ajsae2nt3522erterms.tk

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 80.211.19.232, located in Arezzo, Italy and belongs to ARUBA-ASN, IT. The main domain is ajsae2nt3522erterms.tk.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 9th 2018. Valid for: 3 months.

This is the only time ajsae2nt3522erterms.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	80.211.19.232 80.211.19.232	31034 (ARUBA-ASN) (ARUBA-ASN)
2 2	172.104.14.217 172.104.14.217	63949 (LINODE-AP...) (LINODE-AP Linode)
1	104.27.139.141 104.27.139.141	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	192.240.180.202 192.240.180.202	36444 (NEXCESS-NET) (NEXCESS-NET - NEXCESS.NET L.L.C.)
5	3

3 80.211.19.232 (Arezzo, Italy)

ASN31034 (ARUBA-ASN, IT)
PTR: host232-19-211-80.serverdedicati.aruba.it

ajsae2nt3522erterms.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.104.14.217 (Absecon, United States) 2 redirects

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1749-217.members.linode.com

www.guidingtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.27.139.141 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.guidingtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.240.180.202 (Southfield, United States)

ASN36444 (NEXCESS-NET - NEXCESS.NET L.L.C., US)
PTR: eep5-07.nexcess.net

www.demandware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	guidingtech.com 2 redirects www.guidingtech.com cdn.guidingtech.com	12 KB
3	ajsae2nt3522erterms.tk ajsae2nt3522erterms.tk	5 KB
1	demandware.com www.demandware.com	1 KB
5	3

	Domain	Requested by
3	ajsae2nt3522erterms.tk	ajsae2nt3522erterms.tk
2	www.guidingtech.com	2 redirects
1	www.demandware.com	ajsae2nt3522erterms.tk
1	cdn.guidingtech.com	ajsae2nt3522erterms.tk
5	4

This site contains no links.

Subject Issuer	Validity	Valid
ajsae2nt3522erterms.tk cPanel, Inc. Certification Authority	`2018-05-09` - `2018-08-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Frame ID: 65DB213BCAD006E20A7000F73CB048AE
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

18 kB
Transfer

17 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg HTTP 301
https://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg HTTP 301
https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg

Request Chain 1

http://www.demandware.com/uploads/home/icon-lock-circle.svg HTTP 307
https://www.demandware.com/uploads/home/icon-lock-circle.svg

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request securedoc.html Show response
ajsae2nt3522erterms.tk/www/pdf/ 5 KB
5 KB 202ms
34ms Document
text/html 80.211.19.232
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.211.19.232 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: host232-19-211-80.serverdedicati.aruba.it
Software: Apache /
Resource Hash: 0b828eceb77b386b1652efb6756d58d8c8cea8e783745ec06dac2e0dc5bbb3fe

Request headers

Host: ajsae2nt3522erterms.tk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 65DB213BCAD006E20A7000F73CB048AE

Response headers

Date: Thu, 24 May 2018 21:27:12 GMT
Server: Apache
Last-Modified: Thu, 17 May 2018 08:30:48 GMT
Accept-Ranges: bytes
Content-Length: 4852
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
S

200

logo-adobe-pdf.jpg
cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/
Redirect Chain

http://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg
https://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg
https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg

11 KB
11 KB

50ms
13ms

Image
image/jpeg

104.27.139.141
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg
Requested by: Host: ajsae2nt3522erterms.tk
URL: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Protocol: SPDY
Server: 104.27.139.141 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e1682716795b2048d4f397901cf6612d63a713e7ef0e8a98f3192bef88721f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 24 May 2018 21:27:13 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2017 13:37:09 GMT
server: cloudflare
etag: "59e0c185-2c38"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4202d855fa1b64e7-FRA
content-length: 11320
expires: Sat, 23 Jun 2018 21:27:13 GMT

Redirect headers

pragma: no-cache
date: Thu, 24 May 2018 21:27:13 GMT
x-content-type-options: nosniff
server: nginx
status: 301
x-frame-options: SAMEORIGIN
x-cache: STALE
content-type: text/html; charset=UTF-8
location: https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1

200
OK

icon-lock-circle.svg
www.demandware.com/uploads/home/
Redirect Chain

http://www.demandware.com/uploads/home/icon-lock-circle.svg
https://www.demandware.com/uploads/home/icon-lock-circle.svg

1 KB
1 KB

439ms
113ms

Image
image/svg+xml

192.240.180.202
NEXCESS.NET L.L.C.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.demandware.com/uploads/home/icon-lock-circle.svg

Requested by

Host: ajsae2nt3522erterms.tk
URL: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html

Protocol

HTTP/1.1

Server

192.240.180.202 Southfield, United States, ASN36444 (NEXCESS-NET - NEXCESS.NET L.L.C., US),

Reverse DNS

eep5-07.nexcess.net

Software

Apache /

Resource Hash

d14a69ff94cf499915e4cc348951a76f41748010c8eab0876b03c8ba77179b87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 24 May 2018 21:27:13 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 03 Mar 2015 22:56:14 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: image/svg+xml
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 717
Expires: Sat, 23 Jun 2018 21:27:13 GMT

Redirect headers

Location: https://www.demandware.com/uploads/home/icon-lock-circle.svg
Non-Authoritative-Reason: HSTS

GET
H/1.1 404
Not Found jquery-1.4.4.min.js
ajsae2nt3522erterms.tk/www/pdf/Scripts/ 0
0 35ms
34ms Script
text/html 80.211.19.232
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ajsae2nt3522erterms.tk/www/pdf/Scripts/jquery-1.4.4.min.js
Requested by: Host: ajsae2nt3522erterms.tk
URL: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.211.19.232 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: host232-19-211-80.serverdedicati.aruba.it
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ajsae2nt3522erterms.tk
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 24 May 2018 21:27:12 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 352
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found jquery.h5validate.js
ajsae2nt3522erterms.tk/www/pdf/Scripts/ 0
0 69ms
34ms Script
text/html 80.211.19.232
ARUBA-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ajsae2nt3522erterms.tk/www/pdf/Scripts/jquery.h5validate.js
Requested by: Host: ajsae2nt3522erterms.tk
URL: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.211.19.232 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS: host232-19-211-80.serverdedicati.aruba.it
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ajsae2nt3522erterms.tk
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
Connection: keep-alive
Cache-Control: no-cache
Referer: https://ajsae2nt3522erterms.tk/www/pdf/securedoc.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 24 May 2018 21:27:12 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 353
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| popitup

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajsae2nt3522erterms.tk
cdn.guidingtech.com
www.demandware.com
www.guidingtech.com
104.27.139.141
172.104.14.217
192.240.180.202
80.211.19.232
0b828eceb77b386b1652efb6756d58d8c8cea8e783745ec06dac2e0dc5bbb3fe
85e1682716795b2048d4f397901cf6612d63a713e7ef0e8a98f3192bef88721f
d14a69ff94cf499915e4cc348951a76f41748010c8eab0876b03c8ba77179b87

ajsae2nt3522erterms.tk Open in urlscan Pro 80.211.19.232 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

3 IPs

2 Countries

18 kBTransfer

17 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

ajsae2nt3522erterms.tk Open in urlscan Pro
80.211.19.232 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

18 kB
Transfer

17 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!