susanrcordova.com Open in urlscan Pro
66.147.244.94 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://susanrcordova.com/xee/sd/vxl.html
Submission: On September 03 via automatic, source openphish (September 3rd 2017, 9:28:50 am UTC)

Summary HTTP 22 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 22 HTTP transactions. The main IP is 66.147.244.94, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is susanrcordova.com.

This is the only time susanrcordova.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AOL (Online)

Domain & IP information

	IP Address	AS Autonomous System
13	66.147.244.94 66.147.244.94	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
3	2606:2800:233... 2606:2800:233:af6:eab:2108:1892:6d8	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	95.100.248.105 95.100.248.105	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	66.235.148.132 66.235.148.132	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
22	5

13 66.147.244.94 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box794.bluehost.com

susanrcordova.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:2800:233:af6:eab:2108:1892:6d8 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

s.aolcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.100.248.105 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a95-100-248-105.deploy.akamaitechnologies.com

b.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.148.132 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.d2.sc.omtrdc.net

o.sa.aol.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	susanrcordova.com susanrcordova.com b.susanrcordova.com Failed	99 KB
3	aolcdn.com s.aolcdn.com	8 KB
1	aol.com o.sa.aol.com	43 B
1	scorecardresearch.com b.scorecardresearch.com
0	atwola.com Failed at.atwola.com Failed cdn.at.atwola.com Failed
22	5

	Domain	Requested by
13	susanrcordova.com	susanrcordova.com
3	s.aolcdn.com	susanrcordova.com
1	o.sa.aol.com	susanrcordova.com
1	b.scorecardresearch.com	susanrcordova.com
0	b.susanrcordova.com Failed
0	cdn.at.atwola.com Failed	susanrcordova.com
0	at.atwola.com Failed	susanrcordova.com
22	7

This site contains links to these domains. Also see Links.

Domain
help.aol.com
aol.com
help.channels.aol.com
account.aol.com
new.aol.com
www.corp.aol.com
privacy.aol.com
legal.aol.com
adinfo.aol.com
daol.aol.com

Subject Issuer	Validity	Valid
o.aolcdn.com DigiCert SHA2 High Assurance Server CA	`2016-06-29` - `2019-07-10`	3 years	crt.sh

This page contains 4 frames:

Primary Page: http://susanrcordova.com/xee/sd/vxl.html
Frame ID: 27303.1
Requests: 19 HTTP requests in this frame

Frame: https://at.atwola.com/adiframe/3.0/5113.1/221794/0/-1/size=1300x800;noperf=1;alias=93313514;artexc=art_flash,art_rrflash;kvpg=susanrcordova%2Fxee%2Fsd%2Fvxl.html;kvugc=0;kvh5lsid=0;kvmn=93313514;kvgrp=430919380;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=0;grp=430919380
Frame ID: 27303.2
Requests: 1 HTTP requests in this frame

Frame: http://cdn.at.atwola.com/_media/uac/guid.html
Frame ID: 27303.3
Requests: 1 HTTP requests in this frame

Frame: http://cdn.at.atwola.com/_media/uac/tcode3.html
Frame ID: 27303.4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

three.js (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

script /three(?:\.min)?\.js/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

22
Requests

14 %
HTTPS

25 %
IPv6

5
Domains

7
Subdomains

5
IPs

2
Countries

108 kB
Transfer

272 kB
Size

8
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: http://help.aol.com/help/microsites/search.do?cmd=displayKC&docType=kc&externalId=223296
Title: Help article.

Search URL Search Domain Scan URL

URL: http://aol.com/
Title: Aol.

