dwameza.net Open in urlscan Pro
89.163.237.217 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Submission: On December 20 via automatic, source openphish (December 20th 2019, 12:46:22 am UTC)

Summary HTTP 33 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 9 domains to perform 33 HTTP transactions. The main IP is 89.163.237.217, located in Germany and belongs to MYLOC-AS, DE. The main domain is dwameza.net.

This is the only time dwameza.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
21	89.163.237.217 89.163.237.217	24961 (MYLOC-AS) (MYLOC-AS)
1	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
5	23.8.3.125 23.8.3.125	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	152.199.23.241 152.199.23.241	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:400c:c04::9a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	151.101.14.110 151.101.14.110	54113 (FASTLY) (FASTLY - Fastly)
1	162.247.242.21 162.247.242.21	23467 (NEWRELIC-...) (NEWRELIC-AS-1 - New Relic)
33	9

21 89.163.237.217 (Germany)

ASN24961 (MYLOC-AS, DE)
PTR: node1.1und1.myloc-managedhosting.de

dwameza.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.8.3.125 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-8-3-125.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.23.241 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9a (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.110 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.242.21 (San Francisco, United States)

ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-9.nr-data.net

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	dwameza.net dwameza.net	623 KB
5	wsimg.com img1.wsimg.com	244 KB
1	nr-data.net bam.nr-data.net	254 B
1	newrelic.com js-agent.newrelic.com	9 KB
1	doubleclick.net stats.g.doubleclick.net	17 KB
1	googletagmanager.com www.googletagmanager.com	20 KB
1	tiqcdn.com tags.tiqcdn.com	58 KB
1	google-analytics.com www.google-analytics.com	793 B
0	convertro.com Failed godaddy.sp1.convertro.com Failed
33	9

	Domain	Requested by
21	dwameza.net	dwameza.net
5	img1.wsimg.com	dwameza.net
1	bam.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	dwameza.net
1	stats.g.doubleclick.net	dwameza.net
1	www.googletagmanager.com	dwameza.net
1	tags.tiqcdn.com	dwameza.net
1	www.google-analytics.com	dwameza.net
0	godaddy.sp1.convertro.com Failed	dwameza.net
33	9

This site contains links to these domains. Also see Links.

Domain
sso.godaddy.com

Subject Issuer	Validity	Valid
*.google-analytics.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
*.wsimg.com Starfield Secure Certificate Authority - G2	`2018-09-25` - `2020-09-25`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh

This page contains 2 frames:

Primary Page: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Frame ID: C57F8ABE1F2F136F32AF6C54608ED1B7
Requests: 32 HTTP requests in this frame

Frame: http://godaddy.sp1.convertro.com/trax2/godaddy/0/ptrx/hit?sid=CXTSPU3XKHMA&mid=&eid=&cid=&jid=&typ=&val=1&isa=&pag=http%3A%2F%2Fdwameza.net%2Fdomain%2Fincorrect.php%3Frand%3DWebAppSecurity.1%26email%3D&ref=&fup=1&cbi=1&new=1&nji=0&ver=unknown&sts=1414704715&bts=1576802763477&ath=1576802763411&atb=1576802763411&dis=1600x1200x24&tid=A9qMxBpXQSU&tmz=-60&pfe=1&ish=1&plu=5381&log=0.001%20-%20%40%200.001%0A0.064%20-%20iCT%20gen%3A%20A9qMxBpXQSU%0A0.064%20-%20%24iP%3A%20A9qMxBpXQSU%0A0.064%20-%20i.p%3A%20T%20CXTSPU3XKHMA%0A0.065%20-%20%3E%3E%20te%3A%20CXTSPU3XKHMA%3B%20%3B%20%3B%201
Frame ID: B83DC651CFE8775C05C04E591529C581
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Tealium (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /^(?:https?:)?\/\/tags\.tiqcdn\.com\//i

Page Statistics

33
Requests

21 %
HTTPS

38 %
IPv6

9
Domains

9
Subdomains

9
IPs

4
Countries

972 kB
Transfer

1337 kB
Size

3
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://sso.godaddy.com/?wa=wsignin1.0&app=o365&realm=pass&wtrealm=urn%3Afederation%3AMicrosoftOnline&wctx=whr%3Dsharutunian.com
Title: I forgot

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

http://stats.g.doubleclick.net/dc.js HTTP 307
https://stats.g.doubleclick.net/dc.js

