www.craftflocking.com Open in urlscan Pro
66.70.138.181 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.mariospizzawp.com/paypal.php
Effective URL:
https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany
Submission: On June 09 via automatic, source phishtank (June 9th 2019, 4:06:54 pm UTC)

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 66.70.138.181, located in Montreal, Canada and belongs to OVH, FR. The main domain is www.craftflocking.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on March 4th 2019. Valid for: a year.

This is the only time www.craftflocking.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	216.155.158.83 216.155.158.83		20473 (AS-CHOOPA) (AS-CHOOPA - Choopa)
1 1	2600:9000:204... 2600:9000:2043:9800:19:9934:6a80:93a1		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 7	66.70.138.181 66.70.138.181		16276 (OVH) (OVH)
7	2

1 216.155.158.83 (Matawan, United States)

ASN20473 (AS-CHOOPA - Choopa, LLC, US)
PTR: 216.155.158.83.choopa.com

www.mariospizzawp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2043:9800:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

example.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 66.70.138.181 (Montreal, Canada) 1 redirects

ASN16276 (OVH, FR)
PTR: ip181.ip-66-70-138.net

www.craftflocking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	craftflocking.com 1 redirects www.craftflocking.com	41 KB
1	app.link 1 redirects example.app.link	761 B
1	mariospizzawp.com www.mariospizzawp.com	710 B
7	3

	Domain	Requested by
7	www.craftflocking.com	1 redirects www.craftflocking.com
1	example.app.link	1 redirects
1	www.mariospizzawp.com
7	3

This site contains no links.

Subject Issuer	Validity	Valid
www.craftflocking.com RapidSSL RSA CA 2018	`2019-03-04` - `2020-05-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany
Frame ID: FF56E26DDF60C6D0E0D3C6EC27D8CA04
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.mariospizzawp.com/paypal.php Page URL
https://example.app.link/?foo=bar&baz=456&$fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplat... HTTP 307
https://www.craftflocking.com/template/template?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflo... HTTP 301
https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftfl... Page URL
https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