Search URL Search Domain Scan URL

URL: http://help.channels.aol.com/topic.adp?topicId=SG_SignIn
Title: help

Search URL Search Domain Scan URL

URL: https://account.aol.com/account/password/start?sitedomain=sns.webmail.aol.com&authLev=0&siteState=ver%3A4%7Crt%3ASTANDARD%7Cat%3ASNS%7Cld%3Amail.aol.com%7Cuv%3AAOL%7Clc%3Aen-us%7Cmt%3AANGELIA%7Csnt%3AScreenName%7Csid%3A3ae5fec2-cfdb-45fd-a301-be2d5b0c6794&lang=en&locale=us&offerId=newmail-en-us-v2&seamless=novl&r=https%3A%2F%2Fmy.screenname.aol.com%2F_cqr%2Flogin%2Flogin.psp%3Fseamless%3Dnovl%26locale%3Dus%26offerId%3Dnewmail-en-us-v2%26siteState%3Dver%253A4%257Crt%253ASTANDARD%257Cat%253ASNS%257Cld%253Amail.aol.com%257Cuv%253AAOL%257Clc%253Aen-us%257Cmt%253AANGELIA%257Csnt%253AScreenName%257Csid%253A3ae5fec2-cfdb-45fd-a301-be2d5b0c6794%26authLev%3D0%26sitedomain%3Dsns.webmail.aol.com%26lang%3Den&oauth_signature_method=HMAC-SHA1&oauth_consumer_key=redir.aol.com&oauth_timestamp=1424795368&oauth_nonce=3456528452614734&oauth_version=1.0&oauth_signature=m8NUtAaWM%2FYPVwObWL9H06jWOMw%3D%0D%0A
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://new.aol.com/productsweb/?promocode=827692&ncid=txtlnkuswebr00000073
Title: Get a Free Username

Search URL Search Domain Scan URL

URL: http://www.corp.aol.com/
Title: AOL Inc.

Search URL Search Domain Scan URL

URL: http://privacy.aol.com/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://legal.aol.com/TOS
Title: Terms of Service

Search URL Search Domain Scan URL

URL: http://adinfo.aol.com/about-our-ads
Title: About Our Ads

Search URL Search Domain Scan URL

URL: http://daol.aol.com/aolatoz
Title: Site Map

Search URL Search Domain Scan URL

URL: http://help.aol.com/
Title: Help

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request 16

http://b.scorecardresearch.com/b?rn=4867956&C1=2&C2=1000009&C4=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C5=us.snssignin&C7=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C8=AOL%20...
http://b.scorecardresearch.com/b2?rn=4867956&C1=2&C2=1000009&C4=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C5=us.snssignin&C7=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C8=AOL%2...

Request 17

http://o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/s97931388747198?AQB=1&ndh=1&t=3%2F8%2F2017%209%3A28%3A39%200%200&fid=1D2CD2B42B831166-21BD557B82863D8B&ns=aolllc&cl=63072000&pageName=sso%20%3A%20logi...
http://o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/s97931388747198?AQB=1&pccr=true&vidn=2CD5E5A405313492-4000010900016C4A&&ndh=1&t=3%2F8%2F2017%209%3A28%3A39%200%200&fid=1D2CD2B42B831166-21BD557B82863D...

