grandmonumentsohio.com
Open in
urlscan Pro
50.28.33.23
Malicious Activity!
Public Scan
Effective URL: https://grandmonumentsohio.com/wp-utils/B070e5ddf111e0256.php?uau=$bHVjeS5sb21vbmFjb0BiZWxsLmNh&f875df4482c32976c432d33156168f5...
Submission: On November 25 via manual from CA — Scanned from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 4th 2021. Valid for: 3 months.
This is the only time grandmonumentsohio.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 50.28.33.23 50.28.33.23 | 32244 (LIQUIDWEB) (LIQUIDWEB) | |
6 | 1 |
ASN32244 (LIQUIDWEB, US)
PTR: host3.officialmission.com
grandmonumentsohio.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
grandmonumentsohio.com
grandmonumentsohio.com |
589 KB |
6 | 1 |
Domain | Requested by | |
---|---|---|
6 | grandmonumentsohio.com |
grandmonumentsohio.com
|
6 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
grandmonumentsohio.com cPanel, Inc. Certification Authority |
2021-11-04 - 2022-02-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://grandmonumentsohio.com/wp-utils/B070e5ddf111e0256.php?uau=$bHVjeS5sb21vbmFjb0BiZWxsLmNh&f875df4482c32976c432d33156168f59da1a3ccf71e07929d7ef871f146530bf0c8a21b2dd1720656025e4bceabdc974c2ceafda9c638513949546f9037aaa230fb084050d5e579e8afbb88682bc08eddebea11679d5663b1b42
Frame ID: 1283AAB7FB5D7428F13F8C14F157F3FF
Requests: 6 HTTP requests in this frame
Screenshot
Page Title
Netflix netflix-logoPage URL History Show full URLs
- https://grandmonumentsohio.com/wp-utils/index.php?uau=%24bHVjeS5sb21vbmFjb0BiZWxsLmNh Page URL
- https://grandmonumentsohio.com/wp-utils/B070e5ddf111e0256.php?uau=$bHVjeS5sb21vbmFjb0BiZWxsLmNh&f875df4482c... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://grandmonumentsohio.com/wp-utils/index.php?uau=%24bHVjeS5sb21vbmFjb0BiZWxsLmNh Page URL
- https://grandmonumentsohio.com/wp-utils/B070e5ddf111e0256.php?uau=$bHVjeS5sb21vbmFjb0BiZWxsLmNh&f875df4482c32976c432d33156168f59da1a3ccf71e07929d7ef871f146530bf0c8a21b2dd1720656025e4bceabdc974c2ceafda9c638513949546f9037aaa230fb084050d5e579e8afbb88682bc08eddebea11679d5663b1b42 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.php
grandmonumentsohio.com/wp-utils/ |
514 B 722 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
B070e5ddf111e0256.php
grandmonumentsohio.com/wp-utils/ |
14 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
G17bd22067662ed98108.css
grandmonumentsohio.com/wp-utils/Ya1g6b61df024b3f6/ |
158 KB 158 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
X70530868ef1fbcbe.js
grandmonumentsohio.com/wp-utils/Ya1g6b61df024b3f6/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Y5f7412fb995b6d99.jpg
grandmonumentsohio.com/wp-utils/Ya1g6b61df024b3f6/ |
341 KB 341 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Mec3871c32626d4b9.woff
grandmonumentsohio.com/wp-utils/Ya1g6b61df024b3f6/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| removeSpacesFromPAN function| verifyMod10 function| formSub function| logPANentry function| chklog function| checkValue1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
grandmonumentsohio.com/wp-utils | Name: new Value: data |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
grandmonumentsohio.com
50.28.33.23
4cb887a90b524fbbd9c67b9c99675d48bcc28a0fbdf494d12cd1fa531ada20be
71be1154fbf98fe099cc5ea14b19017e720678626245fe124f850412b29caed1
823e19eaf003b34dc7f0ce88c94f5ebb44ac84fb15a00c50c5d48b161c010115
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
99b6e7e990f4f69a5a6c9991da7e4046635ae54642df8ed1b64b7b7a9caf333f
acc65fd08dd6c9f627a4e12b51a95f0ded1b481adb61f8e916e27f31e75f5e83