legalena.info
Open in
urlscan Pro
2606:4700:3031::ac43:ce73
Malicious Activity!
Public Scan
Effective URL: https://legalena.info/?encoded_value=24QSBG&sub1=a946d14eedbc467eb8187d6b4e2b9293&sub2=&sub3=&sub4=&sub5=&source_id=1443
Submission: On May 30 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 14th 2023. Valid for: a year.
This is the only time legalena.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.95.148.188 52.95.148.188 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 91.199.147.123 91.199.147.123 | 62212 () () | |
1 1 | 154.16.202.14 154.16.202.14 | 61317 (ASDETUK w...) (ASDETUK www.heficed.com) | |
1 1 | 34.117.79.165 34.117.79.165 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 22 | 2606:4700:303... 2606:4700:3031::ac43:ce73 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:e2:... 2606:4700:e2::ac40:840f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700:303... 2606:4700:3032::ac43:b158 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 20.50.64.3 20.50.64.3 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
28 | 5 |
ASN16509 (AMAZON-02, US)
PTR: s3-website.eu-west-2.amazonaws.com
fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com |
ASN61317 (ASDETUK www.heficed.com, US)
www.mostratic.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 165.79.117.34.bc.googleusercontent.com
www.lpredirect.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
legalena.info
1 redirects
legalena.info |
2 MB |
3 |
virtualpushplatform.com
virtualpushplatform.com — Cisco Umbrella Rank: 554887 |
4 KB |
2 |
pushserve.xyz
pushserve.xyz — Cisco Umbrella Rank: 348741 |
2 KB |
2 |
foxnews-usa.com
1 redirects
foxnews-usa.com |
582 B |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 868 |
426 KB |
1 |
lpredirect.com
1 redirects
www.lpredirect.com — Cisco Umbrella Rank: 577897 |
495 B |
1 |
mostratic.com
1 redirects
www.mostratic.com |
620 B |
1 |
amazonaws.com
1 redirects
fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com |
313 B |
28 | 8 |
Domain | Requested by | |
---|---|---|
22 | legalena.info |
1 redirects
foxnews-usa.com
legalena.info |
3 | virtualpushplatform.com |
legalena.info
virtualpushplatform.com |
2 | pushserve.xyz |
virtualpushplatform.com
|
2 | foxnews-usa.com | 1 redirects |
1 | use.fontawesome.com |
legalena.info
|
1 | www.lpredirect.com | 1 redirects |
1 | www.mostratic.com | 1 redirects |
1 | fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com | 1 redirects |
28 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-02-14 - 2024-02-13 |
a year | crt.sh |
use.fontawesome.com GTS CA 1P5 |
2023-05-06 - 2023-08-04 |
3 months | crt.sh |
pushserve.xyz Sectigo RSA Domain Validation Secure Server CA |
2022-08-01 - 2023-08-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://legalena.info/?encoded_value=24QSBG&sub1=a946d14eedbc467eb8187d6b4e2b9293&sub2=&sub3=&sub4=&sub5=&source_id=1443
Frame ID: B0DCFE7EFC9FC70DE1A320848E4231EC
Requests: 26 HTTP requests in this frame
Screenshot
Page Title
Survey RewardsPage URL History Show full URLs
-
http://fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com/rd/c13135DmIap312791BASK294902lKI921EXkj1000
HTTP 301
http://foxnews-usa.com/rd/c13135DmIap312791BASK294902lKI921EXkj1000 Page URL
-
http://foxnews-usa.com/track/c13135DmIap312791BASK294902lKI921EXkj1000
HTTP 302
https://www.mostratic.com/3BHB69N/23BKB45C/?sub1=11&sub2=1000-13135&sub3=312791-294902-921 HTTP 302
https://www.lpredirect.com/24QSBG/KKHH63H/?source_id=1443&sub1=a946d14eedbc467eb8187d6b4e2b9293 HTTP 302
https://legalena.info/nHSjza6T0d/?encoded_value=24QSBG&sub1=a946d14eedbc467eb8187d6b4e2b9293&sub2=... HTTP 302
https://legalena.info/?encoded_value=24QSBG&sub1=a946d14eedbc467eb8187d6b4e2b9293&sub2=&sub3=&sub4... Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com/rd/c13135DmIap312791BASK294902lKI921EXkj1000
HTTP 301
http://foxnews-usa.com/rd/c13135DmIap312791BASK294902lKI921EXkj1000 Page URL
-
http://foxnews-usa.com/track/c13135DmIap312791BASK294902lKI921EXkj1000
HTTP 302
https://www.mostratic.com/3BHB69N/23BKB45C/?sub1=11&sub2=1000-13135&sub3=312791-294902-921 HTTP 302
https://www.lpredirect.com/24QSBG/KKHH63H/?source_id=1443&sub1=a946d14eedbc467eb8187d6b4e2b9293 HTTP 302
https://legalena.info/nHSjza6T0d/?encoded_value=24QSBG&sub1=a946d14eedbc467eb8187d6b4e2b9293&sub2=&sub3=&sub4=&sub5=&source_id=1443 HTTP 302
https://legalena.info/?encoded_value=24QSBG&sub1=a946d14eedbc467eb8187d6b4e2b9293&sub2=&sub3=&sub4=&sub5=&source_id=1443 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com/rd/c13135DmIap312791BASK294902lKI921EXkj1000 HTTP 301
- http://foxnews-usa.com/rd/c13135DmIap312791BASK294902lKI921EXkj1000
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
c13135DmIap312791BASK294902lKI921EXkj1000
foxnews-usa.com/rd/ Redirect Chain
|
243 B 360 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
legalena.info/ Redirect Chain
