urlscan.io logo urlscan.io
SecurityTrails logo

difpt.org Open in urlscan Pro
166.62.10.186  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://apps10.cra-arc.gc.ca.justwings.net/
Effective URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Submission: On May 25 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 16 HTTP transactions. The main IP is 166.62.10.186, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is difpt.org.
This is the only time difpt.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Canadian Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 51.91.111.17 16276 (OVH)
1 2a00:1450:400... 15169 (GOOGLE)
12 166.62.10.186 26496 (AS-26496-...)
1 185.225.208.133 13213 (UK2NET-AS)
1 67.202.94.94 32748 (STEADFAST)
16 6
1    51.91.111.17 (France)

ASN16276 (OVH, FR)
PTR: vps-5aef6345.vps.ovh.net
apps10.cra-arc.gc.ca.justwings.net
1    2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
12    166.62.10.186 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-10-186.ip.secureserver.net
difpt.org
1    185.225.208.133 (Germany)

ASN13213 (UK2NET-AS, GB)
waust.at
1    67.202.94.94 (Chicago, United States)

ASN32748 (STEADFAST, US)
PTR: amung.us
whos.amung.us
Domain Requested by
12 difpt.org apps10.cra-arc.gc.ca.justwings.net
difpt.org
1 whos.amung.us waust.at
1 waust.at difpt.org
1 ajax.googleapis.com apps10.cra-arc.gc.ca.justwings.net
1 apps10.cra-arc.gc.ca.justwings.net
16 5

This site contains links to these domains. Also see Links.

Domain
whos.amung.us
Subject Issuer Validity Valid
upload.video.google.com
GTS CA 1O1		 2020-05-05 -
2020-07-28		 3 months crt.sh

This page contains 3 frames:

Primary Page: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Frame ID: 60DB7F97BC7CADB0B41BB1EE9314E531
Requests: 15 HTTP requests in this frame

Frame: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/wmms.svg
Frame ID: 315646D6A89118F9D840D056329A9121
Requests: 1 HTTP requests in this frame

Frame: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/sig-en.svg
Frame ID: AAC727F99373DB5D10BCD58F8BFF7078
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://apps10.cra-arc.gc.ca.justwings.net/ Page URL
  2. http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

16
Requests

6 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

143 kB
Transfer

474 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://apps10.cra-arc.gc.ca.justwings.net/ Page URL
  2. http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Cookie set /
apps10.cra-arc.gc.ca.justwings.net/ 		232 B
604 B 		Document
General
Check archive.org
Download Go to
Full URL
http://apps10.cra-arc.gc.ca.justwings.net/
Protocol
HTTP/1.1
Server
51.91.111.17 , France, ASN16276 (OVH, FR),
Reverse DNS
vps-5aef6345.vps.ovh.net
Software
Apache/2.4.18 (Ubuntu) /
Resource Hash
d4de7cb3f13455591354b582fe9fbb129f9d7292bf4186f0762049780313bf57

Request headers

Host
apps10.cra-arc.gc.ca.justwings.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:55 GMT
Server
Apache/2.4.18 (Ubuntu)
Set-Cookie
PHPSESSID=98jcfs954k3copvcge2fnomjq2; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
184
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: apps10.cra-arc.gc.ca.justwings.net
URL: http://apps10.cra-arc.gc.ca.justwings.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://apps10.cra-arc.gc.ca.justwings.net/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 20 May 2020 15:35:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
427921
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30399
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 May 2021 15:35:54 GMT
Primary Request Cookie set authenticate.php
difpt.org/images/.cra-ca/home404shtmlccrd-request/ 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Requested by
Host: apps10.cra-arc.gc.ca.justwings.net
URL: http://apps10.cra-arc.gc.ca.justwings.net/
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache / PHP/7.1.33
Resource Hash
4ff7b08c5995a9fb72ba94f924e7c8f17fcc5cfbc6883457a1a385e7addcfe7e

Request headers

Host
difpt.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://apps10.cra-arc.gc.ca.justwings.net/
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://apps10.cra-arc.gc.ca.justwings.net/

Response headers

Date
Mon, 25 May 2020 14:27:55 GMT
Server
Apache
X-Powered-By
PHP/7.1.33
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=bbb54a9489f897532d644f36cb3dc53d; path=/
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
3000
Keep-Alive
timeout=5
Content-Type
text/html; charset=UTF-8
jquery.min.js
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		82 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/jquery.min.js
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"70402ac-14915-5a6403c3064cd-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5
Content-Length
29497
theme.min.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		199 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/theme.min.css
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
e3536ef9cb8bcff43b17377a72b2657db0d020529137688b1fdf4b2ec7a2c105

