urlscan.io logo urlscan.io
SecurityTrails logo

campstor.com Open in urlscan Pro
119.28.9.120  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://campstor.com/client.php
Effective URL: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Submission: On September 01 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 119.28.9.120, located in Beijing, China and belongs to TENCENT-AS-AP Tencent Cloud Computing (Beijing) Co., Ltd, CN. The main domain is campstor.com.
This is the only time campstor.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 119.28.9.120 133478 (TENCENT-A...)
2 198.232.125.123 3257 (GTT-BACKB...)
3 52.85.89.242 16509 (AMAZON-02)
1 94.31.29.54 54104 (AS-NETDNA)
7 4
Domain Requested by
3 d3ikljl879wvvx.cloudfront.net campstor.com
code.jquery.com
2 maxcdn.bootstrapcdn.com campstor.com
1 code.jquery.com campstor.com
1 campstor.com
7 4

This site contains no links.

Subject Issuer Validity Valid
*.bootstrapcdn.com
RapidSSL SHA256 CA		 2016-10-13 -
2017-10-13		 a year crt.sh
code.jquery.com
AlphaSSL CA - SHA256 - G2		 2017-07-25 -
2018-07-26		 a year crt.sh

This page contains 1 frames:

Primary Page: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Frame ID: 4084.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

7
Requests

43 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

430 kB
Transfer

617 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
campstor.com/DE/5d655a713b45927b94a548c458110bac/
Redirect Chain
  • http://campstor.com/bakhgkcz
  • http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
 		22 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Protocol
HTTP/1.1
Server
119.28.9.120 Beijing, China, ASN133478 (TENCENT-AS-AP Tencent Cloud Computing (Beijing) Co., Ltd, CN),
Reverse DNS
Software
nginx /
Resource Hash
a4bb651dce5e6b3e663c724f241e547e39f1fb27c01163eef5da8590547e5dcc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Fri, 01 Sep 2017 14:32:33 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Sep 2017 04:16:06 GMT
Server
nginx
Vary
Accept-Encoding, Accept-Encoding
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive

Redirect headers

Date
Fri, 01 Sep 2017 14:32:32 GMT
x-content-type-options
nosniff
Server
nginx
Content-Type
text/html; charset=utf-8
location
/DE/5d655a713b45927b94a548c458110bac/
cache-control
max-age=0, private, must-revalidate
Connection
keep-alive
Content-Length
103
x-xss-protection
1; mode=block
x-request-id
or1ful7uuan39penbn863ia27l9nashl
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 		118 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: campstor.com
URL: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.232.125.123 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, DE),
Reverse DNS
123-125-232-198.static.unitasglobal.net
Software
NetDNA-cache/2.2 /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

Referer
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

date
Fri, 01 Sep 2017 14:32:33 GMT
content-encoding
gzip
last-modified
Mon, 25 Jul 2016 16:08:01 GMT
server
NetDNA-cache/2.2
status
200
etag
W/"ec3bb52a00e176a7181d454dffaea219"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31104000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
expires
Mon, 27 Aug 2018 14:32:33 GMT
radar.gif
d3ikljl879wvvx.cloudfront.net/assets/07cd5017f866757a9d8bdcfd0f0fe8a6/images/ 		172 KB
172 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://d3ikljl879wvvx.cloudfront.net/assets/07cd5017f866757a9d8bdcfd0f0fe8a6/images/radar.gif
Requested by
Host: campstor.com
URL: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Protocol
HTTP/1.1
Server
52.85.89.242 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-89-242.jfk6.r.cloudfront.net
Software
nginx /
Resource Hash
89495896bcc3deb0b6a643cf55ddfe620ada0cdb66cd09ce4ba801a06396fcef

Request headers

Referer
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Tue, 29 Aug 2017 13:17:51 GMT
Via
1.1 5d4055ddd4ab6dc339d40953c6e99219.cloudfront.net (CloudFront)
Last-Modified
Mon, 28 Aug 2017 20:12:20 GMT
Server
nginx
Age
4378
ETag
"59a47924-2aeaf"
X-Cache
Hit from cloudfront
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
175791
X-Amz-Cf-Id
RyRhKzXc5iAe0Z9qljY6Pmh456BiQ9NyMFqm7YRQmxQL9T0wjQL_Og==
jquery-2.2.4.min.js
code.jquery.com/ 		84 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-2.2.4.min.js
Requested by
Host: campstor.com
URL: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.31.29.54 , United Kingdom, ASN54104 (AS-NETDNA - netDNA, US),
Reverse DNS
94.31.29.54.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Referer
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Origin
http://campstor.com