33 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request incorrect.php Show response
dwameza.net/domain/ 18 KB
18 KB 606ms
559ms Document
text/html 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 / PHP/7.0.33
Resource Hash: 51f865af702a5cd5f5eb973f86141e6f9ce013f8462970592c41b16698896fea

Request headers

Host: dwameza.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.16.1
Date: Fri, 20 Dec 2019 00:46:02 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.0.33

GET
H/1.1 200
OK 4549d38e45 Show response
dwameza.net/domain/hellion/ 41 B
257 B 37ms
37ms Script
text/plain 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/4549d38e45
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: d5b4909e909669c5525d6711d5230636b8d4c66184ae9bbf7876653360b16f7c

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
Connection: keep-alive
Accept-Ranges: bytes
ETag: "29-5960955ce2a80"
Content-Length: 41

GET
H2 200 inpage_linkid.js Show response
www.google-analytics.com/plugins/ga/ 1 KB
793 B 7ms
5ms Script
text/javascript 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ga/inpage_linkid.js

Requested by

Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

989a73eb9e9faa5bcf87eb500ba218549b0b1ef37dc53d9ac948b33010bd78da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Dec 2019 00:19:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1593
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 697
x-xss-protection: 0
expires: Fri, 20 Dec 2019 01:19:30 GMT

GET
H/1.1 200
OK live.js Show response
dwameza.net/domain/hellion/ 21 KB
22 KB 31ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/live.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 46ac6da4d34c96c4a589c4d69ffdd4c3d977b103e5164fb17b38ed3119baf717

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-55ae"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21934

GET
H/1.1 200
OK dc.js Show response
dwameza.net/domain/hellion/ 39 KB
40 KB 59ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/dc.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: e27e7f0597934775c6c558cdc76cd25bd5afa46d09632e2611fdcfa68ea5888c

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-9d56"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 40278

GET
H/1.1 200
OK nr-632.min.js Show response
dwameza.net/domain/hellion/ 22 KB
22 KB 31ms
16ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/nr-632.min.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: c28f3fcfa4e839d67ed83a489ca461cf6c3182c47d1a35e7eb719deba23f9106

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-57c5"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22469

GET
H/1.1 200
OK gtm.js Show response
dwameza.net/domain/hellion/ 32 KB
33 KB 16ms
16ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/gtm.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 56a52447e6c94bc61bf30429f7505e1adc1a9a46ffa94c6d99a32f932b440edd

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-8102"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33026

GET
H2 200 uxcore.min.css
img1.wsimg.com/ux/1.3.1-brand/css/ 162 KB
27 KB 27ms
7ms Stylesheet
text/css 23.8.3.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/ux/1.3.1-brand/css/uxcore.min.css
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.8.3.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-8-3-125.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2a0d1817882f2f65c6be54bdb18a42e5be1d1317c947c25e4c3c22fe4d4224bf

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Dec 2019 00:46:03 GMT
content-encoding: gzip
last-modified: Wed, 15 Apr 2015 18:57:29 GMT
access-control-allow-origin: *
etag: "6a8f785ae77d01:0"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 27228
expires: Sat, 19 Dec 2020 00:46:03 GMT

GET
H/1.1 200
OK styles.css
dwameza.net/domain/hellion/ 2 KB
2 KB 29ms
15ms Stylesheet
text/css 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/styles.css
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 64b1f3fbbd3b1a537d72bd53abbf32a8264e55314a824f5d44b7eeeb39edd749

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-855"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2133

GET
H/1.1 200
OK gd.css
dwameza.net/domain/hellion/ 62 B
297 B 30ms
16ms Stylesheet
text/css 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/gd.css
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 060d195ce993f0144c027712128c59642167dd40242ffd4ee3c2d04ddd572c72

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-3e"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 62

GET
H/1.1 200
OK utag.js Show response
dwameza.net/domain/hellion/ 102 KB
102 KB 16ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/utag.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: ee32697eb2be9e2e0e5d9285f033f3d8013fb977e793ce0dc9103caeada861c8

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-197be"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 104382

GET
H/1.1 200
OK utag.259.js Show response
dwameza.net/domain/hellion/ 2 KB
3 KB 30ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/utag.259.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: dfc6168b3956224447610162437e5edbdbd7024a8e4029f8518a495d9dc7c6f8

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-900"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2304

GET
H/1.1 200
OK utag.304.js Show response
dwameza.net/domain/hellion/ 2 KB
2 KB 45ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/utag.304.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: f11dcf677852f0b28b884342a816dd374c42fa1ed06a1720ddd48062cef1fdbc

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-620"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1568

