procommwa-pdf-files.weebly.com
Open in
urlscan Pro
199.34.228.53
Malicious Activity!
Public Scan
Effective URL: https://procommwa-pdf-files.weebly.com/
Submission: On December 18 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on November 22nd 2021. Valid for: a year.
This is the only time procommwa-pdf-files.weebly.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 199.34.228.53 199.34.228.53 | 27647 (WEEBLY) (WEEBLY) | |
11 | 2a04:4e42:200... 2a04:4e42:200::302 | 54113 (FASTLY) (FASTLY) | |
4 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 162.241.67.24 162.241.67.24 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 52.40.76.192 52.40.76.192 | 16509 (AMAZON-02) (AMAZON-02) | |
32 | 8 |
ASN27647 (WEEBLY, US)
PTR: pages-wildcard-1.weebly.com
procommwa-pdf-files.weebly.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-67-24.unifiedlayer.com
nezabellecosmetics.net |
ASN15169 (GOOGLE, US)
ssl.google-analytics.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-76-192.us-west-2.compute.amazonaws.com
ec.editmysite.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
editmysite.com
cdn2.editmysite.com ec.editmysite.com |
403 KB |
7 |
weebly.com
1 redirects
procommwa-pdf-files.weebly.com |
38 KB |
5 |
nezabellecosmetics.net
nezabellecosmetics.net |
484 KB |
5 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
36 KB |
2 |
gstatic.com
fonts.gstatic.com |
43 KB |
1 |
google-analytics.com
ssl.google-analytics.com |
17 KB |
32 | 6 |
Domain | Requested by | |
---|---|---|
11 | cdn2.editmysite.com |
procommwa-pdf-files.weebly.com
ajax.googleapis.com |
7 | procommwa-pdf-files.weebly.com |
1 redirects
procommwa-pdf-files.weebly.com
ajax.googleapis.com |
5 | nezabellecosmetics.net |
procommwa-pdf-files.weebly.com
nezabellecosmetics.net |
4 | fonts.googleapis.com |
procommwa-pdf-files.weebly.com
|
2 | ec.editmysite.com |
cdn2.editmysite.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | ssl.google-analytics.com |
procommwa-pdf-files.weebly.com
|
1 | ajax.googleapis.com |
procommwa-pdf-files.weebly.com
|
32 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
nezabellecosmetics.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.weeblysite.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-11-22 - 2022-11-17 |
a year | crt.sh |
*.editmysite.com GlobalSign Atlas R3 DV TLS CA 2020 |
2021-05-10 - 2022-06-11 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
nezabellecosmetics.net R3 |
2021-12-12 - 2022-03-12 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-11-29 - 2022-02-21 |
3 months | crt.sh |
ec.editmysite.com Amazon |
2021-08-11 - 2022-09-09 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://procommwa-pdf-files.weebly.com/
Frame ID: 009F9B547AA0E0BF1DFA5385B5888F0A
Requests: 26 HTTP requests in this frame
Frame:
https://nezabellecosmetics.net/aa/activation/Office/index2.php
Frame ID: DED66C7F1175C04F7F47343864968216
Requests: 5 HTTP requests in this frame
Screenshot
Page Title
HomePage URL History Show full URLs
-
http://procommwa-pdf-files.weebly.com/
HTTP 301
https://procommwa-pdf-files.weebly.com/ Page URL
Detected technologies
Weebly (CMS) ExpandDetected patterns
- cdn\d+\.editmysite\.com
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Office 365 Encryption
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://procommwa-pdf-files.weebly.com/
HTTP 301
https://procommwa-pdf-files.weebly.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
procommwa-pdf-files.weebly.com/ Redirect Chain
|
19 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sites.css
cdn2.editmysite.com/css/ |
210 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fancybox.css
cdn2.editmysite.com/css/old/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-icons.css
cdn2.editmysite.com/css/ |
13 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main_style.css
procommwa-pdf-files.weebly.com/files/ |
51 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 1001 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 648 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 701 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
362 B 360 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
templateArtifacts.js
procommwa-pdf-files.weebly.com/files/ |
7 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.8.3/ |
91 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
stl.js
cdn2.editmysite.com/js/lang/en/ |
173 KB 31 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
cdn2.editmysite.com/js/site/ |
466 KB 143 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme-plugins.js
cdn2.editmysite.com/js/site/ |
12 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-toast-published-image-1.png
cdn2.editmysite.com/images/site/footer/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footerSignup.js
cdn2.editmysite.com/js/site/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
plugins.js
procommwa-pdf-files.weebly.com/files/theme/ |
75 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
procommwa-pdf-files.weebly.com/files/theme/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-customer-accounts-site.js
cdn2.editmysite.com/js/site/ |
521 KB 155 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index2.php
nezabellecosmetics.net/aa/activation/Office/ Frame DED6 |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ |
23 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ |
19 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
ssl.google-analytics.com/ |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
snowday262.js
cdn2.editmysite.com/js/wsnbn/ |
73 KB 25 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-footer-v3.css
cdn2.editmysite.com/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
procommwa-pdf-files.weebly.com/ajax/api/JsonRPC/CustomerAccounts/ |
348 B 630 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
tp2
ec.editmysite.com/com.snowplowanalytics.snowplow/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
tp2
ec.editmysite.com/com.snowplowanalytics.snowplow/ |
2 B 339 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
nezabellecosmetics.net/aa/activation/Office/ Frame DED6 |
473 KB 474 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.svg
nezabellecosmetics.net/aa/activation/Office/ Frame DED6 |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
key.svg
nezabellecosmetics.net/aa/activation/Office/ Frame DED6 |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.svg
nezabellecosmetics.net/aa/activation/Office/ Frame DED6 |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)70 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| Weebly string| STATIC_BASE string| ASSETS_BASE string| STYLE_PREFIX function| $ function| jQuery object| _W function| publishedWBJP string| RECAPTCHA_PUBLIC_KEY string| INVISIBLE_RECAPTCHA_PUBLIC_KEY function| _ object| Mustache object| jQBrowser function| PlatformElement function| whenThemeCSSLoaded function| isThemeCSSLoaded function| blogCommentDisplayForm object| YTPlayer object| VimeoPlayer function| Sd function| Rd boolean| Cd function| videojs function| _V_ object| jsonrpc function| getCartCount function| getCartNavElement function| reportCartNavElement function| initPublishedFlyoutMenus boolean| flyoutMenusRefreshable function| initEditorFlyoutMenus function| refreshNavCondense boolean| disableFlyouts function| FlyoutMenu function| objectify object| mejs function| MediaElement function| MediaElementPlayer function| require function| platformElementRequire function| initCustomerAccountsModels object| initEvt string| com_currentSite string| com_userID function| Hammer object| jQuery18306157726658543554 object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| _gaq object| r function| snPlObR string| s object| regEx object| drSegmentsTag undefined| segmentData object| GlobalSnowplowNamespace function| snowday boolean| lightboxLoaded object| container object| Snowplow object| _gat5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.procommwa-pdf-files.weebly.com/ | Name: is_mobile Value: 0 |
|
procommwa-pdf-files.weebly.com/ | Name: language Value: de |
|
procommwa-pdf-files.weebly.com/ | Name: _snow_ses.54be Value: * |
|
procommwa-pdf-files.weebly.com/ | Name: _snow_id.54be Value: 34187b16-28c2-492e-b721-8e435cfdea12.1639789599.1.1639789599.1639789599.5647a648-11ca-4c6c-a10a-be5eccdf87b1 |
|
ec.editmysite.com/ | Name: sp Value: 4929682b-1854-49b5-b209-94f019a79310 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn2.editmysite.com
ec.editmysite.com
fonts.googleapis.com
fonts.gstatic.com
nezabellecosmetics.net
procommwa-pdf-files.weebly.com
ssl.google-analytics.com
162.241.67.24
199.34.228.53
2a00:1450:4001:809::200a
2a00:1450:4001:812::2003
2a00:1450:4001:812::200a
2a00:1450:4001:831::2008
2a04:4e42:200::302
52.40.76.192
004224d90390c7cd683c2b1911c8ff02da3c2f1dd84db133333f3d704adb7355
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
0f37a756490ca3690c5f021149c8837290570c6e96bd0e5d0d20bcd63615772c
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
162a3eebb385684e99a8b624b77189f9b5c38cb51d1b814c1c3a84fc17c324a7
248f30d8a9a174b51edf4c2bb87751f2b2fb200bf4e5076bbe0c8c23dc37ce05
251a983a1b4b2cc76542aa398ae6b3499978a788860b54a8081d35d7a843303c
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
334e714a1c5ebefb28783d1c809dda2a01b916554121e92067a2e41417cd10a2
44e71aca010aa76e7b8844797b975851ff0f567ca00241128e9df99f2a68c171
482371841902ef73f321b4d806460da882138825d57e70bd6453412e37f23889
548a429f80420726b3f683e96a017efbc35f29dfe24ffed02debb389b7d08f85
580ef6409e067a4ec4a427400c7d6216184869e2da53343df20753cc1f8a46cd
5a630b41e7c3d34392bcb150a5731b6261bc6314d71d5db8407a646af15bf8af
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
648e766bf519673f9a90cc336cbecede80dcbe3419b43d36ecbb25d88f5584a3
7c4ffa992a0526aaa678e8ab9cf20301294514f1d446461b64a369f44fd31c8b
865cb87de9fc4d6530edce21f0103107abae6abe45cabdff2ad9af067b3d8e0a
8a295e631b0d74ebc6b734fdd9a2d5b29653da10a362599b0004ee135c115ce9
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a16df105a4c2f66f83e36051a5d4b3e7399fadc9046f779b7f373a5dc46b2361
a8d273baf15a7710894b533a96f1740239f464f1d5ae61e4aa51eb2c45d46a51
adb97e1bc686c58b4286f1208d2bd969687c6cf3e2fc468697dfd956d260de49
ba97504b136b447bea2ecc59111ba5a63200d2662f92936d0f7c206492b989d8
bd89be5fb679ba96c9599cb6531cd6e3b085ce2865c5fd486b02f8fad3294214
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
c4f595f154c135e6631df3e3a986a1fdebda177a47a91cbb9e645d37a0e03311
e06baca13f25df9c7d684fc1b1fdfbbbb95070a1d5a9cd648632da7bccc90b96
fc16749fe51537684e8cd94d1001a398449cc1e8ada5c8f7f635f51475a8e22c