northcountyluxuryrealestate.com Open in urlscan Pro
2606:4700:3030::ac43:ce1d  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set bizmail.php Show response northcountyluxuryrealestate.com/css/excelz/	1 KB 1 KB	61ms 41ms	Document text/html	2606:4700:3030::ac43:ce1d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://northcountyluxuryrealestate.com/css/excelz/bizmail.php Protocol HTTP/1.1 Server 2606:4700:3030::ac43:ce1d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 88982a2a6feb853832b66cf814f5738fe5f45f761c8766c4d8e59c35d03c581b Request headers Host northcountyluxuryrealestate.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 23 Mar 2021 00:25:25 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d7e4384093031f321821632c4d4f564b41616459125; expires=Thu, 22-Apr-21 00:25:25 GMT; path=/; domain=.northcountyluxuryrealestate.com; HttpOnly; SameSite=Lax CF-Cache-Status DYNAMIC cf-request-id 08fe11ea2000004e07d301f000000001 Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GtzVz74fPQSFb3hgxs1iaku7ZzvySwzv%2BGG%2FiZLy23L9fnshx%2FuWW3jLTqTPdrlKVWi2Rdp77PjaqJIB38mbnb67Kv8WCLUvLLj2xf7o%2FzU4Z5Hw8aIGoA3uK3agjtnYtfBXuhHcdnI7FCQJ"}],"group":"cf-nel","max_age":604800} NEL {"max_age":604800,"report_to":"cf-nel"} Server cloudflare CF-RAY 634385bd0d594e07-FRA Content-Encoding gzip alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H/1.1	200 OK	styles.css northcountyluxuryrealestate.com/css/excelz/css/	3 KB 2 KB	41ms 40ms	Stylesheet text/css	2606:4700:3030::ac43:ce1d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://northcountyluxuryrealestate.com/css/excelz/css/styles.css Requested by Host: northcountyluxuryrealestate.com URL: http://northcountyluxuryrealestate.com/css/excelz/bizmail.php Protocol HTTP/1.1 Server 2606:4700:3030::ac43:ce1d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 66f05abca65a210dccfffc1c7e444c7e01bfb6f12f9d8bf7a281efb739dea9d7 Request headers Referer http://northcountyluxuryrealestate.com/css/excelz/bizmail.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 23 Mar 2021 00:25:25 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Sun, 31 Mar 2019 16:34:16 GMT Server cloudflare Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=o0ziZmI8vGhcKy8chloag%2BBZZbTmDAwXJSaapbCw2gcfaXQNkFRavzEX3k8cmWjaAKAjKnNykNkrsop9aTtMdcD9uFVqH7BLlAw6wxvOgKTSuW4sQAZRUYVuUlKtHed6qkyHGxSckv3oBZSy"}],"group":"cf-nel","max_age":604800} Content-Type text/css alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 634385bd4da54e07-FRA NEL {"max_age":604800,"report_to":"cf-nel"} cf-request-id 08fe11ea4f00004e0765a12000000001
GET H/1.1	200 OK	ex.png northcountyluxuryrealestate.com/css/excelz/img/	8 KB 9 KB	52ms 47ms	Image image/png	2606:4700:3030::ac43:ce1d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://northcountyluxuryrealestate.com/css/excelz/img/ex.png Requested by Host: northcountyluxuryrealestate.com URL: http://northcountyluxuryrealestate.com/css/excelz/bizmail.php Protocol HTTP/1.1 Server 2606:4700:3030::ac43:ce1d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4 Request headers Referer http://northcountyluxuryrealestate.com/css/excelz/bizmail.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 23 Mar 2021 00:25:25 GMT CF-Cache-Status MISS Last-Modified Sun, 31 Mar 2019 16:34:16 GMT Server cloudflare Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4GAchzxkF4UIQ58ApMi95wZdH8k4Mv4WN6QV7ss57M3YAjgrLo2G%2F2SlSKOFMA4D1KB0dR7jJ3Xz0VAFaE6EjIIvbxoCdVGN1BiM1a12gPEQ0kifFbbrWKGFuxObGNUQWeuYU9kGjRa3iRpN"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 NEL {"max_age":604800,"report_to":"cf-nel"} Connection keep-alive Accept-Ranges bytes CF-RAY 634385bd5c501f39-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Content-Length 8180 cf-request-id 08fe11ea5400001f3963083000000001