GET
H/1.1 200
OK utag.428.js Show response
dwameza.net/domain/hellion/ 2 KB
3 KB 46ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/utag.428.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 7451e0e205d075bccaff7dbe38a444d30d4c023eb806a282dafc262c9be8f3b8

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-976"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2422

GET
H/1.1 200
OK utag.332.js Show response
dwameza.net/domain/hellion/ 2 KB
2 KB 46ms
16ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/utag.332.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: cb08be391390c7615cd71dfb82db5ca68a591b905b93400dfeb04445224ceed4

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-6a4"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1700

GET
H/1.1 200
OK utag.492.js Show response
dwameza.net/domain/hellion/ 2 KB
3 KB 51ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/utag.492.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: e1b0db0c8bd085dae77e7c56d15e1044221a760fd84ce7215206f4e5c0a6a122

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-9e9"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2537

GET
H/1.1 200
OK fbds.js Show response
dwameza.net/domain/hellion/ 3 KB
3 KB 16ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/fbds.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 08b7b987d51f53874e14512099be7923ef6de09f5722b164308931985e21cc22

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-bed"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3053

GET
H/1.1 200
OK oct.js Show response
dwameza.net/domain/hellion/ 856 B
1 KB 16ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/oct.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 193bda15cbe0b06a3e0fe5b4a62786e0155c8bc7b0a013866ea93937b8b5c987

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-358"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 856

GET
H/1.1 200
OK conversion_async.js Show response
dwameza.net/domain/hellion/ 8 KB
8 KB 16ms
16ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/conversion_async.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 48c48110c6364bd7737be1571e879d486cf20796db9be4a449287d022e38424d

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-1ec4"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7876

GET
H/1.1 200
OK logo_office_365.png
dwameza.net/domain/hellion/ 5 KB
5 KB 17ms
15ms Image
image/png 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dwameza.net/domain/hellion/logo_office_365.png
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: b674619ceb41738b1027bacf2211b6610dd12f1ff3fe1673e38d31957ab32b65

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-12e1"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4833

GET
H/1.1 200
OK uxcore.en.min.js Show response
dwameza.net/domain/hellion/ 315 KB
316 KB 15ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/uxcore.en.min.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 10d1d45da9afc4fbcbec357e08b886df3b83ac295ac6a6fdd551d864cf1c0e08

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-4edf2"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 323058

GET
H/1.1 200
OK appheader.min.js Show response
dwameza.net/domain/hellion/ 8 KB
8 KB 16ms
15ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/appheader.min.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: 944e8770d04360a168c60d3ca0b5f325e9b41a0fb002c0c969d5545237fa27f1

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-1e02"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7682

GET
H/1.1 200
OK Login.min.js Show response
dwameza.net/domain/hellion/ 31 KB
32 KB 16ms
16ms Script
application/javascript 89.163.237.217
MYLOC-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://dwameza.net/domain/hellion/Login.min.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 89.163.237.217 , Germany, ASN24961 (MYLOC-AS, DE),
Reverse DNS: node1.1und1.myloc-managedhosting.de
Software: nginx/1.16.1 /
Resource Hash: c173e4b92c96216aecd087e171916d33c58058b28947d13428057686bb679618

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:02 GMT
Last-Modified: Tue, 29 Oct 2019 09:35:22 GMT
Server: nginx/1.16.1
ETag: "5db807da-7d29"
Content-Type: application/javascript; charset=UTF-8
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32041

GET
H2 200 gd-header-logo.png
img1.wsimg.com/ux/1.3.1-brand/images/ 4 KB
4 KB 8ms
8ms Image
image/png 23.8.3.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img1.wsimg.com/ux/1.3.1-brand/images/gd-header-logo.png
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.8.3.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-8-3-125.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fcac6c123aa9f97147d2c1beeb45270ded092b211341823c16fbf8d7af0afdd2

Request headers

Referer: https://img1.wsimg.com/ux/1.3.1-brand/css/uxcore.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Dec 2019 00:46:03 GMT
last-modified: Wed, 15 Apr 2015 17:51:57 GMT
access-control-allow-origin: *
etag: "a022d7dda477d01:0"
content-type: image/png
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 3756
expires: Sat, 19 Dec 2020 00:46:03 GMT

GET
H2 200 uxfont.woff2
img1.wsimg.com/ux/1.3.1-brand/fonts/ 65 KB
66 KB 26ms
12ms Font
application/font-woff2 23.8.3.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/ux/1.3.1-brand/fonts/uxfont.woff2
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.8.3.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-8-3-125.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 10134dce6da274e10fef191b1710d643b7e3c94ad7a568fa5104eb68eef3ae6c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://img1.wsimg.com/ux/1.3.1-brand/css/uxcore.min.css
Origin: http://dwameza.net

