www.rules.usa.cc - urlscan.io

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 94.177.253.144, located in Slough, United Kingdom and belongs to ARUBACLOUDLTD-ASN, GB. The main domain is www.rules.usa.cc.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 25th 2018. Valid for: 3 months.

This is the only time www.rules.usa.cc was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	94.177.253.144 94.177.253.144	199883 (ARUBACLOU...) (ARUBACLOUDLTD-ASN)
5	2.19.41.58 2.19.41.58	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	40.101.124.18 40.101.124.18	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
7	3

1 94.177.253.144 (Slough, United Kingdom)

ASN199883 (ARUBACLOUDLTD-ASN, GB)
PTR: host144-253-177-94.static.arubacloud.com

www.rules.usa.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.19.41.58 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-41-58.deploy.static.akamaitechnologies.com

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.101.124.18 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

outlook.office365.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	gfx.ms auth.gfx.ms	82 KB
1	office365.com outlook.office365.com
1	usa.cc www.rules.usa.cc	17 KB
7	3

	Domain	Requested by
5	auth.gfx.ms	www.rules.usa.cc
1	outlook.office365.com	www.rules.usa.cc
1	www.rules.usa.cc
7	3

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com

Subject Issuer	Validity	Valid
rules.usa.cc cPanel, Inc. Certification Authority	`2018-05-25` - `2018-08-23`	3 months	crt.sh
outlook.com DigiCert Cloud Services CA-1	`2017-09-13` - `2018-09-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.rules.usa.cc/me/hotis/step2-authen.php
Frame ID: 62BF740961DABF9C3AF149D6659B7F1A
Requests: 6 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB
Frame ID: DD221D57F06A2C95932FA29BF9D3E278
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

webpack (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

env /^webpackJsonp$/i

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

99 kB
Transfer

304 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.0%26rpsnv%3d13%26ct%3d1479722006%26rver%3d6.4.6456.0%26wp%3dMBI_SSL%26wreply%3dhttps%253a%252f%252foutlook.live.com%252fowa%252f%26lc%3d2057%26id%3d292841%26mkt%3den-gb%26cbcxt%3dout%26fl%3dwld%26contextid%3d3120DC6F591A060F%26bk%3d1479722009&id=292841&uiflavor=web&uaid=2419581f135940218028ecd616c02d58&mkt=EN-GB&lc=2057&bk=1479722009
Title: Forgotten my password

Search URL Search Domain Scan URL

URL: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1479722006&rver=6.4.6456.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f&lc=2057&id=292841&mkt=en-gb&cbcxt=out&fl=wld&contextid=3120DC6F591A060F&ru=https://outlook.live.com/owa/&bk=1479722009&lm=I
Title: Sign in with a different Microsoft account

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-GB&vv=1600
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-GB&vv=1600
Title: Privacy & Cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set step2-authen.php Show response
www.rules.usa.cc/me/hotis/ 17 KB
17 KB 115ms
57ms Document
text/html 94.177.253.144
ARUBACLOUDLTD-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://www.rules.usa.cc/me/hotis/step2-authen.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.177.253.144 Slough, United Kingdom, ASN199883 (ARUBACLOUDLTD-ASN, GB),
Reverse DNS: host144-253-177-94.static.arubacloud.com
Software: Apache /
Resource Hash: 185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995

Request headers

Host: www.rules.usa.cc
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 62BF740961DABF9C3AF149D6659B7F1A

Response headers

Date: Sat, 26 May 2018 08:47:04 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=9b8qv20bsidorfbhq8nh29lcv7; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Default2057.css
auth.gfx.ms/16.000.26754.00.1/ 74 KB
15 KB 21ms
9ms Stylesheet
text/css 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/Default2057.css
Requested by: Host: www.rules.usa.cc
URL: https://www.rules.usa.cc/me/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027

Request headers

Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 26 May 2018 08:47:05 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Nov 2016 09:04:22 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "02f58411f3fd21:0"
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=164636
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14670
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK DefaultLoginPaginatedStrings.EN-GB.js Show response
auth.gfx.ms/16.000.26754.00.1/ 11 KB
4 KB 18ms
6ms Script
application/javascript 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/DefaultLoginPaginatedStrings.EN-GB.js
Requested by: Host: www.rules.usa.cc
URL: https://www.rules.usa.cc/me/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4

Request headers

Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 26 May 2018 08:47:05 GMT
Content-Encoding: gzip
Last-Modified: Tue, 15 Nov 2016 09:11:52 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "0bc904d203fd21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=341638
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3794
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK DefaultLogin_PCore.js Show response
auth.gfx.ms/16.000.26754.00.1/ 190 KB
57 KB 29ms
17ms Script
application/javascript 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.gfx.ms/16.000.26754.00.1/DefaultLogin_PCore.js
Requested by: Host: www.rules.usa.cc
URL: https://www.rules.usa.cc/me/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac

Request headers

Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 26 May 2018 08:47:05 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Nov 2016 17:19:24 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "036f1bdf640d21:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=164627
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK AppCentipede_Microsoft.svg
auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/ 7 KB
3 KB 8ms
8ms Image
image/svg+xml 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.26754.00.1/images/AppCentipede/AppCentipede_Microsoft.svg
Requested by: Host: www.rules.usa.cc
URL: https://www.rules.usa.cc/me/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625

Request headers

Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 26 May 2018 08:47:05 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Oct 2016 12:11:50 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C001 V: 0
ETag: "08785f812ad21:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=114395
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2946
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK Microsoft_Logotype_Gray.svg
auth.gfx.ms/16.000.26754.00.1/images/ 5 KB
3 KB 8ms
8ms Image
image/svg+xml 2.19.41.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.gfx.ms/16.000.26754.00.1/images/Microsoft_Logotype_Gray.svg
Requested by: Host: www.rules.usa.cc
URL: https://www.rules.usa.cc/me/hotis/step2-authen.php
Protocol: HTTP/1.1
Server: 2.19.41.58 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-41-58.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f

Request headers

Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 26 May 2018 08:47:05 GMT
Content-Encoding: gzip
Last-Modified: Wed, 19 Oct 2016 12:11:50 GMT
PPServer: PPV: 30 H: BL2IDSPRTS1C004 V: 0
ETag: "08785f812ad21:0"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=164688
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2160
Server: Microsoft-IIS/8.5

GET
H/1.1 200
OK Cookie set prefetch.aspx
outlook.office365.com/owa/ Frame DD22 0
0 100ms
50ms Document
text/html 40.101.124.18
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL

https://outlook.office365.com/owa/prefetch.aspx?id=292841&mkt=EN-GB

Requested by

Host: www.rules.usa.cc
URL: https://www.rules.usa.cc/me/hotis/step2-authen.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.101.124.18 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Host: outlook.office365.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 62BF740961DABF9C3AF149D6659B7F1A
Referer: https://www.rules.usa.cc/me/hotis/step2-authen.php

Response headers

Cache-Control: private, no-store
Content-Type: text/html
Server: Microsoft-IIS/10.0
request-id: 499849f4-9fac-45d5-9ffa-d39aeeed9728
X-CalculatedFETarget: VI1PR07CU005.internal.outlook.com
X-BackEndHttpStatus: 200 200
Set-Cookie: ClientId=A76BADA3618F46FD90007F97522154B8; expires=Sun, 26-May-2019 08:47:05 GMT; path=/; secure ClientId=A76BADA3618F46FD90007F97522154B8; expires=Sun, 26-May-2019 08:47:05 GMT; path=/; secure OIDC=1; expires=Mon, 26-Nov-2018 08:47:05 GMT; path=/; secure; HttpOnly
X-FEProxyInfo: VI1PR07CA0184.EURPRD07.PROD.OUTLOOK.COM
X-CalculatedBETarget: VI1PR04MB1184.eurprd04.prod.outlook.com
X-RUM-Validated: 1
X-Content-Type-Options: nosniff
X-OWA-Version: 15.20.797.15
X-OWA-DiagnosticsInfo: 2;0;0
X-BackEnd-Begin: 2018-05-26T08:47:05.213
X-BackEnd-End: 2018-05-26T08:47:05.213
X-DiagInfo: VI1PR04MB1184
X-BEServer: VI1PR04MB1184
X-UA-Compatible: IE=EmulateIE7
Strict-Transport-Security: max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-FEServer: VI1PR07CA0184 AM5PR04CA0036
X-Powered-By: ASP.NET
Date: Sat, 26 May 2018 08:47:04 GMT
Content-Length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
outlook.office365.com/	1970-01-18 20:40:22	Name: OIDC Value: 1
outlook.office365.com/	1970-01-19 01:01:00	Name: ClientId Value: A76BADA3618F46FD90007F97522154B8
www.rules.usa.cc/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9b8qv20bsidorfbhq8nh29lcv7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.gfx.ms
outlook.office365.com
www.rules.usa.cc
2.19.41.58
40.101.124.18
94.177.253.144
185cff29d1ed12c007635573c747aa18e5e643b02c69bbde899e196bb11d7995
356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f
8a3aa480509e9e782ec14eb1592d7fc0f68c82b443045751fcdfd051b03029ac
bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625
c582c2fe5f74458f0af90fa1469af95bf4eb88601cc4d017bd7ef5e1b52ffaf4
ca078e9833f067c6e28abe33c37a8ca9565fd02abe961e2ebc227635b1b03027

www.rules.usa.cc Open in urlscan Pro 94.177.253.144 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

29 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

99 kBTransfer

304 kBSize

3 Cookies

4 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

3 Cookies

Indicators

www.rules.usa.cc Open in urlscan Pro
94.177.253.144 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

29 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

99 kB
Transfer

304 kB
Size

3
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!