cleanwaterarizona.com Open in urlscan Pro
165.227.2.7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://infocodek.com/r
Effective URL:
https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fm...
Submission: On August 25 via api (August 25th 2020, 2:30:36 am UTC) from QA

Summary HTTP 11 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 11 HTTP transactions. The main IP is 165.227.2.7, located in Santa Clara, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is cleanwaterarizona.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 12th 2020. Valid for: 3 months.

This is the only time cleanwaterarizona.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1 2	43.255.154.39 43.255.154.39	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1 8	165.227.2.7 165.227.2.7	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	2a04:4e42:600... 2a04:4e42:600::718	54113 (FASTLY) (FASTLY)
11	4

2 43.255.154.39 (Singapore, Singapore) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-43-255-154-39.ip.secureserver.net

infocodek.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 165.227.2.7 (Santa Clara, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

cleanwaterarizona.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a04:4e42:600::718 (Ascension Island)

ASN54113 (FASTLY, US)

ir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	cleanwaterarizona.com 1 redirects cleanwaterarizona.com	53 KB
3	ebaystatic.com ir.ebaystatic.com	10 KB
2	infocodek.com 1 redirects infocodek.com	702 B
11	3

	Domain	Requested by
8	cleanwaterarizona.com	1 redirects cleanwaterarizona.com
3	ir.ebaystatic.com	cleanwaterarizona.com
2	infocodek.com	1 redirects
11	3

This site contains links to these domains. Also see Links.

Domain
www.ebay.com
reg.ebay.com
scgi.ebay.com
www.ebayinc.com
pages.ebay.com
cgi6.ebay.com
trustsealinfo.websecurity.norton.com

Subject Issuer	Validity	Valid
cleanwaterarizona.com Let's Encrypt Authority X3	`2020-08-12` - `2020-11-10`	3 months	crt.sh
ir.ebaystatic.com DigiCert SHA2 Secure Server CA	`2019-12-17` - `2021-01-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0
Frame ID: CEDCCF6F269C7C5160AAB834EECCBD33
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://infocodek.com/r HTTP 301
http://infocodek.com/r/ Page URL
https://cleanwaterarizona.com/ws1?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857... HTTP 301
https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=206285... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

91 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

63 kB
Transfer

155 kB
Size

0
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ebay.com/
Title: eBay

Search URL Search Domain Scan URL

URL: https://reg.ebay.com/reg/PartialReg?siteid=0&co_partnerId=0&UsingSSL=1&rv4=1&signInUrl=
Title: Create an account

Search URL Search Domain Scan URL

URL: https://www.ebay.com/signin/?otpFyp=1
Title: Text a temporary password

Search URL Search Domain Scan URL

URL: https://scgi.ebay.com/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&otpFyp=1&siteid=0&co_partnerId=0&signInUrl=https%3A%2F%2Fwww.ebay.com%2Fsignin%3Ffyp%3Dsgn%26siteid%3D0%26co_partnerId%3D0
Title: Reset your password

Search URL Search Domain Scan URL

URL: https://www.ebayinc.com/accessibility/
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://pages.ebay.com/help/policies/user-agreement.html
Title: User Agreement

Search URL Search Domain Scan URL

URL: https://pages.ebay.com/help/policies/privacy-policy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://pages.ebay.com/help/account/cookies-web-beacons.html
Title: Cookies

Search URL Search Domain Scan URL

URL: https://cgi6.ebay.com/ws/eBayISAPI.dll?AdChoiceLandingPage&partner=0
Title: AdChoice

Search URL Search Domain Scan URL

URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.com&lang=en
Title: Norton Secured - powered by Verisign

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://infocodek.com/r HTTP 301
http://infocodek.com/r/ Page URL
https://cleanwaterarizona.com/ws1?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0 HTTP 301
https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://infocodek.com/r HTTP 301
http://infocodek.com/r/

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
infocodek.com/r/
Redirect Chain

http://infocodek.com/r
http://infocodek.com/r/

215 B
467 B

185ms
185ms

Document
text/html

43.255.154.39
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://infocodek.com/r/
Protocol: HTTP/1.1
Server: 43.255.154.39 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-43-255-154-39.ip.secureserver.net
Software: Apache / PHP/7.3.20
Resource Hash: 8a346df5c2e5a933f74beff32f1b7834b707962f295731cdd2f01fdb7fe84c66

Request headers

Host: infocodek.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:17 GMT
Server: Apache
X-Powered-By: PHP/7.3.20
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 203
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Tue, 25 Aug 2020 02:30:17 GMT
Server: Apache
Location: http://infocodek.com/r/
Content-Length: 231
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1