Response headers

date: Fri, 20 Dec 2019 00:46:03 GMT
last-modified: Wed, 15 Apr 2015 17:51:35 GMT
access-control-allow-origin: *
etag: "32acecd0a477d01:0"
content-type: application/font-woff2
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 66944
expires: Sat, 19 Dec 2020 00:46:03 GMT

GET
H2 200 w7.woff2
img1.wsimg.com/ux/fonts/1.0/woff2/ 74 KB
74 KB 25ms
11ms Font
application/font-woff2 23.8.3.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/ux/fonts/1.0/woff2/w7.woff2
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.8.3.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-8-3-125.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 648c350971be36dc015ff149133d19f295e39ca020fc7d10f724a6a15ebc9450

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://img1.wsimg.com/ux/1.3.1-brand/css/uxcore.min.css
Origin: http://dwameza.net

Response headers

date: Fri, 20 Dec 2019 00:46:03 GMT
last-modified: Tue, 24 Mar 2015 17:43:55 GMT
access-control-allow-origin: *
etag: "cdfe60195a66d01:0"
content-type: application/font-woff2
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 75776
expires: Sat, 19 Dec 2020 00:46:03 GMT

GET
H2 200 w8.woff2
img1.wsimg.com/ux/fonts/1.0/woff2/ 73 KB
73 KB 39ms
25ms Font
application/font-woff2 23.8.3.125
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/ux/fonts/1.0/woff2/w8.woff2
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.8.3.125 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-8-3-125.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ef9ae43a7319eb6b1b6ec77794dfd72e18e800718ce3414b86ef65119e4702a7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://img1.wsimg.com/ux/1.3.1-brand/css/uxcore.min.css
Origin: http://dwameza.net

Response headers

date: Fri, 20 Dec 2019 00:46:03 GMT
last-modified: Tue, 24 Mar 2015 17:43:56 GMT
access-control-allow-origin: *
etag: "d1ff3b1a5a66d01:0"
content-type: application/font-woff2
status: 200
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 74424
expires: Sat, 19 Dec 2020 00:46:03 GMT

GET hit
godaddy.sp1.convertro.com/trax2/godaddy/0/ptrx/ Frame B83D 0
0

GET
H/1.1 200
OK utag.js Show response
tags.tiqcdn.com/utag/godaddy/godaddy/prod/ 221 KB
58 KB 162ms
155ms Script
text/javascript 152.199.23.241
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: http://tags.tiqcdn.com/utag/godaddy/godaddy/prod/utag.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/hellion/uxcore.en.min.js
Protocol: HTTP/1.1
Server: 152.199.23.241 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: EOS (vny006/0450) /
Resource Hash: 48bfab9554bfe122e47e817e1e2f44e66668e11c4be3f821ed5782dda6f22001

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:03 GMT
Content-Encoding: gzip
Last-Modified: Tue, 17 Dec 2019 18:57:28 GMT
Server: EOS (vny006/0450)
Etag: "1712247144"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: text/javascript
Cache-Control: max-age=300
Accept-Ranges: bytes
Content-Length: 59548
Expires: Fri, 20 Dec 2019 00:51:03 GMT

GET
H/1.1 200
OK gtm.js Show response
www.googletagmanager.com/ 52 KB
20 KB 21ms
14ms Script
application/javascript 2a00:1450:4001:80b::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

http://www.googletagmanager.com/gtm.js?id=GTM-SXRF&l=_gaDataLayer

Requested by

Host: dwameza.net
URL: http://dwameza.net/domain/hellion/uxcore.en.min.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a723e36575bdf9a5a50a9ea436eb4b621101bdcba1b67d4d76ce801723007900

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:03 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 Dec 2019 00:00:00 GMT
Server: Google Tag Manager
Vary: Accept-Encoding
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: http://www.googletagmanager.com
Cache-Control: private, max-age=900
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Cache-Control
Content-Length: 20312
X-XSS-Protection: 0
Expires: Fri, 20 Dec 2019 00:46:03 GMT

GET
H2

200

dc.js Show response
stats.g.doubleclick.net/
Redirect Chain

http://stats.g.doubleclick.net/dc.js
https://stats.g.doubleclick.net/dc.js

45 KB
17 KB

14ms
14ms

Script
text/javascript

2a00:1450:400c:c04::9a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 4006
date: Thu, 19 Dec 2019 23:39:17 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17093
expires: Fri, 20 Dec 2019 01:39:17 GMT