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request vxl.html Show response susanrcordova.com/xee/sd/	17 KB 6 KB	603ms 190ms	Document text/html	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `bc700a83ce0ecfae14b8c18fcb5d8c174f612ebd3d01ea59c8d32971102921d2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:38 GMT Content-Encoding gzip Last-Modified Thu, 25 May 2017 21:24:42 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/html X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 6154 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	one.js Show response susanrcordova.com/xee/sd/	71 KB 28 KB	225ms 225ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/one.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `1adeb9b7455c164e01a88173d356742be2a4b5dc4977f0f64fee5b5d4b38e0b3` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:38 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 01:40:42 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 28661 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	two.js Show response susanrcordova.com/xee/sd/	2 KB 722 B	188ms 187ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/two.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `f034a0a2d70ecbf001844124b32ae4281a5e10c3300215e6e9c727f7e3016673` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:38 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 01:41:50 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 722 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	one.css susanrcordova.com/xee/sd/	5 KB 2 KB	371ms 196ms	Stylesheet text/css	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/one.css Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `3c51c146187d33648403eef72fd3a374667211dc1adb96088bd5319412c31f0b` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 02:08:42 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/css X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 1682 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	two.css susanrcordova.com/xee/sd/	720 B 365 B	384ms 199ms	Stylesheet text/css	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/two.css Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `1671293756c66402b96ad2688ef2bd31043e88bea28946ae84dde34e211a6608` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 02:10:26 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/css X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 365 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	three.css susanrcordova.com/xee/sd/	2 KB 699 B	382ms 194ms	Stylesheet text/css	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/three.css Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `6dd279d1a35abe8af11b61af0236d1e68179bbd8038a292e5fbd6b7b24f7c3e1` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 02:12:04 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/css X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 699 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	four.css susanrcordova.com/xee/sd/	12 KB 4 KB	399ms 209ms	Stylesheet text/css	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/four.css Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `6132c8cceeb58bf32112892d6ff25cad7c47f84c8dec30ab0c99739286358b43` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 02:13:32 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/css X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 3667 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	five.css susanrcordova.com/xee/sd/	24 KB 6 KB	432ms 242ms	Stylesheet text/css	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/five.css Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `a3257db99e7d9274c99306304753257c82ffd01ffd3b87f06c697104a331b02c` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 02:15:26 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/css X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 6284 X-Proxy-Cache BYPASS susanrcordova.com
