energizeamerica.com Open in urlscan Pro
205.134.239.254  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request logona57f.html Show response energizeamerica.com/vu/owa/auth/	98 KB 98 KB	665ms 160ms	Document text/html	205.134.239.254 INMOTION
General Check archive.org Show headers Download Go to Full URL https://energizeamerica.com/vu/owa/auth/logona57f.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 205.134.239.254 , United States, ASN22611 (INMOTION, US), Reverse DNS mail.locmed.com.br Software Apache / Resource Hash 1a17fa66cd26a1e2337376fa6c5118cd8cac4bd861944ddef82b2389c0a3e5a3 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 100405 Content-Type text/html Date Wed, 18 Oct 2023 13:19:44 GMT Keep-Alive timeout=5, max=100 Last-Modified Sat, 14 Oct 2023 20:40:49 GMT Server Apache
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cc200a0f004a86937530535d8036f688f21e7d294959c6c5e6d0c1bb1611d15a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4bede5cf77812a764569aab87e4426ac40e71e302914b6540dd3abd6570819da Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET		segoeui-regular.ttf exchange.vu.lt/owa/auth/15.2.1258/themes/resources/	0 0
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash aafa91c17936c7c9a8a77daf5afb5f0f8d0e141d36161cdde08ee988e6d4d44b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

exchange.vu.lt

URL

https://exchange.vu.lt/owa/auth/15.2.1258/themes/resources/segoeui-regular.ttf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			energizeamerica.com/vu/owa/auth	1969-12-31 23:59:59	Name: cookieTest Value: 1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://energizeamerica.com/vu/owa/auth/logona57f.html Message: Access to font at 'https://exchange.vu.lt/owa/auth/15.2.1258/themes/resources/segoeui-regular.ttf' from origin 'https://energizeamerica.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://exchange.vu.lt/owa/auth/15.2.1258/themes/resources/segoeui-regular.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

energizeamerica.com
exchange.vu.lt
exchange.vu.lt
205.134.239.254
1a17fa66cd26a1e2337376fa6c5118cd8cac4bd861944ddef82b2389c0a3e5a3
4bede5cf77812a764569aab87e4426ac40e71e302914b6540dd3abd6570819da
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
aafa91c17936c7c9a8a77daf5afb5f0f8d0e141d36161cdde08ee988e6d4d44b
cc200a0f004a86937530535d8036f688f21e7d294959c6c5e6d0c1bb1611d15a