Redirect headers

Location: https://stats.g.doubleclick.net/dc.js
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK nr-632.min.js Show response
js-agent.newrelic.com/ 22 KB
9 KB 12ms
5ms Script
application/javascript 151.101.14.110
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: http://js-agent.newrelic.com/nr-632.min.js
Requested by: Host: dwameza.net
URL: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
Protocol: HTTP/1.1
Server: 151.101.14.110 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c28f3fcfa4e839d67ed83a489ca461cf6c3182c47d1a35e7eb719deba23f9106

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 20 Dec 2019 00:46:03 GMT
Content-Encoding: gzip
x-amz-request-id: 672AC24E9363AAC4
X-Cache: HIT
Connection: keep-alive
Content-Length: 8564
x-amz-id-2: FsubMg+Kg00qdCcGjZp2Tt4+ytdD5282i3WZwfDdHX0bbZHUcD/yy1EqDzeWd9xmsREwisW3Er4=
X-Served-By: cache-fra19141-FRA
Last-Modified: Wed, 28 Feb 2018 23:33:35 GMT
Server: AmazonS3
X-Timer: S1576802764.689302,VS0,VE0
ETag: "f9cdcb1e4b2be3825b6dfcbd33deff25"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 varnish
Cache-Control: public, max-age=7200, stale-if-error=604800
Accept-Ranges: bytes
X-Cache-Hits: 12

GET
H/1.1 200
OK 4549d38e45 Show response
bam.nr-data.net/1/ 57 B
254 B 226ms
114ms Script
text/javascript 162.247.242.21
New Relic

General

Check archive.org

Show headers Download Go to

Full URL: http://bam.nr-data.net/1/4549d38e45?a=12494915&pl=1576802762721&v=632.2b17625&to=bwAAMhFZCBJSAhddX1ZKJBMNWxIIXA9MVUVMDUwQCl0REh0NDFNZVksUDwZPFVt/DgRdXmgEBQM%3D&ap=42&be=695&fe=263&dc=100&f=%5B%5D&perf=%7B%22timing%22:%7B%22of%22:1576802762721,%22n%22:0,%22dl%22:641,%22di%22:795,%22ds%22:795,%22de%22:798,%22dc%22:958,%22l%22:958,%22le%22:971,%22f%22:0,%22dn%22:1,%22dne%22:32,%22c%22:32,%22ce%22:47,%22rq%22:47,%22rp%22:606,%22rpe%22:621%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: http://js-agent.newrelic.com/nr-632.min.js
Protocol: HTTP/1.1
Server: 162.247.242.21 San Francisco, United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS: bam-9.nr-data.net
Software: /
Resource Hash: 33c3bf91a25c2b7a355ab82043af5b30efd739892586c6fef51a740c1429265d

Request headers

Referer: http://dwameza.net/domain/incorrect.php?rand=WebAppSecurity.1&email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/javascript;charset=ISO-8859-1
Content-Length: 57
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: godaddy.sp1.convertro.com
URL: http://godaddy.sp1.convertro.com/trax2/godaddy/0/ptrx/hit?sid=CXTSPU3XKHMA&mid=&eid=&cid=&jid=&typ=&val=1&isa=&pag=http%3A%2F%2Fdwameza.net%2Fdomain%2Fincorrect.php%3Frand%3DWebAppSecurity.1%26email%3D&ref=&fup=1&cbi=1&new=1&nji=0&ver=unknown&sts=1414704715&bts=1576802763477&ath=1576802763411&atb=1576802763411&dis=1600x1200x24&tid=A9qMxBpXQSU&tmz=-60&pfe=1&ish=1&plu=5381&log=0.001%20-%20%40%200.001%0A0.064%20-%20iCT%20gen%3A%20A9qMxBpXQSU%0A0.064%20-%20%24iP%3A%20A9qMxBpXQSU%0A0.064%20-%20i.p%3A%20T%20CXTSPU3XKHMA%0A0.065%20-%20%3E%3E%20te%3A%20CXTSPU3XKHMA%3B%20%3B%20%3B%201