GET S	200	error.gif s.aolcdn.com/os/landingpages/images/	1021 B 1 KB	25ms 7ms	Image image/gif	2606:2800:233:af6:eab:2108:1892:6d8 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://s.aolcdn.com/os/landingpages/images/error.gif Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:2800:233:af6:eab:2108:1892:6d8 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (frc/8FA2) / Resource Hash `07981e5b5f4c84246a00de0212f7f4af17cae9e45c4bdf357ced2cad8a1bbc32` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers date Sun, 03 Sep 2017 09:28:39 GMT last-modified Wed, 29 Mar 2017 00:41:25 GMT server ECAcc (frc/8FA2) x-amz-request-id 45845F8380C44C21 etag "0c8daa3780d67dae9aa8a916a83b00e2" x-cache HIT content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 1021 x-amz-id-2 AvVL7TquLeP8USs5FRRerMaKH6cO+CtogYXmwsXsD62IdifRSmxQDS9RwHAYCOitjsx0kQfMl+c=
GET H/1.1	200 OK	three.js Show response susanrcordova.com/xee/sd/	36 KB 14 KB	204ms 204ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/three.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `134f8a6088073a8c424017bf24c40ce25b8cca9c403cad0f2b8589a91ecd7b28` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 01:53:22 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 14526 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	four.js Show response susanrcordova.com/xee/sd/	19 KB 5 KB	197ms 196ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/four.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `d0dc9ce292d18b59950ce7b275eabb77e49dc5336d5372aba5f1a2e4b85c3741` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 01:55:30 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 5592 X-Proxy-Cache BYPASS susanrcordova.com
GET S	200	lp-aol-head-lg.png s.aolcdn.com/os/landingpages/images/	7 KB 7 KB	25ms 7ms	Image image/png	2606:2800:233:af6:eab:2108:1892:6d8 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://s.aolcdn.com/os/landingpages/images/lp-aol-head-lg.png Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:2800:233:af6:eab:2108:1892:6d8 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (frc/8FEC) / Resource Hash `754d851f37baf4b424f4d86d668755d7d2b042534f96b3de0b27e6ce3b095392` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers date Sun, 03 Sep 2017 09:28:39 GMT last-modified Wed, 29 Mar 2017 00:41:55 GMT server ECAcc (frc/8FEC) x-amz-request-id E8EDC6F0222468B0 etag "ccffdab46aa3bd1c7cd0499a2943a05b" x-cache HIT content-type image/png status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 6664 x-amz-id-2 4EfBHj5fRUlm+V1HbKfut4AjPPOCyP0mAoae98Tegg0XTVap4TZuIm23Y82+MrbBMp9Y6eY5oJc=
GET H/1.1	200 OK	five.js Show response susanrcordova.com/xee/sd/	4 KB 2 KB	197ms 196ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/five.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `dcee5312b1a816445dcc424a72970ad633f4fdf67d35dd1e80beb3579f7b399f` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 01:57:34 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 1576 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	200 OK	six.js Show response susanrcordova.com/xee/sd/	1 KB 684 B	191ms 191ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/six.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `ca06cc86362548d949921dec1eb8c62696b3710d9654c81699b83e9060fe74b3` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 01:59:12 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 684 X-Proxy-Cache BYPASS susanrcordova.com
GET S	200	aol_logo_new_sm.gif s.aolcdn.com/os/landingpages/images/	989 B 998 B	22ms 6ms	Image image/gif	2606:2800:233:af6:eab:2108:1892:6d8 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://s.aolcdn.com/os/landingpages/images/aol_logo_new_sm.gif Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2606:2800:233:af6:eab:2108:1892:6d8 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (frc/8F80) / Resource Hash `3641d275ec9df661aa0e75017d3129712e8e298d5613bbad1f1ed47276e6de21` Request headers Referer http://susanrcordova.com/xee/sd/three.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers date Sun, 03 Sep 2017 09:28:39 GMT last-modified Wed, 29 Mar 2017 00:40:30 GMT server ECAcc (frc/8F80) x-amz-request-id 4125CBC020CF368A etag "81a1dd83f90df7eead68f686f865049a" x-cache HIT content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes content-length 989 x-amz-id-2 4+Jv/NaC8R6FaYnGvp2AC8ToYHRZGHg2w7jq95+Ex+lkBfDCxx0f/7mOCaDw04sx
GET		size=1300x800;noperf=1;alias=93313514;artexc=art_flash,art_rrflash;kvpg=susanrcordova%2Fxee%2Fsd%2Fvxl.html;kvugc=0;kvh5lsid=0;kvmn=93313514;kvgrp=430919380;kvismob=2;extmirroring=0;kvtile=1;target... at.atwola.com/adiframe/3.0/5113.1/221794/0/-1/ Frame 2730	0 0

