getbadassdeals.com Open in urlscan Pro
104.156.48.194 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://getbadassdeals.com/wordfile/dokin/index.php
Submission: On October 02 via manual (October 2nd 2017, 4:59:34 pm UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 104.156.48.194, located in Tampa, United States and belongs to HVC-AS - HIVELOCITY VENTURES CORP, US. The main domain is getbadassdeals.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 14th 2017. Valid for: 3 months.

This is the only time getbadassdeals.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address		AS Autonomous System
9	104.156.48.194 104.156.48.194		29802 (HVC-AS) (HVC-AS - HIVELOCITY VENTURES CORP)
9	1

9 104.156.48.194 (Tampa, United States)

ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US)
PTR: host.floathosting1.com

getbadassdeals.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	getbadassdeals.com getbadassdeals.com	161 KB
9	1

	Domain	Requested by
9	getbadassdeals.com	getbadassdeals.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
getbadassdeals.com Let's Encrypt Authority X3	`2017-09-14` - `2017-12-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://getbadassdeals.com/wordfile/dokin/index.php
Frame ID: 23825.1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

161 kB
Transfer

161 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.php Show response
getbadassdeals.com/wordfile/dokin/ 1 KB
1 KB 773ms
210ms Document
text/html 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to

Full URL

https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache / PHP/5.6.25

Resource Hash

c692fbc634ef1716dd10c0e204428bd83f771c548b0798c507454ac5b69bfb82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:21 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Powered-By: PHP/5.6.25
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
X-XSS-Protection: 1; mode=block

GET
H/1.1 404
Not Found Cookie set style1.css
getbadassdeals.com/wordfile/dokin/ganton_files/ 0
0 2565ms
2533ms Stylesheet
text/html 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to

Full URL

https://getbadassdeals.com/wordfile/dokin/ganton_files/style1.css

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache / PHP/5.6.25

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:21 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Powered-By: PHP/5.6.25
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=UTF-8
Set-Cookie: wfvt_3320712717=59d2706c1c153; expires=Mon, 02-Oct-2017 17:29:24 GMT; Max-Age=1800; path=/; secure; httponly
Cache-Control: no-cache, must-revalidate, max-age=0
Transfer-Encoding: chunked
Connection: Keep-Alive
Link: <https://getbadassdeals.com/wp-json/>; rel="https://api.w.org/"
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK dokin.png
getbadassdeals.com/wordfile/dokin/css/ 131 KB
131 KB 233ms
135ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/dokin.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

84a7be5ae9640c88db2b4661c560eebf99551af05073e9dd1ff3a26e0b44f455

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:21 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 09:27:42 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 134644
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK alin.png
getbadassdeals.com/wordfile/dokin/css/ 1 KB
1 KB 134ms
133ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/alin.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

e769ee4af1c574e9927cafd4f49fcd25bcf546b2d91274fc8df604881316b32f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:22 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 08:22:20 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1285
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK yaya.png
getbadassdeals.com/wordfile/dokin/css/ 2 KB
2 KB 133ms
133ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/yaya.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

4a13c0da84f5aef7d559981d031c52e5edcb020c639b0b004ed37988774e076f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:22 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 08:22:20 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1673
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK gmilo.png
getbadassdeals.com/wordfile/dokin/css/ 2 KB
2 KB 133ms
133ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/gmilo.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

617668933d14c3020205fcbbe9d76dd2cd77fce10e857e34258edea8323f00cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 09:01:42 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 2067
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK itiliki.png
getbadassdeals.com/wordfile/dokin/css/ 440 B
440 B 134ms
134ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/itiliki.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

8b623356ef47a42e3aca4c850fd5d56c8705348100e3278646581220c3d59934

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 08:22:22 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 440
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK fisere.png
getbadassdeals.com/wordfile/dokin/css/ 18 KB
18 KB 135ms
134ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/fisere.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

201252a0397b3970232b33717076c8614187524bda208e0f0d05c48f6eb72825

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 08:22:20 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 18755
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK dadas.png
getbadassdeals.com/wordfile/dokin/css/ 5 KB
5 KB 135ms
135ms Image
image/png 104.156.48.194
HIVELOCITY VENTUR...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://getbadassdeals.com/wordfile/dokin/css/dadas.png

Requested by

Host: getbadassdeals.com
URL: https://getbadassdeals.com/wordfile/dokin/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.156.48.194 Tampa, United States, ASN29802 (HVC-AS - HIVELOCITY VENTURES CORP, US),

Reverse DNS

host.floathosting1.com

Software

Apache /

Resource Hash

d40513b103e484b27c0581d477ca931c1a2fc636f87ca9a4873492e2269bf91c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: getbadassdeals.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://getbadassdeals.com/wordfile/dokin/index.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Mon, 02 Oct 2017 16:59:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Jul 2017 09:13:42 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 4773
X-XSS-Protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			getbadassdeals.com/	2017-10-02 17:29:24	Name: wfvt_3320712717 Value: 59d2706c1c153

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

getbadassdeals.com
104.156.48.194
201252a0397b3970232b33717076c8614187524bda208e0f0d05c48f6eb72825
4a13c0da84f5aef7d559981d031c52e5edcb020c639b0b004ed37988774e076f
617668933d14c3020205fcbbe9d76dd2cd77fce10e857e34258edea8323f00cd
84a7be5ae9640c88db2b4661c560eebf99551af05073e9dd1ff3a26e0b44f455
8b623356ef47a42e3aca4c850fd5d56c8705348100e3278646581220c3d59934
c692fbc634ef1716dd10c0e204428bd83f771c548b0798c507454ac5b69bfb82
d40513b103e484b27c0581d477ca931c1a2fc636f87ca9a4873492e2269bf91c
e769ee4af1c574e9927cafd4f49fcd25bcf546b2d91274fc8df604881316b32f

getbadassdeals.com Open in urlscan Pro 104.156.48.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

161 kBTransfer

161 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

getbadassdeals.com Open in urlscan Pro
104.156.48.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

161 kB
Transfer

161 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!