eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com Open in urlscan Pro
144.76.162.245 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
Submission: On September 14 via manual (September 14th 2021, 12:53:24 am UTC) from IN — Scanned from DE

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 5 domains to perform 5 HTTP transactions. The main IP is 144.76.162.245, located in Tettnang Castle, Germany and belongs to HETZNER-AS, DE. The main domain is eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com.

This is the only time eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	144.76.162.245 144.76.162.245	24940 (HETZNER-AS) (HETZNER-AS)
1	142.250.102.138 142.250.102.138	15169 (GOOGLE) (GOOGLE)
1	104.21.27.48 104.21.27.48	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.102.95 142.250.102.95	15169 (GOOGLE) (GOOGLE)
1	201.64.158.250 201.64.158.250	4230 (CLARO S.A.) (CLARO S.A.)
5	6

1 144.76.162.245 (Tettnang Castle, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: master2.subdomain.com

eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.102.138 (United States)

ASN15169 (GOOGLE, US)
PTR: rb-in-f138.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.27.48 (None, )

ASN13335 (CLOUDFLARENET, US)

casavini.com.mt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.102.95 (United States)

ASN15169 (GOOGLE, US)
PTR: rb-in-f95.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 201.64.158.250 (Brazil)

ASN4230 (CLARO S.A., BR)

www.brasoftware.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	brasoftware.com.br www.brasoftware.com.br	33 KB
1	googleapis.com ajax.googleapis.com	31 KB
1	casavini.com.mt casavini.com.mt	677 KB
1	google-analytics.com www.google-analytics.com	17 KB
1	exzu.com eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com	9 KB
5	5

	Domain	Requested by
1	www.brasoftware.com.br	casavini.com.mt
1	ajax.googleapis.com	casavini.com.mt
1	casavini.com.mt	eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
1	www.google-analytics.com	eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
1	eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
5	5

This site contains no links.

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-12` - `2022-07-11`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.brasoftware.com.br GeoTrust RSA CA 2018	`2020-09-21` - `2021-10-23`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
Frame ID: B034352968DA3468AE5D7C347B50519F
Requests: 7 HTTP requests in this frame

Frame: https://casavini.com.mt/wp-admin/images//imind.html?t=document
Frame ID: 09681B33B8A9644651FB68F00E62398C
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

767 kB
Transfer

2806 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.google-analytics.com/ga.js HTTP 307
https://www.google-analytics.com/ga.js

5 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.0 200
OK Primary Request / Show response
eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/ 31 KB
9 KB 58ms
23ms Document
text/html 144.76.162.245
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
Protocol: HTTP/1.0
Server: 144.76.162.245 Tettnang Castle, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: master2.subdomain.com
Software: Apache/2.4.10 (Debian) /
Resource Hash: 20ab434cc0dd29c3ace5ab8960b624edb3d9160a53eaba64d0071ec50f1ecb81

Request headers

Host: eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Tue, 14 Sep 2021 00:53:20 GMT
Server: Apache/2.4.10 (Debian)
Content-Encoding: gzip
Content-Length: 9218
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H2

200

ga.js Show response
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/ga.js
https://www.google-analytics.com/ga.js

45 KB
17 KB

74ms
21ms

Script
text/javascript

142.250.102.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/ga.js

Requested by

Host: eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
URL: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.102.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

rb-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4278
date: Mon, 13 Sep 2021 23:42:02 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Tue, 14 Sep 2021 01:42:02 GMT

Redirect headers

Location: https://www.google-analytics.com/ga.js
Non-Authoritative-Reason: HSTS

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 487134547939d7e4874909f045b67b8232cb0a445ebce71aa85aaa5db4744f0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8e05fce5f98ca525ed88502ec94c43763661ea74e0f84e5625a7ed161c28447f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d92fb73d4422ab97f4c170639dde5d2f11a3ebdb601a44ce2ab9de104b2da103

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717cc576a1098d7bc9cfc06b4f908024e6f07009879a6e1f55ccc04f4a833437

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 889 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f9b1f894802acbe8d4916a787d0c221e8826ddb9db42ec09380b2f3489092c8f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 imind.html Show response
casavini.com.mt/wp-admin/images// Frame 0968 2 MB
677 KB 514ms
427ms Document
text/html 104.21.27.48
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://casavini.com.mt/wp-admin/images//imind.html?t=document
Requested by: Host: eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
URL: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.27.48 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ec9e9406b000e6079003434f4cac643fcf28d7daf6690ee8f9c99c04dd633c5

Request headers

:method: GET
:authority: casavini.com.mt
:scheme: https
:path: /wp-admin/images//imind.html?t=document
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com/