GET H/1.1	200 OK	seven.js Show response susanrcordova.com/xee/sd/	70 KB 30 KB	203ms 203ms	Script text/javascript	66.147.244.94 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://susanrcordova.com/xee/sd/seven.js Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.147.244.94 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS box794.bluehost.com Software nginx/1.12.0 / Resource Hash `2b071adac5f3085652b2f26f147f4c675ac2b34e914428ada2c1caab156da13f` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:39 GMT Content-Encoding gzip Last-Modified Wed, 25 Feb 2015 02:05:50 GMT Server nginx/1.12.0 Vary Accept-Encoding Content-Type text/javascript X-Acc-Exp 600 Connection keep-alive Accept-Ranges bytes Content-Length 31072 X-Proxy-Cache BYPASS susanrcordova.com
GET H/1.1	204 No Content	b2 b.scorecardresearch.com/ Redirect Chain http://b.scorecardresearch.com/b?rn=4867956&C1=2&C2=1000009&C4=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C5=us.snssignin&C7=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C8=AOL%20... http://b.scorecardresearch.com/b2?rn=4867956&C1=2&C2=1000009&C4=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C5=us.snssignin&C7=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C8=AOL%2...	0 0	6ms 6ms	Image text/plain	95.100.248.105 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL http://b.scorecardresearch.com/b2?rn=4867956&C1=2&C2=1000009&C4=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C5=us.snssignin&C7=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C8=AOL%20Mail%3A%20Simple%2C%20Free%2C%20Fun Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 95.100.248.105 , European Union, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a95-100-248-105.deploy.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Sun, 03 Sep 2017 09:28:40 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT Redirect headers Location http://b.scorecardresearch.com/b2?rn=4867956&C1=2&C2=1000009&C4=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C5=us.snssignin&C7=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&C8=AOL%20Mail%3A%20Simple%2C%20Free%2C%20Fun Pragma no-cache Date Sun, 03 Sep 2017 09:28:40 GMT Cache-Control private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Connection keep-alive Content-Length 0 Expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	s97931388747198 o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/ Redirect Chain http://o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/s97931388747198?AQB=1&ndh=1&t=3%2F8%2F2017%209%3A28%3A39%200%200&fid=1D2CD2B42B831166-21BD557B82863D8B&ns=aolllc&cl=63072000&pageName=sso%20%3A%20logi... http://o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/s97931388747198?AQB=1&pccr=true&vidn=2CD5E5A405313492-4000010900016C4A&&ndh=1&t=3%2F8%2F2017%209%3A28%3A39%200%200&fid=1D2CD2B42B831166-21BD557B82863D...	43 B 43 B	24ms 24ms	Image image/gif	66.235.148.132 Adobe Systems Inc.
General Check archive.org Show headers Download Go to Show image Full URL http://o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/s97931388747198?AQB=1&pccr=true&vidn=2CD5E5A405313492-4000010900016C4A&&ndh=1&t=3%2F8%2F2017%209%3A28%3A39%200%200&fid=1D2CD2B42B831166-21BD557B82863D8B&ns=aolllc&cl=63072000&pageName=sso%20%3A%20login&g=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&cc=USD&ch=us.snssignin&server=my.screenname.aol.com&events=event10%2Cevent12&c1=sso%20%3A%20ssologin&c2=sso%20%3A%20&c3=gmt_5&c7=D%3DDNT&c10=external%20web%20browser&c12=%2FsnsUiDriver.jsp&c13=non-authenticated&c14=no%20referrer&c15=unavailable&c16=sns.webmail.aol.com&c17=lp&c18=0&c19=wa3&c20=en-us&c21=AOLPortal&c22=.aol.com&c23=newmail-en-us-v2&c24=D%3Dv52&c49=H.25.4-Dec2014%7Cmmx_1&v52=uaid_na&c55=430919380&c56=susanrcordova.com&c61=D%3Dpccr&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 Requested by Host: susanrcordova.com URL: http://susanrcordova.com/xee/sd/vxl.html Protocol HTTP/1.1 Server 66.235.148.132 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US), Reverse DNS .d2.sc.omtrdc.net Software Omniture DC/2.0.0 / Resource Hash* `a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506` Request headers Referer http://susanrcordova.com/xee/sd/vxl.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Sun, 03 Sep 2017 09:28:40 GMT X-C ms-5.5.0 P3P CP="This is not a P3P policy" Connection Keep-Alive Content-Length 43 Pragma no-cache Last-Modified Mon, 04 Sep 2017 09:28:40 GMT Server Omniture DC/2.0.0 xserver www244 ETag "59ABCB48-1564-51BE3BCE" Vary * Content-Type image/gif Access-Control-Allow-Origin * Cache-Control no-cache, no-store, max-age=0, no-transform, private Keep-Alive timeout=15 Expires Sat, 02 Sep 2017 09:28:40 GMT Redirect headers Pragma no-cache Date Sun, 03 Sep 2017 09:28:40 GMT Last-Modified Mon, 04 Sep 2017 09:28:40 GMT Server Omniture DC/2.0.0 Access-Control-Allow-Origin * xserver www72 X-C ms-5.5.0 P3P CP="This is not a P3P policy" Location http://o.sa.aol.com/b/ss/aolsnssignin/1/H.25.4/s97931388747198?AQB=1&pccr=true&vidn=2CD5E5A405313492-4000010900016C4A&&ndh=1&t=3%2F8%2F2017%209%3A28%3A39%200%200&fid=1D2CD2B42B831166-21BD557B82863D8B&ns=aolllc&cl=63072000&pageName=sso%20%3A%20login&g=http%3A%2F%2Fsusanrcordova.com%2Fxee%2Fsd%2Fvxl.html&cc=USD&ch=us.snssignin&server=my.screenname.aol.com&events=event10%2Cevent12&c1=sso%20%3A%20ssologin&c2=sso%20%3A%20&c3=gmt_5&c7=D%3DDNT&c10=external%20web%20browser&c12=%2FsnsUiDriver.jsp&c13=non-authenticated&c14=no%20referrer&c15=unavailable&c16=sns.webmail.aol.com&c17=lp&c18=0&c19=wa3&c20=en-us&c21=AOLPortal&c22=.aol.com&c23=newmail-en-us-v2&c24=D%3Dv52&c49=H.25.4-Dec2014%7Cmmx_1&v52=uaid_na&c55=430919380&c56=susanrcordova.com&c61=D%3Dpccr&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 Cache-Control no-cache, no-store, max-age=0, no-transform, private Connection Keep-Alive Content-Type text/plain Keep-Alive timeout=15 Content-Length 0 Expires Sat, 02 Sep 2017 09:28:40 GMT
GET		guid.html cdn.at.atwola.com/_media/uac/ Frame 2730	0 0

