urlscan.io logo urlscan.io
SecurityTrails logo

news.accessvegas.com Open in urlscan Pro
2400:cb00:2048:1::681c:7fa  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://ow.ly/Fw6D30f9TTR
Effective URL: http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Submission: On September 14 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2400:cb00:2048:1::681c:7fa, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is news.accessvegas.com.
This is the only time news.accessvegas.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 54.67.57.56 16509 (AMAZON-02)
1 1 23.21.86.180 14618 (AMAZON-AES)
3 6 2400:cb00:204... 13335 (CLOUDFLAR...)
1 2400:cb00:204... 13335 (CLOUDFLAR...)
4 2
Apex Domain
Subdomains		 Transfer
7 accessvegas.com
news.accessvegas.com
335 KB
1 hyperurl.co
hyperurl.co
755 B
1 ow.ly
ow.ly
109 B
4 3
Domain Requested by
7 news.accessvegas.com 3 redirects news.accessvegas.com
1 hyperurl.co 1 redirects
1 ow.ly 1 redirects
4 3

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Frame ID: 17043.1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://ow.ly/Fw6D30f9TTR HTTP 301
    http://hyperurl.co/uv26d8 HTTP 301
    http://news.accessvegas.com/blessup/ghost HTTP 301
    http://news.accessvegas.com/blessup/ghost/ HTTP 302
    http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b HTTP 301
    http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Page Statistics

4
Requests

0 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

335 kB
Transfer

337 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ow.ly/Fw6D30f9TTR HTTP 301
    http://hyperurl.co/uv26d8 HTTP 301
    http://news.accessvegas.com/blessup/ghost HTTP 301
    http://news.accessvegas.com/blessup/ghost/ HTTP 302
    http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b HTTP 301
    http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Redirect Chain
  • http://ow.ly/Fw6D30f9TTR
  • http://hyperurl.co/uv26d8
  • http://news.accessvegas.com/blessup/ghost
  • http://news.accessvegas.com/blessup/ghost/
  • http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b
  • http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::681c:7fa , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
9fe81d1ea24ef23b5355a9d107ff6d6d23dced58137323bdfb995c5ab1cbb417

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Thu, 14 Sep 2017 19:20:56 GMT
Content-Encoding
gzip
Last-Modified
Thu, 14 Sep 2017 19:20:55 GMT
Server
cloudflare-nginx
Transfer-Encoding
chunked
Content-Type
text/html
Connection
keep-alive
CF-RAY
39e5b4d5676e2708-FRA

Redirect headers

Location
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Date
Thu, 14 Sep 2017 19:20:55 GMT
Server
cloudflare-nginx
Connection
keep-alive
CF-RAY
39e5b4d4a6ec2708-FRA
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
dr1.png
news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/index_files/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/index_files/dr1.png
Requested by
Host: news.accessvegas.com
URL: http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::681c:7fa , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
27c5cb589eabb52c39ca1cffe3ee682bb6847dac8844cc23c16230d6f322d52f

Request headers

Referer
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Thu, 14 Sep 2017 19:20:56 GMT
CF-Cache-Status
MISS
Last-Modified
Thu, 14 Sep 2017 19:20:55 GMT
Server
cloudflare-nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
39e5b4d620052708-FRA
Content-Length
7904
Expires
Thu, 14 Sep 2017 23:20:56 GMT
dr2.png
news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/index_files/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/index_files/dr2.png
Requested by
Host: news.accessvegas.com
URL: http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::681c:7fa , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
e36f9564f0bc7e07b57f7418accf994812c3b7783d028a7483fbb9c3b385d3a4

Request headers

Referer
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Thu, 14 Sep 2017 19:20:56 GMT
CF-Cache-Status
MISS
Last-Modified
Thu, 14 Sep 2017 19:20:55 GMT
Server
cloudflare-nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
39e5b4d6367008a5-FRA
Content-Length
25757
Expires
Thu, 14 Sep 2017 23:20:56 GMT
max.png
news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/index_files/ 		301 KB
301 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/index_files/max.png
Requested by
Host: news.accessvegas.com
URL: http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
Protocol
HTTP/1.1
Server
2400:cb00:2048:1::681c:6fa , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),
Reverse DNS
Software
cloudflare-nginx /
Resource Hash
1a82fa67943ca9c135d3f5c570fdcd56869660b6b6b28c59e6debb5c133d40a0

Request headers

Referer
http://news.accessvegas.com/blessup/ghost/0e565c650735b8545b46a36fbd44699b/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Thu, 14 Sep 2017 19:20:56 GMT
CF-Cache-Status
MISS
Last-Modified
Thu, 14 Sep 2017 19:20:55 GMT
Server
cloudflare-nginx
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
39e5b4d625e52384-FRA
Content-Length
307760
Expires
Thu, 14 Sep 2017 23:20:56 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
.accessvegas.com/ Name: __cfduid
Value: d19acc94345f7f6033d9bb296078e930b1505416855