951homesforsale.com Open in urlscan Pro
104.244.124.255  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 951homesforsale.com/ant/	5 KB 6 KB	826ms 207ms	Document text/html	104.244.124.255 INMOTION
General Check archive.org Show headers Download Go to Full URL https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.244.124.255 , United States, ASN22611 (INMOTION, US), Reverse DNS real55.prophosting.com Software Apache / Resource Hash 2da10fecb8260e0f5f1b64da55bd2357a21f3637a8c77bd2f1e89795a38809c5 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Tue, 01 Feb 2022 01:03:18 GMT Server Apache Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Keep-Alive timeout=3, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	CookieAuth.css 951homesforsale.com/ant/	78 KB 78 KB	153ms 153ms	Stylesheet text/css	104.244.124.255 INMOTION
General Check archive.org Show headers Download Go to Full URL https://951homesforsale.com/ant/CookieAuth.css Requested by Host: 951homesforsale.com URL: https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.244.124.255 , United States, ASN22611 (INMOTION, US), Reverse DNS real55.prophosting.com Software Apache / Resource Hash e2edd1c0ce07b5199dca81995c0fb2a7d514c1ec8963c1f29c80b59c9de0e94e Request headers Accept-Language de-DE,de;q=0.9 Referer https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 01 Feb 2022 01:03:18 GMT Last-Modified Fri, 10 Jul 2020 07:06:20 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=3, max=99 Content-Length 79486
GET H/1.1	200 OK	logon.js Show response 951homesforsale.com/ant/	18 KB 19 KB	453ms 152ms	Script application/javascript	104.244.124.255 INMOTION
General Check archive.org Show headers Download Go to Full URL https://951homesforsale.com/ant/logon.js Requested by Host: 951homesforsale.com URL: https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.244.124.255 , United States, ASN22611 (INMOTION, US), Reverse DNS real55.prophosting.com Software Apache / Resource Hash bf9a7d642c3575e7e97964c6879f2b0df69bbe506c78524b500ab8ae1fa288da Request headers Accept-Language de-DE,de;q=0.9 Referer https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 01 Feb 2022 01:03:18 GMT Last-Modified Fri, 10 Jul 2020 09:03:28 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=3, max=100 Content-Length 18740
GET H/1.1	200 OK	logo2.png 951homesforsale.com/ant/	2 KB 3 KB	152ms 152ms	Image image/png	104.244.124.255 INMOTION
General Check archive.org Show headers Download Go to Show image Full URL https://951homesforsale.com/ant/logo2.png Requested by Host: 951homesforsale.com URL: https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 104.244.124.255 , United States, ASN22611 (INMOTION, US), Reverse DNS real55.prophosting.com Software Apache / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Accept-Language de-DE,de;q=0.9 Referer https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Tue, 01 Feb 2022 01:03:18 GMT Last-Modified Fri, 10 Jul 2020 07:09:42 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=3, max=98 Content-Length 2503
GET H2	200	de.ey.com logo.clearbit.com/	3 KB 3 KB	55ms 6ms	Image image/png	65.9.7.29 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://logo.clearbit.com/de.ey.com Requested by Host: 951homesforsale.com URL: https://951homesforsale.com/ant/?client-request-id=bWFyaW9uLnN0YWhsQGRlLmV5LmNvbQ== Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.7.29 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-9-7-29.fra56.r.cloudfront.net Software envoy / Resource Hash bbac1cd3b3e3b3fbab49c794a16b91c1acf12178be6b32a544ab51e4080b3785 Request headers Accept-Language de-DE,de;q=0.9 Referer https://951homesforsale.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Wed, 19 Jan 2022 09:35:06 GMT via 1.1 29d33c5cd70a6501fde7bc2dba557906.cloudfront.net (CloudFront) server envoy age 1092493 x-cache Hit from cloudfront content-type image/png access-control-allow-origin * cache-control public, max-age=2592000 x-amz-cf-pop FRA56-C1 x-amz-cf-id 4ykR-e3HsJcR5rsMRFIEbHRPOlKnr4pbQfu-2dNKK_PpP1U8a2b0iw==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| onld function| chkCookies function| ldCookie function| clkExp function| clkExp2 function| clkExp3 function| clkExp4 function| shw function| hd function| checkSubmit function| clkLgn function| clkSubmit function| clkLgn_new function| clkSec function| clkBsc function| clkChpwd function| optClkSec function| clkPin function| clkRtry function| gbid function| getUser number| a_fGzpEnbl number| g_fFcs function| window_onload

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			951homesforsale.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 246orqko4sv0364cd8qr88cuq5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

951homesforsale.com
logo.clearbit.com
104.244.124.255
65.9.7.29
2da10fecb8260e0f5f1b64da55bd2357a21f3637a8c77bd2f1e89795a38809c5
bbac1cd3b3e3b3fbab49c794a16b91c1acf12178be6b32a544ab51e4080b3785
bf9a7d642c3575e7e97964c6879f2b0df69bbe506c78524b500ab8ae1fa288da
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e2edd1c0ce07b5199dca81995c0fb2a7d514c1ec8963c1f29c80b59c9de0e94e