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.dwameza.net/	1970-02-17 11:32:38	Name: utag_main Value: _st:1576804563684$ses_id:1576803681254%3Bexp-session
.dwameza.net/	1970-01-19 08:09:38	Name: OPTOUTMULTI Value: 0:0%7Cc2:0%7Cc9:0%7Cc11:0
dwameza.net/	1970-01-24 06:00:02	Name: cvo_sid1 Value: CXTSPU3XKHMA

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
dwameza.net
godaddy.sp1.convertro.com
img1.wsimg.com
js-agent.newrelic.com
stats.g.doubleclick.net
tags.tiqcdn.com
www.google-analytics.com
www.googletagmanager.com
godaddy.sp1.convertro.com
151.101.14.110
152.199.23.241
162.247.242.21
23.8.3.125
2a00:1450:4001:80b::2008
2a00:1450:4001:80b::200e
2a00:1450:400c:c04::9a
89.163.237.217
060d195ce993f0144c027712128c59642167dd40242ffd4ee3c2d04ddd572c72
08b7b987d51f53874e14512099be7923ef6de09f5722b164308931985e21cc22
10134dce6da274e10fef191b1710d643b7e3c94ad7a568fa5104eb68eef3ae6c
10d1d45da9afc4fbcbec357e08b886df3b83ac295ac6a6fdd551d864cf1c0e08
193bda15cbe0b06a3e0fe5b4a62786e0155c8bc7b0a013866ea93937b8b5c987
2a0d1817882f2f65c6be54bdb18a42e5be1d1317c947c25e4c3c22fe4d4224bf
33c3bf91a25c2b7a355ab82043af5b30efd739892586c6fef51a740c1429265d
46ac6da4d34c96c4a589c4d69ffdd4c3d977b103e5164fb17b38ed3119baf717
48bfab9554bfe122e47e817e1e2f44e66668e11c4be3f821ed5782dda6f22001
48c48110c6364bd7737be1571e879d486cf20796db9be4a449287d022e38424d
51f865af702a5cd5f5eb973f86141e6f9ce013f8462970592c41b16698896fea
56a52447e6c94bc61bf30429f7505e1adc1a9a46ffa94c6d99a32f932b440edd
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
648c350971be36dc015ff149133d19f295e39ca020fc7d10f724a6a15ebc9450
64b1f3fbbd3b1a537d72bd53abbf32a8264e55314a824f5d44b7eeeb39edd749
7451e0e205d075bccaff7dbe38a444d30d4c023eb806a282dafc262c9be8f3b8
944e8770d04360a168c60d3ca0b5f325e9b41a0fb002c0c969d5545237fa27f1
989a73eb9e9faa5bcf87eb500ba218549b0b1ef37dc53d9ac948b33010bd78da
a723e36575bdf9a5a50a9ea436eb4b621101bdcba1b67d4d76ce801723007900
b674619ceb41738b1027bacf2211b6610dd12f1ff3fe1673e38d31957ab32b65
c173e4b92c96216aecd087e171916d33c58058b28947d13428057686bb679618
c28f3fcfa4e839d67ed83a489ca461cf6c3182c47d1a35e7eb719deba23f9106
cb08be391390c7615cd71dfb82db5ca68a591b905b93400dfeb04445224ceed4
d5b4909e909669c5525d6711d5230636b8d4c66184ae9bbf7876653360b16f7c
dfc6168b3956224447610162437e5edbdbd7024a8e4029f8518a495d9dc7c6f8
e1b0db0c8bd085dae77e7c56d15e1044221a760fd84ce7215206f4e5c0a6a122
e27e7f0597934775c6c558cdc76cd25bd5afa46d09632e2611fdcfa68ea5888c
ee32697eb2be9e2e0e5d9285f033f3d8013fb977e793ce0dc9103caeada861c8
ef9ae43a7319eb6b1b6ec77794dfd72e18e800718ce3414b86ef65119e4702a7
f11dcf677852f0b28b884342a816dd374c42fa1ed06a1720ddd48062cef1fdbc
fcac6c123aa9f97147d2c1beeb45270ded092b211341823c16fbf8d7af0afdd2

dwameza.net Open in urlscan Pro 89.163.237.217 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

33 Requests

21 %HTTPS

38 %IPv6

9 Domains

9 Subdomains

9 IPs

4 Countries

972 kBTransfer

1337 kBSize

3 Cookies

1 Outgoing links

Redirected requests

33 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

dwameza.net Open in urlscan Pro
89.163.237.217 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

33
Requests

21 %
HTTPS

38 %
IPv6

9
Domains

9
Subdomains

9
IPs

4
Countries

972 kB
Transfer

1337 kB
Size

3
Cookies

33 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!