GET		tcode3.html cdn.at.atwola.com/_media/uac/ Frame 2730	0 0

GET		/ b.susanrcordova.com/vanity/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: at.atwola.com
URL: https://at.atwola.com/adiframe/3.0/5113.1/221794/0/-1/size=1300x800;noperf=1;alias=93313514;artexc=art_flash,art_rrflash;kvpg=susanrcordova%2Fxee%2Fsd%2Fvxl.html;kvugc=0;kvh5lsid=0;kvmn=93313514;kvgrp=430919380;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=0;grp=430919380

Domain: cdn.at.atwola.com
URL: http://cdn.at.atwola.com/_media/uac/guid.html

Domain: cdn.at.atwola.com
URL: http://cdn.at.atwola.com/_media/uac/tcode3.html

Domain: b.susanrcordova.com
URL: http://b.susanrcordova.com/vanity/?ts=1504430920490&h=susanrcordova.com&v=36&r=&l=143&k=1&m=1600x1200&bd=1600x1200&tz=0&ms=502&t=AOL%20Mail%3A%20Simple%2C%20Free%2C%20Fun&dL_ch=us.snssignin&dL_dpt=sso%20%3A%20ssologin&ads_grp=430919380&kb=17&dL_sDpt=sso%20%3A%20&pgvis=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.at.atwola.com/	2018-09-04 09:28:40	Name: APIDTS Value: 1504430920
.at.atwola.com/	2018-09-04 09:28:40	Name: APID Value: UP45458553-908a-11e7-95aa-065852abc5d7
.atwola.com/	2019-09-03 09:28:39	Name: JEB2 Value: 59ABC4AC64000F2F8550D434FFF90F95
.atwola.com/	1970-01-01 00:00:00	Name: CfP Value: 1
.at.atwola.com/	2018-09-04 09:28:40	Name: ATTACID Value: a3Z0aWQ9VVA0NTQ1ODU1My05MDhhLTExZTctOTVhYS0wNjU4NTJhYmM1ZDc=
.susanrcordova.com/	1970-01-01 00:00:00	Name: s_sess Value: %20s_cc%3Dtrue%3B%20s_sq%3D%3B
.susanrcordova.com/	2019-09-03 09:28:40	Name: s_pers Value: %20s_fid%3D1D2CD2B42B831166-21BD557B82863D8B%7C1567502919999%3B%20s_getnr%3D1504430920004-New%7C1567502920004%3B%20s_nrgvo%3DNew%7C1567502920014%3B
susanrcordova.com/xee/sd	1970-01-01 00:00:00	Name: Value: testcookie

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

at.atwola.com
b.scorecardresearch.com
b.susanrcordova.com
cdn.at.atwola.com
o.sa.aol.com
s.aolcdn.com
susanrcordova.com
at.atwola.com
b.susanrcordova.com
cdn.at.atwola.com
2606:2800:233:af6:eab:2108:1892:6d8
66.147.244.94
66.235.148.132
95.100.248.105
07981e5b5f4c84246a00de0212f7f4af17cae9e45c4bdf357ced2cad8a1bbc32
134f8a6088073a8c424017bf24c40ce25b8cca9c403cad0f2b8589a91ecd7b28
1671293756c66402b96ad2688ef2bd31043e88bea28946ae84dde34e211a6608
1adeb9b7455c164e01a88173d356742be2a4b5dc4977f0f64fee5b5d4b38e0b3
2b071adac5f3085652b2f26f147f4c675ac2b34e914428ada2c1caab156da13f
3641d275ec9df661aa0e75017d3129712e8e298d5613bbad1f1ed47276e6de21
3c51c146187d33648403eef72fd3a374667211dc1adb96088bd5319412c31f0b
6132c8cceeb58bf32112892d6ff25cad7c47f84c8dec30ab0c99739286358b43
6dd279d1a35abe8af11b61af0236d1e68179bbd8038a292e5fbd6b7b24f7c3e1
754d851f37baf4b424f4d86d668755d7d2b042534f96b3de0b27e6ce3b095392
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a3257db99e7d9274c99306304753257c82ffd01ffd3b87f06c697104a331b02c
bc700a83ce0ecfae14b8c18fcb5d8c174f612ebd3d01ea59c8d32971102921d2
ca06cc86362548d949921dec1eb8c62696b3710d9654c81699b83e9060fe74b3
d0dc9ce292d18b59950ce7b275eabb77e49dc5336d5372aba5f1a2e4b85c3741
dcee5312b1a816445dcc424a72970ad633f4fdf67d35dd1e80beb3579f7b399f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f034a0a2d70ecbf001844124b32ae4281a5e10c3300215e6e9c727f7e3016673

susanrcordova.com Open in urlscan Pro 66.147.244.94 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

14 %HTTPS

25 %IPv6

5 Domains

7 Subdomains

5 IPs

2 Countries

108 kBTransfer

272 kBSize

8 Cookies

11 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

8 Cookies

Indicators

susanrcordova.com Open in urlscan Pro
66.147.244.94 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

14 %
HTTPS

25 %
IPv6

5
Domains

7
Subdomains

5
IPs

2
Countries

108 kB
Transfer

272 kB
Size

8
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!