script execution in 'about:srcdoc' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.
other warning URL: about:srcdoc(Line 4303)
Message:
<link rel=preload> has an invalid `href` value
other warning URL: about:srcdoc(Line 4303)
Message:
<link rel=preload> has an invalid `href` value