www.myschoolresidence.com

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 199.115.125.99, located in Canada and belongs to ECRITEL-FRANCE ISP and web hosting., FR. The main domain is www.myschoolresidence.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 17th 2021. Valid for: 3 months.

This is the only time www.myschoolresidence.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dotloop (Real Estate)

Domain & IP information

	IP Address		AS Autonomous System
6	199.115.125.99 199.115.125.99		8304 (ECRITEL-F...) (ECRITEL-FRANCE ISP and web hosting.)
6	1

6 199.115.125.99 (Canada)

ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR)
PTR: absolu12599.client.ecritel.ca

www.myschoolresidence.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	myschoolresidence.com www.myschoolresidence.com	132 KB
6	1

	Domain	Requested by
6	www.myschoolresidence.com	www.myschoolresidence.com
6	1

This site contains links to these domains. Also see Links.

Domain
auth.dotloop.com
www.dotloop.com

Subject Issuer	Validity	Valid
maresidencesecondaire.ca cPanel, Inc. Certification Authority	`2021-03-17` - `2021-06-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm
Frame ID: 00D12DA747EF75FA5B2C93B47F52B7BD
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

132 kB
Transfer

129 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://auth.dotloop.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.dotloop.com/#/forgotpassword
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.dotloop.com/#/signup
Title: Sign up

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request login.htm Show response
www.myschoolresidence.com/language/Dotloop/Dotloop/ 3 KB
4 KB 427ms
99ms Document
text/html 199.115.125.99
ECRITEL-FRANCE IS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.115.125.99 , Canada, ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR),

Reverse DNS

absolu12599.client.ecritel.ca

Software

Apache /

Resource Hash

e460fd42b5422ba688644941fbeff001ca2540937f9cccacc9924210f5cdef99

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: www.myschoolresidence.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 13:15:58 GMT
Server: Apache
Strict-Transport-Security: max-age=15552000; includeSubDomains
Referrer-Policy: same-origin
Last-Modified: Mon, 26 Aug 2019 15:23:56 GMT
Accept-Ranges: bytes
Content-Length: 3367
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK main.css
www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/ 16 KB
17 KB 99ms
99ms Stylesheet
text/css 199.115.125.99
ECRITEL-FRANCE IS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/main.css

Requested by

Host: www.myschoolresidence.com
URL: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.115.125.99 , Canada, ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR),

Reverse DNS

absolu12599.client.ecritel.ca

Software

Apache /

Resource Hash

cb22b845c160068b8ffec05cb007c8f3dd1667e5fb4f31ada58c44510cae555e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 13:15:58 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Referrer-Policy: same-origin
Last-Modified: Tue, 09 Jul 2019 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
X-XSS-Protection: 1; mode=block
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16484
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK logo.png
www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/ 2 KB
3 KB 293ms
97ms Image
image/png 199.115.125.99
ECRITEL-FRANCE IS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/logo.png

Requested by

Host: www.myschoolresidence.com
URL: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.115.125.99 , Canada, ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR),

Reverse DNS

absolu12599.client.ecritel.ca

Software

Apache /

Resource Hash

ab8298ef975e6a1c2fbd7824a5f30b8183b0fd037cc218ce60be083b61ad99ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 13:15:58 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Referrer-Policy: same-origin
Last-Modified: Tue, 09 Jul 2019 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
X-XSS-Protection: 1; mode=block
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2386
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK jquery-3.js Show response
www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/ 85 KB
85 KB 290ms
98ms Script
application/javascript 199.115.125.99
ECRITEL-FRANCE IS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/jquery-3.js

Requested by

Host: www.myschoolresidence.com
URL: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.115.125.99 , Canada, ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR),

Reverse DNS

absolu12599.client.ecritel.ca

Software

Apache /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 13:15:58 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Referrer-Policy: same-origin
Last-Modified: Tue, 09 Jul 2019 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 86709
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK jquery.js Show response
www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/ 22 KB
23 KB 289ms
97ms Script
application/javascript 199.115.125.99
ECRITEL-FRANCE IS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/jquery.js

Requested by

Host: www.myschoolresidence.com
URL: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.115.125.99 , Canada, ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR),

Reverse DNS

absolu12599.client.ecritel.ca

Software

Apache /

Resource Hash

aa1d80cdf0990e97a21069ab16c048ef90a35df1165b87d19accabd7c4edc860

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 13:15:58 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Referrer-Policy: same-origin
Last-Modified: Tue, 09 Jul 2019 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 22688
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK signin.js Show response
www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/ 392 B
836 B 288ms
96ms Script
application/javascript 199.115.125.99
ECRITEL-FRANCE IS...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myschoolresidence.com/language/Dotloop/Dotloop/login_files/signin.js

Requested by

Host: www.myschoolresidence.com
URL: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

199.115.125.99 , Canada, ASN8304 (ECRITEL-FRANCE ISP and web hosting., FR),

Reverse DNS

absolu12599.client.ecritel.ca

Software

Apache /

Resource Hash

cdb0d57a07eb293ba94806b21ec5a3166f5d633964161ea7db433413bbc591c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.myschoolresidence.com/language/Dotloop/Dotloop/login.htm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 13:15:58 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Referrer-Policy: same-origin
Last-Modified: Tue, 09 Jul 2019 00:35:30 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
X-XSS-Protection: 1; mode=block
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 392
X-Content-Type-Options: nosniff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dotloop (Real Estate)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.myschoolresidence.com
199.115.125.99
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
aa1d80cdf0990e97a21069ab16c048ef90a35df1165b87d19accabd7c4edc860
ab8298ef975e6a1c2fbd7824a5f30b8183b0fd037cc218ce60be083b61ad99ed
cb22b845c160068b8ffec05cb007c8f3dd1667e5fb4f31ada58c44510cae555e
cdb0d57a07eb293ba94806b21ec5a3166f5d633964161ea7db433413bbc591c1
e460fd42b5422ba688644941fbeff001ca2540937f9cccacc9924210f5cdef99

www.myschoolresidence.com Open in urlscan Pro 199.115.125.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

132 kBTransfer

129 kBSize

0 Cookies

3 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

www.myschoolresidence.com Open in urlscan Pro
199.115.125.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

132 kB
Transfer

129 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!