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"70402e1-31c1f-5a6403c30bea5-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
35059
apps.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/apps.css
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
204a17ca995a792e855a803a949467e09f71c1f78ed57551684cab15db078cbe

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"7040166-c57-5a6403c2fdc15-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
1142
common.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/common.css
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
93c11c985807fa11dee8e93dabece88c3b74c1e945fa8911c032e75ddd2a6f2d

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"704016e-995-5a6403c2febb5-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
920
d.js
waust.at/ 		13 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://waust.at/d.js
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
185.225.208.133 , Germany, ASN13213 (UK2NET-AS, GB),
Reverse DNS
Software
/
Resource Hash
21092efadab949c3ad748e1c67c0e5f14eaab93275d2f1ba142464ef02a3735a

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Thu, 21 May 2020 14:38:50 GMT
ETag
W/"5ec6927a-32f2"
Transfer-Encoding
chunked
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400, private
Connection
keep-alive
Expires
Tue, 26 May 2020 14:27:56 GMT
timeout.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		428 B
597 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/timeout.css
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
447a4a6c6d785d6fc009367d1fd835b3245114e3162a5dafe288ea54ffd7e0c7

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"70402e7-1ac-5a6403c30c675-gzip"
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=5
Content-Length
241
font-awesome.css
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		39 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/font-awesome.css
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
6081e5ab192226d10d4ccbb32070bd11f65a079467886afb905ee3b9440952e7

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"7040184-9b47-5a6403c300325-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
7488
header-leaf.jpg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/header-leaf.jpg
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/theme.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"704027d-1b32-5a6403c302a35"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
6962
header-bg.jpg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/header-bg.jpg
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/theme.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"704018c-3c4c-5a6403c30264d"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
15436
sft-deco.gif
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ 		80 B
346 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/sft-deco.gif
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/theme.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
Server
Apache
ETag
"70402d0-50-5a6403c309f65"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
80
wmms.svg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ Frame 3156 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/wmms.svg
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
4dd1b275548819246b29ff689c8f617314c6e7b5a18c30341c001321519f9913

Request headers

Host
difpt.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
PHPSESSID=bbb54a9489f897532d644f36cb3dc53d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Server
Apache
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
ETag
"70402f4-12d3-5a6403c30d22d-gzip"
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
1794
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
image/svg+xml
sig-en.svg
difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/ Frame AAC7 		11 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/details_files/sig-en.svg
Requested by
Host: difpt.org
URL: http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Protocol
HTTP/1.1
Server
166.62.10.186 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-186.ip.secureserver.net
Software
Apache /
Resource Hash
ddc04f3de34dce28968926fb8d174ad39a07b875392fa406b07fc4c729a47438

Request headers

Host
difpt.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
PHPSESSID=bbb54a9489f897532d644f36cb3dc53d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php

Response headers

Date
Mon, 25 May 2020 14:27:56 GMT
Server
Apache
Last-Modified
Fri, 22 May 2020 17:48:21 GMT
ETag
"70402d2-2a0c-5a6403c30a34d-gzip"
Accept-Ranges
bytes
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
2247
Keep-Alive
timeout=5
Connection
Keep-Alive
Content-Type
image/svg+xml
/
whos.amung.us/pingjs/ 		28 B
212 B 		Script
General
Check archive.org
Download Go to
Full URL
http://whos.amung.us/pingjs/?k=k79luj4uh0&t=Confirm%20Your%20Identity&c=d&y=http%3A%2F%2Fapps10.cra-arc.gc.ca.justwings.net%2F&a=0&r=3498
Requested by
Host: waust.at
URL: http://waust.at/d.js
Protocol
HTTP/1.1
Server
67.202.94.94 Chicago, United States, ASN32748 (STEADFAST, US),
Reverse DNS
amung.us
Software
/
Resource Hash
87c449a0a5efe33d928b7b6ce31f184a687c801c062e47e10ff9889dd99895df

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 25 May 2020 14:27:56 GMT
content-encoding
gzip
transfer-encoding
chunked
content-type
text/javascript;charset=UTF-8
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6f4587fb64cd2e7ce26ba21941c80f3ab8d28c257b73d04a87c949b32e4cde2d

Request headers

Referer
http://difpt.org/images/.cra-ca/home404shtmlccrd-request/authenticate.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Canadian Government (Government)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| empty function| change object| _wau string| wau_w_col string| wau_w_siz object| WAU_ren function| WAU_dynamic function| WAU_dynamic_request function| WAU_r_d function| WAU_insert function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_cps function| docReady object| x string| x1 string| x2

1 Cookies

Domain/Path Name / Value
difpt.org/ Name: PHPSESSID
Value: bbb54a9489f897532d644f36cb3dc53d