legendcomicsandcoffee.com Open in urlscan Pro
173.44.39.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://legendcomicsandcoffee.com/test/wstpc/post1.php
Effective URL:
http://legendcomicsandcoffee.com/test/wstpc/step2.php
Submission: On August 05 via automatic, source phishtank (August 5th 2020, 6:29:13 pm UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 173.44.39.15, located in Miami, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is legendcomicsandcoffee.com.

This is the only time legendcomicsandcoffee.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Westpac (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 9	173.44.39.15 173.44.39.15		8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
8	1

9 173.44.39.15 (Miami, United States) 1 redirects

ASN8100 (ASN-QUADRANET-GLOBAL, US)
PTR: server44.01domain.net

legendcomicsandcoffee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	legendcomicsandcoffee.com 1 redirects legendcomicsandcoffee.com	50 KB
8	1

	Domain	Requested by
9	legendcomicsandcoffee.com	1 redirects legendcomicsandcoffee.com
8	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://legendcomicsandcoffee.com/test/wstpc/step2.php
Frame ID: 455B88BE4A178D4DE4C7154A565B7D4E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://legendcomicsandcoffee.com/test/wstpc/post1.php HTTP 302
http://legendcomicsandcoffee.com/test/wstpc/step2.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

50 kB
Transfer

48 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://legendcomicsandcoffee.com/test/wstpc/post1.php HTTP 302
http://legendcomicsandcoffee.com/test/wstpc/step2.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request step2.php Show response legendcomicsandcoffee.com/test/wstpc/ Redirect Chain http://legendcomicsandcoffee.com/test/wstpc/post1.php http://legendcomicsandcoffee.com/test/wstpc/step2.php	8 KB 8 KB	234ms 234ms	Document text/html	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Full URL http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `2f9337e48f79ef78374db86a24ad01e818b99721e012987e1717a3aab5ad75cd` Request headers Host legendcomicsandcoffee.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Wed, 05 Aug 2020 18:28:55 GMT Server Apache Location step2.php Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	w11.png legendcomicsandcoffee.com/test/wstpc/images/	21 KB 21 KB	164ms 163ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/w11.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `534ce038c2d96fd751a0e1a49de51c1cd94cadbabd32339ecb8b80c23ed6236b` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 01:53:50 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 21744
GET H/1.1	200 OK	w12.png legendcomicsandcoffee.com/test/wstpc/images/	7 KB 7 KB	165ms 164ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/w12.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `1fc888b127dd9fca4927d5cb3c0bb0d05ce8c38cb41e385d4294f14c68cd14f5` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 02:54:24 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 7369
GET H/1.1	200 OK	w13.png legendcomicsandcoffee.com/test/wstpc/images/	7 KB 7 KB	388ms 353ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/w13.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `a9b9ce47590a6d8fd75a8fd57bc14e4d58e8c40194795925f0693c74ba43cd3e` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 02:55:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7278
GET H/1.1	200 OK	logo.png legendcomicsandcoffee.com/test/wstpc/images/	962 B 1 KB	331ms 297ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/logo.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `8e45cd28373a54151cfda9e1ae013e7f3e827296118ee6a8c2bfdbf28b2944b5` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 01:57:20 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 962
GET H/1.1	200 OK	w14.png legendcomicsandcoffee.com/test/wstpc/images/	2 KB 3 KB	329ms 294ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/w14.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `6cac435dd560f79f146677c3f5e496b9d1df597d104e275df7eca06868f4b1bc` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 02:14:46 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2455
GET H/1.1	200 OK	cncel.png legendcomicsandcoffee.com/test/wstpc/images/	426 B 667 B	327ms 164ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/cncel.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `6e0512b6be18f618398ce1dde91e84292151e322089fc304af12d274ae9b28fe` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 01:57:06 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 426
GET H/1.1	200 OK	submit.png legendcomicsandcoffee.com/test/wstpc/images/	686 B 928 B	314ms 289ms	Image image/png	173.44.39.15 ASN-QUADRANET-GLOBAL
General Check archive.org Show headers Download Go to Show image Full URL http://legendcomicsandcoffee.com/test/wstpc/images/submit.png Requested by Host: legendcomicsandcoffee.com URL: http://legendcomicsandcoffee.com/test/wstpc/step2.php Protocol HTTP/1.1 Server 173.44.39.15 Miami, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US), Reverse DNS server44.01domain.net Software Apache / Resource Hash `c33a2d9a18cc52bfb376fb0feeb99e07733469ce7ee37013054e1b05502a1bb9` Request headers Referer http://legendcomicsandcoffee.com/test/wstpc/step2.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 05 Aug 2020 18:28:56 GMT Last-Modified Thu, 29 Jun 2017 01:56:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 686

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Westpac (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| unhideBody

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

legendcomicsandcoffee.com
173.44.39.15
1fc888b127dd9fca4927d5cb3c0bb0d05ce8c38cb41e385d4294f14c68cd14f5
2f9337e48f79ef78374db86a24ad01e818b99721e012987e1717a3aab5ad75cd
534ce038c2d96fd751a0e1a49de51c1cd94cadbabd32339ecb8b80c23ed6236b
6cac435dd560f79f146677c3f5e496b9d1df597d104e275df7eca06868f4b1bc
6e0512b6be18f618398ce1dde91e84292151e322089fc304af12d274ae9b28fe
8e45cd28373a54151cfda9e1ae013e7f3e827296118ee6a8c2bfdbf28b2944b5
a9b9ce47590a6d8fd75a8fd57bc14e4d58e8c40194795925f0693c74ba43cd3e
c33a2d9a18cc52bfb376fb0feeb99e07733469ce7ee37013054e1b05502a1bb9

legendcomicsandcoffee.com Open in urlscan Pro 173.44.39.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

50 kBTransfer

48 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

legendcomicsandcoffee.com Open in urlscan Pro
173.44.39.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

50 kB
Transfer

48 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!