globalexchange.com.investment.money-paid.trades-mill-insurance.com
Open in
urlscan Pro
107.180.24.235
Malicious Activity!
Public Scan
Submission: On July 03 via manual from IN
Summary
This is the only time globalexchange.com.investment.money-paid.trades-mill-insurance.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 107.180.24.235 107.180.24.235 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::681b:8efe | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::6810:641d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 104.111.234.198 104.111.234.198 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 45.40.130.22 45.40.130.22 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
19 | 7 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-24-235.ip.secureserver.net
globalexchange.com.investment.money-paid.trades-mill-insurance.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
ajax.aspnetcdn.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.minterest.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cfl.dropboxstatic.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-234-198.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
img.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
trades-mill-insurance.com
globalexchange.com.investment.money-paid.trades-mill-insurance.com |
138 KB |
1 |
secureserver.net
img.secureserver.net |
637 B |
1 |
wsimg.com
img1.wsimg.com |
5 KB |
1 |
dropboxstatic.com
cfl.dropboxstatic.com |
24 KB |
1 |
minterest.com
www.minterest.com |
27 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com |
34 KB |
19 | 6 |
Domain | Requested by | |
---|---|---|
14 | globalexchange.com.investment.money-paid.trades-mill-insurance.com |
globalexchange.com.investment.money-paid.trades-mill-insurance.com
|
1 | img.secureserver.net | |
1 | img1.wsimg.com |
globalexchange.com.investment.money-paid.trades-mill-insurance.com
|
1 | cfl.dropboxstatic.com |
globalexchange.com.investment.money-paid.trades-mill-insurance.com
|
1 | www.minterest.com |
globalexchange.com.investment.money-paid.trades-mill-insurance.com
|
1 | ajax.aspnetcdn.com |
globalexchange.com.investment.money-paid.trades-mill-insurance.com
|
19 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://globalexchange.com.investment.money-paid.trades-mill-insurance.com/
Frame ID: D45F928490D64C64BA61FCED8F1E4703
Requests: 20 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
globalexchange.com.investment.money-paid.trades-mill-insurance.com/ |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
globalexchange.com.investment.money-paid.trades-mill-insurance.com/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mss.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/images/ |
873 B 717 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dbdg.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.12.2.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
95 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header.png
globalexchange.com.investment.money-paid.trades-mill-insurance.com/images/ |
59 KB 59 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
image7.png
www.minterest.com/wp-content/uploads/2013/03/ |
26 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select_gif.png
globalexchange.com.investment.money-paid.trades-mill-insurance.com/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
but2_2.png
globalexchange.com.investment.money-paid.trades-mill-insurance.com/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/js/ |
623 B 678 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ps.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vj.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2nd.png
globalexchange.com.investment.money-paid.trades-mill-insurance.com/images/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
create_small_2x-vflRCZOr1.jpg
cfl.dropboxstatic.com/static/images/productivity/ |
24 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3rd.png
globalexchange.com.investment.money-paid.trades-mill-insurance.com/images/ |
33 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dbdg.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vj.js
globalexchange.com.investment.money-paid.trades-mill-insurance.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 637 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| PopupCenterDual function| unhideBody function| $ function| jQuery object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cfl.dropboxstatic.com
globalexchange.com.investment.money-paid.trades-mill-insurance.com
img.secureserver.net
img1.wsimg.com
www.minterest.com
104.111.234.198
107.180.24.235
152.199.19.160
2400:cb00:2048:1::6810:641d
2400:cb00:2048:1::681b:8efe
45.40.130.22
06c8967abd3d5cbf1628a5080a8380f1e609c93c4f176353299eeef063cbd0c9
1274e2a204ce01b495bc70f1e22f71355c8c22f7d079e51651c426577ca2a60f
4d595b823981245e68c3edeca07ff15b79cc908592cebc50133378f6738df424
59973d86265a55215deca2afa6ea7e0e6c8a0e8923159fc424004e71a5ead4ec
6255aadc9a807417c8701fb0ce1da2d70640a358170a7bb7b54b2209df4bcc9f
8f0538245cd10735d3528dc46828580755b1a3525e40216619c00c28c3136457
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
aea8b01d83dfd5f2f65c164b0ef1f033a3fb275935bb51e504d7651ebb17d288
b11b0add6ca98cf5224b66d81ea911b5700f3822dad9c497e5960c89487255b7
cbe4833a5e29077f25ea81e2068df23b20bde5b72e2a7028462707cbc012887a
d92af9df111dc685d9d0863e1e554325ed042a59a4c65867417bd549aa741f59
f24cbb77f2b76d7cec44590ac9aa5588533170a839b64875601bb667591536d6