sdash.space - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 192.185.186.99, located in Houston, United States and belongs to CYRUSONE - CyrusOne LLC, US. The main domain is sdash.space.

This is the only time sdash.space was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.108.44.94 104.108.44.94	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 6	192.185.186.99 192.185.186.99	20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	2

1 104.108.44.94 (Amsterdam, Netherlands) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-44-94.deploy.static.akamaitechnologies.com

masterpiecestagingandesign.us11.list-manage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 192.185.186.99 (Houston, United States) 1 redirects

ASN20013 (CYRUSONE - CyrusOne LLC, US)
PTR: 192-185-186-99.unifiedlayer.com

sdash.space	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	sdash.space 1 redirects sdash.space	17 KB
1	sitepoint.com www.sitepoint.com	6 KB
1	list-manage.com 1 redirects masterpiecestagingandesign.us11.list-manage.com	463 B
6	3

	Domain	Requested by
6	sdash.space	1 redirects sdash.space
1	www.sitepoint.com	sdash.space
1	masterpiecestagingandesign.us11.list-manage.com	1 redirects
6	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999
Frame ID: (C810212C675C41A55B717EC32A23DBE1)
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://masterpiecestagingandesign.us11.list-manage.com/track/click?u=88faa0c763e696ac103236526&id=455e8c0180&e=d2a32dc2c0 HTTP 302
http://sdash.space/?utm_source=Realtors&utm_campaign=ac455900e1-EMAIL_CAMPAIGN_2018_02_03&utm_m... HTTP 302
http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