|
28 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
legalena.info/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
animate.min.css
legalena.info/css/ |
70 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.js
use.fontawesome.com/releases/v5.15.4/js/ |
1 MB 426 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
datehead.js
legalena.info/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ace-push.js
virtualpushplatform.com/ |
10 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
legalena.info/images/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flaglogo.png
legalena.info/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
product1.png
legalena.info/images/ |
518 KB 519 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
loadingBL.gif
legalena.info/images/ |
122 KB 122 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prize1.png
legalena.info/images/ |
467 KB 467 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1.jpg
legalena.info/images/ |
44 KB 45 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2.jpg
legalena.info/images/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
comm_pic_1.jpg
legalena.info/images/ |
72 KB 73 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3.jpg
legalena.info/images/ |
43 KB 43 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4.jpg
legalena.info/images/ |
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
comm_pic_2.jpg
legalena.info/images/ |
79 KB 79 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
5.jpg
legalena.info/images/ |
60 KB 60 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f_guarantee.png
legalena.info/images/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f_secure_1.png
legalena.info/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo2.png
legalena.info/images/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
legalena.info/js/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg.png
legalena.info/images/ |
231 KB 231 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
visit
pushserve.xyz/api/v1/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
visit
pushserve.xyz/api/v1/ |
1 KB 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
log-client-error
virtualpushplatform.com/api/v1/visit/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
log-client-error
virtualpushplatform.com/api/v1/visit/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| datehax function| datenhax function| datenhay function| initializeAcePush function| setBaseUrl function| getLocation function| registerServiceWorker object| answers number| lastQnum function| toNext object| states object| dones object| loadImg object| loadBgCol function| drawloader function| startTimer object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.lpredirect.com/ | Name: uniqueClick_KKHH63H Value: 6609908e-9282-4819-bded-e3e405ab4da5:1685464868 |
|
www.lpredirect.com/ | Name: transaction_id Value: a1473943768248df893de2c7a510d4d5 |
|
legalena.info/ | Name: SESSIONIDS Value: nHSjza6T0d |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
foxnews-usa.com
fyvgubinydsgbv.s3-website.eu-west-2.amazonaws.com
legalena.info
pushserve.xyz
use.fontawesome.com
virtualpushplatform.com
www.lpredirect.com
www.mostratic.com
154.16.202.14
20.50.64.3
2606:4700:3031::ac43:ce73
2606:4700:3032::ac43:b158
2606:4700:e2::ac40:840f
34.117.79.165
52.95.148.188
91.199.147.123
0609a9584f46530b80db0a4bd2343db25d1859c324a7ef6d2c1a3c66d83da88f
2dbefe7d18317cc502deac6000e211893cf423ce66d10826d4263aad4220a806
37949baf3f0c2326338d79b572afbad9012828e6dc7e9d290c920165abf2b254
37e5d12238df11751984a474ffc6e3120985605e4070d4db757995a36abdb7f7
37f08b72a8979b3faed73629ede662e40c80f4d22b6d9b807368d02387e82b2b
414d70413a8b02b3faffdb99ae4f654d90aba320bac05b745b7b67189108a480
49daeee75a844be2792d54e31e60eb3a37d1b97f16f9d9fbca9cc676c7ec0cfd
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
6502cf5a2a5769fe9372669a3ad7c7ec7c13b64550c414bd12332c0418888f1f
7c03afc2bad8a241e1bf0c1f12e67f938815324a3fe3db4d24a2ae3f4a587605
7efe3233a8511d2101e189628413af3f29eaa8ac39bb75dcff1c9ccaa18905c8
812ab0e46f86b2ce98ab2425ab2224b90d0845952a1ac0d5abd734b6217e98bf
90af081bb8a5cc3d0733c8c2221f91f002a212abc0b0e79f44e0a74278a33c4b
acd5297abee4b6b5ba2a06d2e654c9daa71ec632de8de03a8eec76ce7bfb603d
adc69e4dc6ca8be9efc957fd8235cb61a53b678a8e6d852dcdaefaa825190543
bf02017c2fc0a74424e42e71d734b47c92a6aa9c5420e1892e62530195e1c9b6
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
cf3d34041e665d64895d9d6bff29804c011795a32ee500288266da578a761d5e
d0cdba2c922eda972c2f9a96abf69ca9f9ac0a4d9386e8de5b00c71ba4d15449
d62dcdb3449970f612971eb8e27a20fc132fa439ebfafae9d1e969c70359ab32
dd8fc86e5bd153223fe4bd03de34b8bc002cbc78e6a8a146f616850b8f2609f5
e3a1f070309af0cee26eee78fee249ba2dc978e3aa0ab6d78630a48758ae9308
f4dfc10d7b7789510e5b20b85e582e4fca1a346c87473de5bbca1c8c3ecd257e