7
Requests

86 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

41 kB
Transfer

126 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.mariospizzawp.com/paypal.php Page URL
https://example.app.link/?foo=bar&baz=456&$fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate HTTP 307
https://www.craftflocking.com/template/template?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 HTTP 301
https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 Page URL
https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://example.app.link/?foo=bar&baz=456&$fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate HTTP 307
https://www.craftflocking.com/template/template?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 HTTP 301
https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	paypal.php Show response www.mariospizzawp.com/	565 B 710 B	182ms 180ms	Document text/html	216.155.158.83 Choopa
General Check archive.org Show headers Download Go to Full URL http://www.mariospizzawp.com/paypal.php Protocol HTTP/1.1 Server 216.155.158.83 Matawan, United States, ASN20473 (AS-CHOOPA - Choopa, LLC, US), Reverse DNS 216.155.158.83.choopa.com Software Microsoft-IIS/8.5 / PHP/7.1.7 ASP.NET Resource Hash `a2967c575ddb0358ce734c482e2c5a037151436ec358dba7a21f7a97fe61376d` Request headers Host www.mariospizzawp.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type text/html; charset=UTF-8 Content-Encoding gzip Vary Accept-Encoding Server Microsoft-IIS/8.5 X-HttpBL HttpBL/1.0.4962.20359 (NET v2.0.50727) ID=0x7912996B X-Powered-By PHP/7.1.7 ASP.NET Date Sun, 09 Jun 2019 16:06:37 GMT Content-Length 407
GET H2	200	/ www.craftflocking.com/template/template/ Redirect Chain https://example.app.link/?foo=bar&baz=456&$fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate https://www.craftflocking.com/template/template?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014	241 B 280 B	886ms 885ms	Document text/html	66.70.138.181 OVH
General Check archive.org Show headers Download Go to Full URL https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.70.138.181 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip181.ip-66-70-138.net Software LiteSpeed / PHP/5.4.45 Resource Hash Request headers :method GET :authority www.craftflocking.com :scheme https :path /template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 referer http://www.mariospizzawp.com/paypal.php accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://www.mariospizzawp.com/paypal.php Response headers status 200 x-powered-by PHP/5.4.45 set-cookie PHPSESSID=8prij471cg1g4ov0m6tspl2dd2; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache content-type text/html; charset-UTF-8 content-length 204 content-encoding gzip vary Accept-Encoding date Sun, 09 Jun 2019 15:56:04 GMT accept-ranges bytes server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,37,38,39" Redirect headers status 301 content-type text/html content-length 617 date Sun, 09 Jun 2019 15:56:04 GMT accept-ranges bytes server LiteSpeed location https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 alt-svc quic=":443"; ma=2592000; v="35,37,38,39"
GET H2	200	Primary Request login.php Show response www.craftflocking.com/template/template/	3 KB 1 KB	618ms 618ms	Document text/html	66.70.138.181 OVH
General Check archive.org Show headers Download Go to Full URL https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Requested by Host: www.craftflocking.com URL: https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.70.138.181 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip181.ip-66-70-138.net Software LiteSpeed / PHP/5.4.45 Resource Hash `b33ebcf6f23fee6cbb7c93cc7dbc0a93437044000652aaa2874be5d626def5f5` Request headers :method GET :authority www.craftflocking.com :scheme https :path /template/template/login.php?code=DE&id=49084419&country=Germany pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 referer https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 accept-encoding gzip, deflate, br cookie PHPSESSID=8prij471cg1g4ov0m6tspl2dd2 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://www.craftflocking.com/template/template/?foo=bar&baz=456&%24fallback_url=https%3A%2F%2Fwww.craftflocking.com%2Ftemplate%2Ftemplate&_branch_match_id=666299482849744014 Response headers status 200 x-powered-by PHP/5.4.45 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache content-type text/html; charset-UTF-8 content-length 1373 content-encoding gzip vary Accept-Encoding date Sun, 09 Jun 2019 15:56:05 GMT accept-ranges bytes server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,37,38,39"
GET H2	200	bootstrap.css www.craftflocking.com/template/template/lib/css/	23 KB 5 KB	95ms 94ms	Stylesheet text/css	66.70.138.181 OVH
General Check archive.org Show headers Download Go to Full URL https://www.craftflocking.com/template/template/lib/css/bootstrap.css Requested by Host: www.craftflocking.com URL: https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.70.138.181 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip181.ip-66-70-138.net Software LiteSpeed / Resource Hash `ce840503a2c5167ccd9652602de6edd62158d068fd39aaa7e2bad5704c38ddd3` Request headers Referer https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 09 Jun 2019 15:56:05 GMT content-encoding br last-modified Sat, 08 Jun 2019 07:04:30 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 5032 expires Sun, 16 Jun 2019 15:56:05 GMT
GET H2	200	jquery.1.11.1.min.js Show response www.craftflocking.com/template/template/lib/js/	94 KB 32 KB	99ms 98ms	Script application/javascript	66.70.138.181 OVH
General Check archive.org Show headers Download Go to Full URL https://www.craftflocking.com/template/template/lib/js/jquery.1.11.1.min.js Requested by Host: www.craftflocking.com URL: https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.70.138.181 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip181.ip-66-70-138.net Software LiteSpeed / Resource Hash `540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441` Request headers Referer https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 09 Jun 2019 15:56:05 GMT content-encoding br last-modified Sat, 08 Jun 2019 07:04:30 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 32330 expires Sun, 16 Jun 2019 15:56:05 GMT
GET H2	200	login.js Show response www.craftflocking.com/template/template/lib/js/	817 B 287 B	283ms 282ms	Script application/javascript	66.70.138.181 OVH
General Check archive.org Show headers Download Go to Full URL https://www.craftflocking.com/template/template/lib/js/login.js Requested by Host: www.craftflocking.com URL: https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.70.138.181 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip181.ip-66-70-138.net Software LiteSpeed / Resource Hash `91555248b245023c08f525948e72f388c4d17f29cc34a34d2fca28e36835c9a9` Request headers Referer https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 09 Jun 2019 15:56:05 GMT content-encoding br last-modified Sat, 08 Jun 2019 07:04:30 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 244 expires Sun, 16 Jun 2019 15:56:05 GMT
GET H2	200	logo.svg www.craftflocking.com/template/template/lib/css/img/	5 KB 2 KB	192ms 191ms	Image image/svg+xml	66.70.138.181 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://www.craftflocking.com/template/template/lib/css/img/logo.svg Requested by Host: www.craftflocking.com URL: https://www.craftflocking.com/template/template/login.php?code=DE&id=49084419&country=Germany Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.70.138.181 Montreal, Canada, ASN16276 (OVH, FR), Reverse DNS ip181.ip-66-70-138.net Software LiteSpeed / Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Referer https://www.craftflocking.com/template/template/lib/css/bootstrap.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 09 Jun 2019 15:56:05 GMT content-encoding br last-modified Sat, 08 Jun 2019 07:04:30 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,37,38,39" content-length 1800 expires Sun, 16 Jun 2019 15:56:05 GMT

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.craftflocking.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8prij471cg1g4ov0m6tspl2dd2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

example.app.link
www.craftflocking.com
www.mariospizzawp.com
216.155.158.83
2600:9000:2043:9800:19:9934:6a80:93a1
66.70.138.181
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
91555248b245023c08f525948e72f388c4d17f29cc34a34d2fca28e36835c9a9
a2967c575ddb0358ce734c482e2c5a037151436ec358dba7a21f7a97fe61376d
b33ebcf6f23fee6cbb7c93cc7dbc0a93437044000652aaa2874be5d626def5f5
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
ce840503a2c5167ccd9652602de6edd62158d068fd39aaa7e2bad5704c38ddd3