22 kB
Transfer

33 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://masterpiecestagingandesign.us11.list-manage.com/track/click?u=88faa0c763e696ac103236526&id=455e8c0180&e=d2a32dc2c0 HTTP 302
http://sdash.space/?utm_source=Realtors&utm_campaign=ac455900e1-EMAIL_CAMPAIGN_2018_02_03&utm_medium=email&utm_term=0_1c489bd366-ac455900e1-251193297 HTTP 302
http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response sdash.space/ Redirect Chain https://masterpiecestagingandesign.us11.list-manage.com/track/click?u=88faa0c763e696ac103236526&id=455e8c0180&e=d2a32dc2c0 http://sdash.space/?utm_source=Realtors&utm_campaign=ac455900e1-EMAIL_CAMPAIGN_2018_02_03&utm_medium=email&utm_term=0_1c489bd366-ac455900e1-251193297 http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999	3 KB 2 KB	221ms 221ms	Document text/html	192.185.186.99 CyrusOne LLC
General Check archive.org Show headers Download Go to Full URL http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Protocol HTTP/1.1 Server 192.185.186.99 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS 192-185-186-99.unifiedlayer.com Software nginx/1.12.2 / Resource Hash `9139c211c455c74cf3c0d545303a112492a6724df4c8fa54f63262cfeaeaccec` Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host sdash.space Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Feb 2018 00:01:01 GMT Content-Encoding gzip Server nginx/1.12.2 Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers location login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Date Sun, 04 Feb 2018 00:01:00 GMT Server nginx/1.12.2 Connection keep-alive Content-Length 0 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	MaskedPassword.js Show response www.sitepoint.com/examples/password/MaskedPassword/	17 KB 6 KB	797ms 197ms	Script application/javascript	54.148.84.95 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js Requested by Host: sdash.space URL: http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Protocol HTTP/1.1 Server 54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-148-84-95.us-west-2.compute.amazonaws.com Software Apache/2.2.22 (Debian) / Resource Hash `2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825` Request headers Referer http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Fri, 02 Feb 2018 21:15:55 GMT Content-Encoding gzip X-Cache-Lookup HIT from ip-172-31-20-20.us-west-2.compute.internal:3128 Last-Modified Fri, 15 Oct 2010 00:03:45 GMT Server Apache/2.2.22 (Debian) Age 2422 ETag "680936-4208-4929c8f629a40" Vary Accept-Encoding X-Cache HIT from ip-172-31-20-20.us-west-2.compute.internal Content-Type application/javascript Accept-Ranges bytes Content-Length 5767
GET H/1.1	200 OK	q1.png sdash.space/images/	9 KB 10 KB	145ms 127ms	Image image/png	192.185.186.99 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://sdash.space/images/q1.png Requested by Host: sdash.space URL: http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Protocol HTTP/1.1 Server 192.185.186.99 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS 192-185-186-99.unifiedlayer.com Software nginx/1.12.2 / Resource Hash `288004e84f65e89f924a995c5c068a5cdebada490e6aa9cbe146188d0b5111a4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sdash.space User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Connection keep-alive Cache-Control no-cache Referer http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Feb 2018 00:01:01 GMT Last-Modified Fri, 11 Aug 2017 09:37:28 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 9525 Content-Type image/png
GET H/1.1	200 OK	q2.png sdash.space/images/	2 KB 3 KB	321ms 321ms	Image image/png	192.185.186.99 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://sdash.space/images/q2.png Requested by Host: sdash.space URL: http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Protocol HTTP/1.1 Server 192.185.186.99 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS 192-185-186-99.unifiedlayer.com Software nginx/1.12.2 / Resource Hash `4317eb66598a65475130ed1eb6784e7c1e04b59a1c761e7a8aeed63a4847a2c1` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sdash.space User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Connection keep-alive Cache-Control no-cache Referer http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Feb 2018 00:01:01 GMT Last-Modified Fri, 11 Aug 2017 09:37:46 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 2515 Content-Type image/png
GET H/1.1	200 OK	q3.png sdash.space/images/	1 KB 2 KB	132ms 131ms	Image image/png	192.185.186.99 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://sdash.space/images/q3.png Requested by Host: sdash.space URL: http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Protocol HTTP/1.1 Server 192.185.186.99 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS 192-185-186-99.unifiedlayer.com Software nginx/1.12.2 / Resource Hash `2237a55457e4fbd39a72f3947b8bc81c87b6469089e804a7434bae596b3337a3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sdash.space User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Connection keep-alive Cache-Control no-cache Referer http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Feb 2018 00:01:01 GMT Last-Modified Fri, 11 Aug 2017 09:44:52 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 1320 Content-Type image/png
GET H/1.1	200 OK	loggn.png sdash.space/images/	811 B 1 KB	123ms 123ms	Image image/png	192.185.186.99 CyrusOne LLC
General Check archive.org Show headers Download Go to Show image Full URL http://sdash.space/images/loggn.png Requested by Host: sdash.space URL: http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Protocol HTTP/1.1 Server 192.185.186.99 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US), Reverse DNS 192-185-186-99.unifiedlayer.com Software nginx/1.12.2 / Resource Hash `044af914c21dc62db25a7e4f579de7661a9726b3ea8cb84d672052a8806adf05` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host sdash.space User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 Connection keep-alive Cache-Control no-cache Referer http://sdash.space/login.php?cmd=login_submit&id=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999&session=7f998b8b0c9978d6c045beb758a039997f998b8b0c9978d6c045beb758a03999 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 04 Feb 2018 00:01:01 GMT Last-Modified Fri, 11 Aug 2017 09:38:22 GMT Server nginx/1.12.2 Connection keep-alive Accept-Ranges bytes Content-Length 811 Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| MaskedPassword function| unhideBody

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

masterpiecestagingandesign.us11.list-manage.com
sdash.space
www.sitepoint.com
104.108.44.94
192.185.186.99
54.148.84.95
044af914c21dc62db25a7e4f579de7661a9726b3ea8cb84d672052a8806adf05
2237a55457e4fbd39a72f3947b8bc81c87b6469089e804a7434bae596b3337a3
288004e84f65e89f924a995c5c068a5cdebada490e6aa9cbe146188d0b5111a4
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
4317eb66598a65475130ed1eb6784e7c1e04b59a1c761e7a8aeed63a4847a2c1
9139c211c455c74cf3c0d545303a112492a6724df4c8fa54f63262cfeaeaccec

sdash.space Open in urlscan Pro 192.185.186.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

22 kBTransfer

33 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

sdash.space Open in urlscan Pro
192.185.186.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

22 kB
Transfer

33 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!