vzwtermdiscounts.com Open in urlscan Pro
184.168.131.241 Malicious Activity! Public Scan

URL:
http://vzwtermdiscounts.com/
Submission: On April 25 via manual (April 25th 2021, 11:13:28 pm UTC) from US

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 184.168.131.241, located in United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is vzwtermdiscounts.com.

This is the only time vzwtermdiscounts.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Verizon (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	184.168.131.241 184.168.131.241	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1 2	192.185.32.223 192.185.32.223	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2	3

1 184.168.131.241 (United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net

vzwtermdiscounts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.185.32.223 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-32-223.unifiedlayer.com

albertrosen.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	albertrosen.com 1 redirects albertrosen.com	227 KB
1	vzwtermdiscounts.com vzwtermdiscounts.com	533 B
2	2

	Domain	Requested by
2	albertrosen.com	1 redirects vzwtermdiscounts.com
1	vzwtermdiscounts.com
2	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://vzwtermdiscounts.com/
Frame ID: 06FF460834C928E840268FA85B969AEF
Requests: 1 HTTP requests in this frame

Frame: http://albertrosen.com/images/v/
Frame ID: B1D0F7D2C64D2E27E05B7F136495A5EE
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

355 kB
Transfer

477 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://albertrosen.com/images/v HTTP 301
http://albertrosen.com/images/v/

2 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response vzwtermdiscounts.com/	356 B 533 B	397ms 373ms	Document text/html	184.168.131.241 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL http://vzwtermdiscounts.com/ Protocol HTTP/1.1 Server 184.168.131.241 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-184-168-131-241.ip.secureserver.net Software nginx/1.16.1 / Resource Hash `4f52075eddacc892f7e956ebab3139f07e51c1fbe50a6b0d460bd706668ba8d2` Request headers Host vzwtermdiscounts.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server nginx/1.16.1 Date Sun, 25 Apr 2021 23:13:09 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection close
GET H/1.1	200 OK	/ Show response albertrosen.com/images/v/ Frame B1D0 Redirect Chain http://albertrosen.com/images/v http://albertrosen.com/images/v/	339 KB 226 KB	837ms 837ms	Document text/html	192.185.32.223 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://albertrosen.com/images/v/ Requested by Host: vzwtermdiscounts.com URL: http://vzwtermdiscounts.com/ Protocol HTTP/1.1 Server 192.185.32.223 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-32-223.unifiedlayer.com Software Apache / Resource Hash `82415bc25e85a52f5bb6dbf6756ccab499ad224756def34485dcb773402b8b28` Request headers Host albertrosen.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://vzwtermdiscounts.com/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://vzwtermdiscounts.com/ Response headers Date Sun, 25 Apr 2021 23:13:10 GMT Server Apache Vary Accept-Encoding Content-Encoding gzip Keep-Alive timeout=5, max=74 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Sun, 25 Apr 2021 23:13:10 GMT Server Apache Location http://albertrosen.com/images/v/ Content-Length 240 Keep-Alive timeout=5, max=75 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated / Frame B1D0	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f5e2bfc852795fccb848c4d20732043efa7eeaeaec9922d794f9b065f54d83aa` Request headers Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated / Frame B1D0	43 KB 43 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `2b50e0a3ad918478d346c4b7141798a5379067ad2d3c0141dfa2ad6d13234e12` Request headers Origin http://albertrosen.com Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated / Frame B1D0	608 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c7177fabb0104ef5c5aba7d6f78980eb8ce8aa48ec64dac9150f6db5469260d5` Request headers Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated / Frame B1D0	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `afd720816fec9fb9f21ecd6ee741f83730f9c9ac3ca7b79d530df3f12f99ca9b` Request headers Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame B1D0	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5559d92d6c5ff3e999d02feb5ba97fa608252347ad8d33c38dfd21892a5df3c0` Request headers Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated / Frame B1D0	42 KB 42 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b1e45351cfa1020bfa509335485d0c6bae80acf2e91b63398dfe373958906dc5` Request headers Origin http://albertrosen.com Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated / Frame B1D0	43 KB 43 KB		Font application/x-font-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1f689953c0c5d35f16fa360279c0197c46aa06c0e0b94f074cfcd9273a959197` Request headers Origin http://albertrosen.com Referer http://albertrosen.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/x-font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Verizon (Telecommunication)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

albertrosen.com
vzwtermdiscounts.com
184.168.131.241
192.185.32.223
1f689953c0c5d35f16fa360279c0197c46aa06c0e0b94f074cfcd9273a959197
2b50e0a3ad918478d346c4b7141798a5379067ad2d3c0141dfa2ad6d13234e12
4f52075eddacc892f7e956ebab3139f07e51c1fbe50a6b0d460bd706668ba8d2
5559d92d6c5ff3e999d02feb5ba97fa608252347ad8d33c38dfd21892a5df3c0
82415bc25e85a52f5bb6dbf6756ccab499ad224756def34485dcb773402b8b28
afd720816fec9fb9f21ecd6ee741f83730f9c9ac3ca7b79d530df3f12f99ca9b
b1e45351cfa1020bfa509335485d0c6bae80acf2e91b63398dfe373958906dc5
c7177fabb0104ef5c5aba7d6f78980eb8ce8aa48ec64dac9150f6db5469260d5
f5e2bfc852795fccb848c4d20732043efa7eeaeaec9922d794f9b065f54d83aa

vzwtermdiscounts.com Open in urlscan Pro 184.168.131.241 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

2 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

355 kBTransfer

477 kBSize

0 Cookies

0 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

vzwtermdiscounts.com Open in urlscan Pro
184.168.131.241 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

355 kB
Transfer

477 kB
Size

0
Cookies

2 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!