GET H2	200	css fonts.googleapis.com/	2 KB 607 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=PT+Sans:400,700 Requested by Host: northcountyluxuryrealestate.com URL: http://northcountyluxuryrealestate.com/css/excelz/css/styles.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 089822305b9af8e8bf8797060fa68e6d18068b4fd7e8938f30b125ab6f61a2b9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer http://northcountyluxuryrealestate.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 22 Mar 2021 23:45:13 GMT server ESF date Tue, 23 Mar 2021 00:25:25 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 23 Mar 2021 00:25:25 GMT
GET H/1.1	200 OK	pdf.png northcountyluxuryrealestate.com/css/excelz/img/	73 KB 74 KB	53ms 52ms	Image image/png	2606:4700:3030::ac43:ce1d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://northcountyluxuryrealestate.com/css/excelz/img/pdf.png Requested by Host: northcountyluxuryrealestate.com URL: http://northcountyluxuryrealestate.com/css/excelz/css/styles.css Protocol HTTP/1.1 Server 2606:4700:3030::ac43:ce1d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf Request headers Referer http://northcountyluxuryrealestate.com/css/excelz/css/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Tue, 23 Mar 2021 00:25:25 GMT CF-Cache-Status MISS Last-Modified Sun, 31 Mar 2019 16:34:16 GMT Server cloudflare Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1Tn%2F3skSIcFVI4q5epU%2FckXI9JFuZhmKSJhGpbVWGpTBcHNdVJF423O2IK4Bs0RrzGS2VhWDpjl3gN2TcrjBh0QHm0UbV8el%2BS8vDpXNUKAsN5oasQxmYmePZ6nNodww35UCLe6U995UiWuJ"}],"group":"cf-nel","max_age":604800} Content-Type image/png Cache-Control max-age=14400 NEL {"max_age":604800,"report_to":"cf-nel"} Connection keep-alive Accept-Ranges bytes CF-RAY 634385bdac911f39-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Content-Length 74994 cf-request-id 08fe11ea8b00001f39b5130000000001
GET H2	200	jizfRExUiTo99u79B_mh0O6tLQ.woff2 fonts.gstatic.com/s/ptsans/v12/	46 KB 46 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:80e::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ptsans/v12/jizfRExUiTo99u79B_mh0O6tLQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://northcountyluxuryrealestate.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 22 Mar 2021 18:13:58 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:10:11 GMT server sffe age 22287 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46988 x-xss-protection 0 expires Tue, 22 Mar 2022 18:13:58 GMT
GET H2	200	jizaRExUiTo99u79D0KExQ.woff2 fonts.gstatic.com/s/ptsans/v12/	44 KB 44 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:80e::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/ptsans/v12/jizaRExUiTo99u79D0KExQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=PT+Sans:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin http://northcountyluxuryrealestate.com Referer https://fonts.googleapis.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 22 Mar 2021 18:34:27 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:09:20 GMT server sffe age 21058 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45416 x-xss-protection 0 expires Tue, 22 Mar 2022 18:34:27 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.northcountyluxuryrealestate.com/	1970-01-19 17:44:11	Name: __cfduid Value: d7e4384093031f321821632c4d4f564b41616459125

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
northcountyluxuryrealestate.com
2606:4700:3030::ac43:ce1d
2a00:1450:4001:80e::2003
2a00:1450:4001:810::200a
089822305b9af8e8bf8797060fa68e6d18068b4fd7e8938f30b125ab6f61a2b9
1e93b530a651320569bb9a1e5afdefa40ef6a77f7d1887a27cb4f5cc049b57a3
5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4
66f05abca65a210dccfffc1c7e444c7e01bfb6f12f9d8bf7a281efb739dea9d7
88982a2a6feb853832b66cf814f5738fe5f45f761c8766c4d8e59c35d03c581b
95dc30d8b40e0bae97c0a41fa52d8d43ef7b66a7de4645c913aa994def62e5dd
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf