grand-avenue.cf
Open in
urlscan Pro
23.249.165.224
Malicious Activity!
Public Scan
Submission: On April 29 via api from CA
Summary
This is the only time grand-avenue.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 23.249.165.224 23.249.165.224 | 36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing) | |
1 2 | 2.16.186.51 2.16.186.51 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2.16.186.41 2.16.186.41 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 2 | 18.196.106.74 18.196.106.74 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
15 | 4 |
ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
grand-avenue.cf |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-51.deploy.akamaitechnologies.com
b.scorecardresearch.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-41.deploy.akamaitechnologies.com
w.sharethis.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-196-106-74.eu-central-1.compute.amazonaws.com
l.sharethis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
grand-avenue.cf
grand-avenue.cf |
411 KB |
3 |
sharethis.com
1 redirects
w.sharethis.com l.sharethis.com |
5 KB |
2 |
scorecardresearch.com
1 redirects
b.scorecardresearch.com |
1 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
12 | grand-avenue.cf |
grand-avenue.cf
|
2 | l.sharethis.com | 1 redirects |
2 | b.scorecardresearch.com |
1 redirects
grand-avenue.cf
|
1 | w.sharethis.com |
grand-avenue.cf
|
15 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 2 frames:
Primary Page:
http://grand-avenue.cf/att/Upgraded-vertion-att-user-forum.html
Frame ID: 54A94E2B90DBE61C254979AB4AD43684
Requests: 13 HTTP requests in this frame
Frame:
http://grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/getSegment.htm
Frame ID: 9AA1746A2D14A738E8CC22E8041FD666
Requests: 2 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- http://b.scorecardresearch.com/b?c1=7&c2=8097938&rn=388198305&c7=http%3A%2F%2Fgrand-avenue.cf%2Fatt%2FYahoo%2521%2520Mail%2520Upgrade_files%2FgetSegment.htm&c3=8097938&c8=ShareThis%20Segmenter&c9=http%3A%2F%2Fgrand-avenue.cf%2Fatt%2FUpgraded-vertion-att-user-forum.html&cv=2.2&cs=js HTTP 302
- http://b.scorecardresearch.com/b2?c1=7&c2=8097938&rn=388198305&c7=http%3A%2F%2Fgrand-avenue.cf%2Fatt%2FYahoo%2521%2520Mail%2520Upgrade_files%2FgetSegment.htm&c3=8097938&c8=ShareThis%20Segmenter&c9=http%3A%2F%2Fgrand-avenue.cf%2Fatt%2FUpgraded-vertion-att-user-forum.html&cv=2.2&cs=js
- http://l.sharethis.com/pview?event=pview&source=share4x&publisher=null&hostname=grand-avenue.cf&location=%2Fatt%2FUpgraded-vertion-att-user-forum.html&url=http%3A%2F%2Fgrand-avenue.cf%2Fatt%2FUpgraded-vertion-att-user-forum.html&sessionID=1524974358025.98400&fpc=597d27e-1630f8e0e09-394932c3-1&ts1524974358220.0 HTTP 301
- http://l.sharethis.com/sc?cm=ZGAKKVrlQxYAAAATJfLXAw%3D%3D&uid=true&url=http%3A%2F%2Fgrand-avenue.cf%2Fatt%2FUpgraded-vertion-att-user-forum.html
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Upgraded-vertion-att-user-forum.html
grand-avenue.cf/att/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons.css
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
23 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mail-bg-v3.png
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
paper-hole_v2.png
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
169 KB 169 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jVal.css
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons_002.css
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
17 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
javascriptfunctions.js
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_002.js
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
89 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jVal.js
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons.js
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
45 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoolog.png
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
getSegment.htm
grand-avenue.cf/att/Yahoo%21%20Mail%20Upgrade_files/ Frame 9AA1 |
799 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b2
b.scorecardresearch.com/ Frame 9AA1 Redirect Chain
|
0 248 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons.css
w.sharethis.com/button/css/ |
22 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sc
l.sharethis.com/ Redirect Chain
|
82 B 82 B |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| startTime object| loadTime object| request number| random_pager function| validateLoginInput function| loginForm function| $ function| jQuery object| cookie boolean| stRecentServices object| betaBlacklist number| rNumFor5x number| testLimitFor5x object| stButtons function| Shareable object| stWidget function| odjs object| jsonp function| shareLog boolean| switchTo5x object| stLight boolean| st_showing function| plusoneCallback2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.grand-avenue.cf/ | Name: __unam Value: 597d27e-1630f8e0e09-394932c3-1 |
|
.grand-avenue.cf/ | Name: __switchTo5x Value: 78 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.scorecardresearch.com
grand-avenue.cf
l.sharethis.com
w.sharethis.com
18.196.106.74
2.16.186.41
2.16.186.51
23.249.165.224
063fa79fdfb74c97ec80902a50fc478b92a6ad681d94b8776b7c88fe817e5f70
604fb033b645f2b9ae386effd307651e1490676197669f8f595eef529e8fbd0b
822afa8620d12cc8fabc0de752af5e68845457e834b0fc75c3eb6562f0c97c18
9d54ecc6e31c5395d9d35de1ef75e4152c8f9787c511dea5590cea300dfbc07c
a4a09a2806c0bdffdffee03073f56732acba6a435473d227c8c57a9073c41ea8
a65ea805e6801a47485849e2c6668facb5c458ffcad3c60393cb28f63e28cbf9
b35745e800e632b0aa428e986b447dad09c176fad80e0f86c49835d31e12c685
d9ac0cabe482dcbca87e18c9a81e32a8005ee21cce55be9806821d52d857aef9
daa9a7565d6e53d5c8bb9c5117760da97bf488259401444aac11f71abbfa63a6
ddfcde6b3d91c22bf284f701b9d3320512cf8301ee43505abd058d042400e7f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40949fef718c5b1f84aecec489db51618eee0746343a5745b84caef1f08abfd
ed862c231506f3ee5216049c8af5fc5a1a6c6b47006a92ec5f5e31efbcd57a90
f2b46b60179796b76b63b4d0d08364128a91ed5681cdb857775be64a7fd45134