200
OK

Primary Request / Show response
cleanwaterarizona.com/ws1/
Redirect Chain

https://cleanwaterarizona.com/ws1?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0
https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0

11 KB
4 KB

168ms
168ms

Document
text/html

165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

580d3fb797edb576f2624d1757e084fd59c258e3c445d45ed082aae76d4a7f93

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Host: cleanwaterarizona.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: http://infocodek.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://infocodek.com/r/

Response headers

Server: nginx
Date: Tue, 25 Aug 2020 02:30:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: sameorigin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Referrer-Policy: strict-origin
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Tue, 25 Aug 2020 02:30:18 GMT
Content-Type: text/html
Content-Length: 178
Location: https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0
Connection: keep-alive
X-Frame-Options: sameorigin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Referrer-Policy: strict-origin

GET
H/1.1 200
OK 2css.css
cleanwaterarizona.com/ws1/css/ 4 KB
4 KB 167ms
166ms Stylesheet
text/css 165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://cleanwaterarizona.com/ws1/css/2css.css

Requested by

Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

05830fdef4ed02fa522186d6b44ff242fbdec217f36fb1fe7a7df98abe05bfd1

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:18 GMT
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Connection: keep-alive
Content-Length: 3712
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin
Last-Modified: Mon, 24 Aug 2020 15:15:48 GMT
Server: nginx
ETag: "5f43d9a4-e80"
X-Download-Options: noopen
X-Frame-Options: sameorigin
Content-Type: text/css
Cache-Control: max-age=86400
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Accept-Ranges: bytes
Expires: Wed, 26 Aug 2020 02:30:18 GMT

GET
H/1.1 200
OK 1css.css
cleanwaterarizona.com/ws1/css/ 126 KB
39 KB 489ms
322ms Stylesheet
text/css 165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://cleanwaterarizona.com/ws1/css/1css.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

89f24c431c8908235d3ed3defb37af7d20b485a51734e8e84da555fd9283186e

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:18 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin
Last-Modified: Mon, 24 Aug 2020 15:15:45 GMT
Server: nginx
X-Frame-Options: sameorigin
ETag: W/"5f43d9a1-1f7ea"
X-Download-Options: noopen
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=86400
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Expires: Wed, 26 Aug 2020 02:30:18 GMT

GET
H/1.1 500
Internal Server Error GlanceCobrowseLoader_4.js
cleanwaterarizona.com/ws1/css/ 0
0 466ms
158ms Script
text/html 165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cleanwaterarizona.com/ws1/css/GlanceCobrowseLoader_4.js
Requested by: Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:18 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 500
Internal Server Error GlancePresenceVisitor_4.js
cleanwaterarizona.com/ws1/css/ 0
0 469ms
159ms Script
text/html 165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cleanwaterarizona.com/ws1/css/GlancePresenceVisitor_4.js
Requested by: Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:18 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 1png.png
cleanwaterarizona.com/ws1/css/ 5 KB
5 KB 155ms
154ms Image
image/png 165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cleanwaterarizona.com/ws1/css/1png.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:19 GMT
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Connection: keep-alive
Content-Length: 4820
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin
Last-Modified: Mon, 24 Aug 2020 15:15:51 GMT
Server: nginx
ETag: "5f43d9a7-12d4"
X-Download-Options: noopen
X-Frame-Options: sameorigin
Content-Type: image/png
Cache-Control: max-age=86400
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Accept-Ranges: bytes
Expires: Wed, 26 Aug 2020 02:30:19 GMT

GET
H/1.1 500
Internal Server Error GlancePresenceVisitor_4.js
cleanwaterarizona.com/ws1/css/ 0
0 169ms
168ms Script
text/html 165.227.2.7
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cleanwaterarizona.com/ws1/css/GlancePresenceVisitor_4.js
Requested by: Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/?eBayISAPI.dll?SignIn&UsingSSL=1&siteid=0&co_partnerId=2&pageType=2062857&ru=https%3A%2F%2Fmesg.ebay.com%2Fmesgweb%2FViewMessages%2F0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 165.227.2.7 Santa Clara, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 25 Aug 2020 02:30:19 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 sgninui-src-static-images-google-logo-icon-PNG-Transparent-Background-67e4c5b2.png
ir.ebaystatic.com/rs/c/ 7 KB
7 KB 30ms
7ms Image
image/png 2a04:4e42:600::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/c/sgninui-src-static-images-google-logo-icon-PNG-Transparent-Background-67e4c5b2.png
Requested by: Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/css/1css.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: 56fbf97dc6629d06d83590f3c759381dacd1f6dfcd0f8af956ca3ab15b10e699

