Submitted URL: http://link.azet.sk/?w=1&link=https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
Effective URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Submission: On October 17 via manual from US

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 72.52.129.96, located in Lansing, United States and belongs to LIQUIDWEB - Liquid Web, L.L.C, US. The main domain is webkinetics.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 31st 2019. Valid for: 3 months.
This is the only time webkinetics.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 2 91.235.52.15 57788 (AZET-AS)
1 2 51.38.84.146 16276 (OVH)
1 9 72.52.129.96 32244 (LIQUIDWEB)
9 2
Apex Domain
Subdomains
Transfer
9 webkinetics.net
webkinetics.net
709 KB
2 witnessthemagic.co.uk
witnessthemagic.co.uk
956 B
2 azet.sk
link.azet.sk
1 KB
9 3
Domain Requested by
9 webkinetics.net 1 redirects witnessthemagic.co.uk
webkinetics.net
2 witnessthemagic.co.uk 1 redirects
2 link.azet.sk 2 redirects
9 3

This site contains no links.

Subject Issuer Validity Valid
www.witnessthemagic.co.uk
RapidSSL RSA CA 2018
2018-03-20 -
2020-03-19
2 years crt.sh
webkinetics.net
cPanel, Inc. Certification Authority
2019-08-31 -
2019-11-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Frame ID: A801C0A2C485BA67FB68960BD8E417D8
Requests: 9 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://link.azet.sk/?w=1&link=https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.co... HTTP 301
    https://link.azet.sk/redir?w=1&link=68ec666ee7e7837917f2407c2c54bb97 HTTP 302
    https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796 Page URL
  2. https://witnessthemagic.co.uk/t/aredir5a.php?p= HTTP 302
    https://webkinetics.net/6a/index.php?_=89.39.105.129 HTTP 302
    https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ== Page URL

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

709 kB
Transfer

707 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://link.azet.sk/?w=1&link=https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796 HTTP 301
    https://link.azet.sk/redir?w=1&link=68ec666ee7e7837917f2407c2c54bb97 HTTP 302
    https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796 Page URL
  2. https://witnessthemagic.co.uk/t/aredir5a.php?p= HTTP 302
    https://webkinetics.net/6a/index.php?_=89.39.105.129 HTTP 302
    https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://link.azet.sk/?w=1&link=https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796 HTTP 301
  • https://link.azet.sk/redir?w=1&link=68ec666ee7e7837917f2407c2c54bb97 HTTP 302
  • https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
witnessthemagic.co.uk/t/
Redirect Chain
  • http://link.azet.sk/?w=1&link=https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
  • https://link.azet.sk/redir?w=1&link=68ec666ee7e7837917f2407c2c54bb97
  • https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
524 B
640 B
Document
General
Full URL
https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.38.84.146 , United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
ip146.ip-51-38-84.eu
Software
Apache /
Resource Hash
2a1446afb02daf6fe15a12caef8a6741801f49b3909b3705c09dcc8c921b15ff
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Host
witnessthemagic.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:31 GMT
Server
Apache
Last-Modified
Thu, 17 Oct 2019 14:04:22 GMT
ETag
"3d60f05-20c-5951bb1c95010"
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
X-XSS-Protection
1; mode=block
Content-Length
328
Content-Type
text/html

Redirect headers

Date
Thu, 17 Oct 2019 22:20:30 GMT
Charset
utf-8
Location
https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
Vary
Accept-Encoding
Content-Encoding
gzip
X-Frame-Options
sameorigin
X-XSS-Protection
1; mode=block
X-Served-By
systemweb-02
Content-Length
1767
Keep-Alive
timeout=4, max=1000
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Set-Cookie
TS01e8a449=01717008babd957cf22ff886de0815d9321d13101ebe661e57e2426e122ca8a128d38db538de937acae5448997e689ad5c051fb10b; Path=/
Primary Request Cookie set login.php
webkinetics.net/6a/
Redirect Chain
  • https://witnessthemagic.co.uk/t/aredir5a.php?p=
  • https://webkinetics.net/6a/index.php?_=89.39.105.129
  • https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
4 KB
5 KB
Document
General
Full URL
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Requested by
Host: witnessthemagic.co.uk
URL: https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
8ce3c0c5b6f874d085a56bd70be16af95eb821fa59422d9057c27c63658f286d

Request headers

Host
webkinetics.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://witnessthemagic.co.uk/t/?5237395735169769outlook.office.com529796

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=36f8913931e29ba4cb762e17a36536d5; path=/
Keep-Alive
timeout=2, max=149
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Thu, 17 Oct 2019 22:20:31 GMT
Server
Apache
Location
login.php?_=ODkuMzkuMTA1LjEyOQ==
Keep-Alive
timeout=2, max=150
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
c.login.min.css
webkinetics.net/6a/css/
85 KB
86 KB
Stylesheet
General
Full URL
https://webkinetics.net/6a/css/c.login.min.css
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
311a07f159ca5f3f25911c8d5636f1915d6e3a8f1d993b266998ce5d07fd9f58

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=148
Content-Length
87411
c_pcore.min.js
webkinetics.net/6a/css/
307 KB
307 KB
Script
General
Full URL
https://webkinetics.net/6a/css/c_pcore.min.js
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
610f8c0dee8253b71a5eb4edca540fbda04dea326f44bee0b19622379bdcdba3

Request headers

Sec-Fetch-Mode
cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Origin
https://webkinetics.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=150
Content-Length
314516
c-en.min.js
webkinetics.net/6a/css/
10 KB
10 KB
Script
General
Full URL
https://webkinetics.net/6a/css/c-en.min.js
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
4b115bae35dbfe25b144917a49d7664764c87fcb6de03ae78544c522ca011baa

Request headers

Sec-Fetch-Mode
cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Origin
https://webkinetics.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=150
Content-Length
9732
logo_orange.png
webkinetics.net/6a/images/
4 KB
4 KB
Image
General
Full URL
https://webkinetics.net/6a/images/logo_orange.png
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
1039e99e81b60c781120d7626d9cbda664776467f3ca87de50b3c2c19c1b5345

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=150
Content-Length
3614
one.jpg
webkinetics.net/6a/images/
5 KB
5 KB
Image
General
Full URL
https://webkinetics.net/6a/images/one.jpg
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
39435bb7c450af393f8fe2fe8980b4c18f51fbc770c91beba6345c81948a40ba

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=150
Content-Length
5042
0-small.jpg
webkinetics.net/6a/images/
1 KB
1 KB
Image
General
Full URL
https://webkinetics.net/6a/images/0-small.jpg
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=149
Content-Length
1029
0.jpg
webkinetics.net/6a/images/
291 KB
291 KB
Image
General
Full URL
https://webkinetics.net/6a/images/0.jpg
Requested by
Host: webkinetics.net
URL: https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.52.129.96 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
host.cmglive.us
Software
Apache /
Resource Hash
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://webkinetics.net/6a/login.php?_=ODkuMzkuMTA1LjEyOQ==
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 17 Oct 2019 22:20:32 GMT
Last-Modified
Thu, 17 Oct 2019 13:20:18 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=149
Content-Length
298105

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| webpackJsonp object| StringRepository boolean| __ function| preventBack

1 Cookies

Domain/Path Name / Value
webkinetics.net/ Name: PHPSESSID
Value: 36f8913931e29ba4cb762e17a36536d5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Xss-Protection 1; mode=block