Response headers

date: Tue, 14 Sep 2021 00:53:20 GMT
content-type: text/html
last-modified: Mon, 13 Sep 2021 22:33:02 GMT
vary: Accept-Encoding
host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WR77scY9pdoUWqOTj8719RAQPhwgUYsw1Siwd3lGXqshGwiai2Lf3Cinq3xq0SNlyJwYXyHueH9Z4hlqAyCzHOEKACI5LgN60e7N7SOpBhKh7nGarziu6KKxjZePTbCGgFI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 68e5a341dee03aa5-CDG
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ Frame 0968 87 KB
31 KB 73ms
22ms Script
text/javascript 142.250.102.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: casavini.com.mt
URL: https://casavini.com.mt/wp-admin/images//imind.html?t=document

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.102.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

rb-in-f95.1e100.net

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://casavini.com.mt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 21:53:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 269996
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Sep 2022 21:53:25 GMT

GET
H/1.1 200
OK icon-adobesign.png
www.brasoftware.com.br/Imagens/Tecnologias/CreativeCloud/ Frame 0968 32 KB
33 KB 1389ms
460ms Image
image/png 201.64.158.250
CLARO S.A.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.brasoftware.com.br/Imagens/Tecnologias/CreativeCloud/icon-adobesign.png

Requested by

Host: casavini.com.mt
URL: https://casavini.com.mt/wp-admin/images//imind.html?t=document

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_CBC

Server

201.64.158.250 , Brazil, ASN4230 (CLARO S.A., BR),

Reverse DNS

Software

Microsoft-IIS/8.0 / ASP.NET

Resource Hash

def0a0a1f63141a5ed1a2e26af61e3f15b710fc2fd1ac8db3b43929dc944637a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://casavini.com.mt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Referrer-Policy: no-referrer
Last-Modified: Wed, 14 Oct 2020 14:46:14 GMT
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
ETag: "dbb62cc438a2d61:0"
X-Frame-Options: DENY
Content-Type: image/png
X-Permitted-Cross-Domain-Policies: none
Date: Tue, 14 Sep 2021 00:52:39 GMT
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Accept-Ranges: bytes
Content-Length: 32834
X-Content-Type-Options: nosniff

GET
DATA 200
OK truncated
/ Frame 0968 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c70f85e34cc7de828460aa43450e4c28ecee90420942cf948bcc0daf08e08b15

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0968 356 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bbb22484b6ac90a9bcddc4158e5b530c078c475b78ceab0a9873719ec7e87eb9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0968 419 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6a21968cb04f33fe36deb8e9d1f75b0391e14f47f72fd4403d0e94dd411b5ca3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://casavini.com.mt/wp-admin/images//imind.html?t=document(Line 170) Message: Blocked autofocusing on a <input> element in a cross-origin subframe.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
casavini.com.mt
eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com
www.brasoftware.com.br
www.google-analytics.com
104.21.27.48
142.250.102.138
142.250.102.95
144.76.162.245
201.64.158.250
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1ec9e9406b000e6079003434f4cac643fcf28d7daf6690ee8f9c99c04dd633c5
20ab434cc0dd29c3ace5ab8960b624edb3d9160a53eaba64d0071ec50f1ecb81
487134547939d7e4874909f045b67b8232cb0a445ebce71aa85aaa5db4744f0e
6a21968cb04f33fe36deb8e9d1f75b0391e14f47f72fd4403d0e94dd411b5ca3
717cc576a1098d7bc9cfc06b4f908024e6f07009879a6e1f55ccc04f4a833437
8e05fce5f98ca525ed88502ec94c43763661ea74e0f84e5625a7ed161c28447f
bbb22484b6ac90a9bcddc4158e5b530c078c475b78ceab0a9873719ec7e87eb9
c70f85e34cc7de828460aa43450e4c28ecee90420942cf948bcc0daf08e08b15
d92fb73d4422ab97f4c170639dde5d2f11a3ebdb601a44ce2ab9de104b2da103
def0a0a1f63141a5ed1a2e26af61e3f15b710fc2fd1ac8db3b43929dc944637a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f9b1f894802acbe8d4916a787d0c221e8826ddb9db42ec09380b2f3489092c8f

eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com Open in urlscan Pro 144.76.162.245 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

6 IPs

4 Countries

767 kBTransfer

2806 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

eowtgsgbsxalsqttkoaz0q70mc1q4lfdknkby6ws.exzu.com Open in urlscan Pro
144.76.162.245 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

6
IPs

4
Countries

767 kB
Transfer

2806 kB
Size

0
Cookies

5 HTTP transactions
8 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!