Response headers

date
Fri, 01 Sep 2017 14:32:33 GMT
content-encoding
gzip
last-modified
Fri, 20 May 2016 17:24:41 GMT
server
NetDNA-cache/2.2
status
200
etag
W/"573f4859-14e4a"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
expires
Thu, 31 Dec 2037 23:55:55 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: campstor.com
URL: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.232.125.123 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, DE),
Reverse DNS
123-125-232-198.static.unitasglobal.net
Software
NetDNA-cache/2.2 /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

date
Fri, 01 Sep 2017 14:32:33 GMT
content-encoding
gzip
last-modified
Mon, 25 Jul 2016 16:08:02 GMT
server
NetDNA-cache/2.2
status
200
etag
W/"5869c96cc8f19086aee625d670d741f9"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31104000
x-hello-human
Say hello back! @getBootstrapCDN on Twitter
expires
Mon, 27 Aug 2018 14:32:33 GMT
1.jpg
d3ikljl879wvvx.cloudfront.net/assets/07cd5017f866757a9d8bdcfd0f0fe8a6/images/ 		183 KB
183 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://d3ikljl879wvvx.cloudfront.net/assets/07cd5017f866757a9d8bdcfd0f0fe8a6/images/1.jpg
Requested by
Host: campstor.com
URL: http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
Protocol
HTTP/1.1
Server
52.85.89.242 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-89-242.jfk6.r.cloudfront.net
Software
nginx /
Resource Hash
c71693ed355fb3335c89d8066ebd416735dff32a5cea47c6f78c6b3961213f56

Request headers

Referer
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Tue, 29 Aug 2017 11:38:49 GMT
Via
1.1 9ce63d3af60e77462dfef1ebe1eea8f0.cloudfront.net (CloudFront)
Last-Modified
Mon, 28 Aug 2017 20:12:20 GMT
Server
nginx
Age
10209
ETag
"59a47924-2da0d"
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
186893
X-Amz-Cf-Id
rIqSr6_gYLsiEgOs7KVBjRXlXkIQ8rFvvPw6fG0__1ZNTTLgt5MTNA==
blue.png
d3ikljl879wvvx.cloudfront.net/assets/07cd5017f866757a9d8bdcfd0f0fe8a6/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://d3ikljl879wvvx.cloudfront.net/assets/07cd5017f866757a9d8bdcfd0f0fe8a6/images/blue.png
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-2.2.4.min.js
Protocol
HTTP/1.1
Server
52.85.89.242 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-85-89-242.jfk6.r.cloudfront.net
Software
nginx /
Resource Hash
abff66ea99f7e2b2a51d02feb00d0385f2ac35100fdc65b5d4e4395228fd020b

Request headers

Referer
http://campstor.com/DE/5d655a713b45927b94a548c458110bac/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Tue, 29 Aug 2017 10:46:04 GMT
Via
1.1 6ddeb72bd0522678e37bacf079348a81.cloudfront.net (CloudFront)
Last-Modified
Mon, 28 Aug 2017 20:12:20 GMT
Server
nginx
Age
12691
ETag
"59a47924-889"
X-Cache
Hit from cloudfront
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2185
X-Amz-Cf-Id
qEPCdVwboQcuFBaqDQKadv9bNL2FKg1iQbTrxn7OJHnRATkn0e_G2w==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
campstor.com/ Name: __vl
Value: rQhJogQrrsg
campstor.com/ Name: k
Value: SFMyNTY.g3QAAAAEbQAAAANoaWRtAAAAGUFnVVpVbGNtcHpDQXRtQnFRcHdqd3dMUUFtAAAABXN1Yl8xZAADbmlsbQAAAAVzdWJfMmQAA25pbG0AAAAHdHJhY2tlcm0AAAAHbm90cmFjaw.yu2tyS39ibFjATcVb14NN1Th96APdJbweiM6wwfU_tI