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 25 Aug 2020 02:30:19 GMT
via: 1.1 include-cache-0 (squid), 1.1 varnish
x-cache-lookup: HIT from include-cache-0:80
age: 51983
x-cache: HIT from include-cache-0, HIT
status: 200
x-cache-hits: 1
x-ebay-c-version: 1.0.0
content-length: 6886
x-served-by: cache-fra19177-FRA
last-modified: Tue, 18 Sep 2018 21:23:43 GMT
server: ebay server
x-timer: S1598322619.239875,VS0,VE1
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dqkiufvuq%60%28%60koke*w%60ut3541-174205a7e3c-0xda
accept-ranges: bytes
access-control-allow-headers: *
expires: Tue, 24 Aug 2021 12:03:55 GMT

GET
H2 200 sgninui-src-static-images-FB-f-Logo__white_29-366f0bd1.png
ir.ebaystatic.com/rs/c/ 1 KB
1 KB 30ms
7ms Image
image/png 2a04:4e42:600::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/c/sgninui-src-static-images-FB-f-Logo__white_29-366f0bd1.png
Requested by: Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/css/1css.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: 53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 25 Aug 2020 02:30:19 GMT
via: 1.1 lvsaz01includecache-971932 (squid), 1.1 varnish
x-cache-lookup: HIT from lvsaz01includecache-971932:80
age: 15409975
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%28045214-1708cf223a2-0xb0
x-cache: HIT from lvsaz01includecache-971932, HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 1201
x-served-by: cache-fra19177-FRA
last-modified: Tue, 24 Jul 2018 23:37:11 GMT
server: ebay server
x-timer: S1598322619.239862,VS0,VE1
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
expires: Sat, 27 Feb 2021 17:57:24 GMT
cache-control: public, max-age=31536000, immutable
warning: 113 lvsaz01includecache-971932 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 1708cf22-3a20-ac73-1a42-3ea7fc2a5b01![
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 1

GET
DATA 200
OK truncated
/ 725 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 f5uxsy10bmz05dtrtrqybl5qquv.png
ir.ebaystatic.com/rs/v/ 994 B
2 KB 28ms
6ms Image
image/png 2a04:4e42:600::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/v/f5uxsy10bmz05dtrtrqybl5qquv.png
Requested by: Host: cleanwaterarizona.com
URL: https://cleanwaterarizona.com/ws1/css/2css.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:600::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: 7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0

Request headers

Referer: https://cleanwaterarizona.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 25 Aug 2020 02:30:19 GMT
via: 1.1 lvsaz01includecache-971932 (squid), 1.1 varnish
x-cache-lookup: HIT from lvsaz01includecache-971932:80
age: 15452639
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%285610%3F4%3B-1708a6721f5-0xb6
x-cache: HIT from lvsaz01includecache-971932, HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 994
x-served-by: cache-fra19177-FRA
last-modified: Fri, 12 Feb 2016 00:01:35 GMT
server: ebay server
x-timer: S1598322619.239849,VS0,VE0
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
expires: Sat, 27 Feb 2021 06:06:19 GMT
cache-control: public, max-age=31536000, immutable
warning: 113 lvsaz01includecache-971932 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 1708a672-1f50-aa13-c415-5af7fc2f520c![
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 68495

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cleanwaterarizona.com
infocodek.com
ir.ebaystatic.com
165.227.2.7
2a04:4e42:600::718
43.255.154.39
05830fdef4ed02fa522186d6b44ff242fbdec217f36fb1fe7a7df98abe05bfd1
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
56fbf97dc6629d06d83590f3c759381dacd1f6dfcd0f8af956ca3ab15b10e699
580d3fb797edb576f2624d1757e084fd59c258e3c445d45ed082aae76d4a7f93
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
89f24c431c8908235d3ed3defb37af7d20b485a51734e8e84da555fd9283186e
8a346df5c2e5a933f74beff32f1b7834b707962f295731cdd2f01fdb7fe84c66

cleanwaterarizona.com Open in urlscan Pro 165.227.2.7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

91 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

63 kBTransfer

155 kBSize

0 Cookies

10 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

cleanwaterarizona.com Open in urlscan Pro
165.227.2.7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

91 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

63 kB
Transfer

155 kB
Size

0
Cookies

11 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!