stclhost3.com Open in urlscan Pro
66.235.200.147  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/jfbqfGOPTj?amp=1?742184220211842742184220211842742184220211842774218422021184274218422021184274218422021184277421842202118427421842202118427421842202118427 Page URL
2. https://britwears.com/index0.html?000 Page URL
3. https://stclhost3.com/ddico/cgi-bin/docbyemail/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	jfbqfGOPTj Show response t.co/	266 B 497 B	179ms 137ms	Document text/html	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/jfbqfGOPTj?amp=1?742184220211842742184220211842742184220211842774218422021184274218422021184274218422021184277421842202118427421842202118427421842202118427 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 0e33d269ccb25743aa3eda26000df6b797bd1818a0f18d49258ca9212a1c3473 Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers :method GET :authority t.co :scheme https :path /jfbqfGOPTj?amp=1?742184220211842742184220211842742184220211842774218422021184274218422021184274218422021184277421842202118427421842202118427421842202118427 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Tue, 07 Sep 2021 22:57:55 GMT vary Origin server tsa_o expires Tue, 07 Sep 2021 23:02:56 GMT set-cookie muc=e3618520-de2f-4daf-bc1a-7a48b44850eb; Max-Age=63072000; Expires=Thu, 07 Sep 2023 22:57:56 GMT; Domain=t.co; Secure; SameSite=None content-type text/html; charset=utf-8 cache-control private,max-age=300 content-length 182 content-encoding gzip x-xss-protection 0 strict-transport-security max-age=0 x-connection-hash 8a20b7b5c4d2fb45eeaccdacfa1ff2e3d89f5cf8e646ccb0119b29ce709096cd
GET H2	200	index0.html Show response britwears.com/	936 B 1 KB	654ms 167ms	Document text/html	162.214.72.205 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://britwears.com/index0.html?000 Requested by Host: t.co URL: https://t.co/jfbqfGOPTj?amp=1?742184220211842742184220211842742184220211842774218422021184274218422021184274218422021184277421842202118427421842202118427421842202118427 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.214.72.205 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS host.usabestserver.com Software Apache / Resource Hash b366ae5155ba40cc4a3cc52e76e96538e1051bceafd8b2197f6e5d761ff159d8 Request headers :method GET :authority britwears.com :scheme https :path /index0.html?000 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://t.co/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Referer https://t.co/ Response headers date Tue, 07 Sep 2021 22:57:56 GMT server Apache last-modified Sun, 05 Sep 2021 17:09:42 GMT accept-ranges bytes content-length 936 content-type text/html
GET H2	200	giphy.gif media.giphy.com/media/xUPGciQ9ZEKWnEUXYI/	22 KB 22 KB	27ms 8ms	Image image/gif	151.101.14.2 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://media.giphy.com/media/xUPGciQ9ZEKWnEUXYI/giphy.gif Requested by Host: britwears.com URL: https://britwears.com/index0.html?000 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=15465600 Request headers Referer https://britwears.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Tue, 07 Sep 2021 22:57:56 GMT via 1.1 varnish, 1.1 varnish age 1432878 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 22112 x-served-by cache-bwi5183-BWI, cache-fra19177-FRA last-modified Tue, 19 Mar 2019 01:30:10 GMT x-timer S1631055477.836974,VS0,VE1 etag "60778a01174cddfebebf54aa7f47cb12" strict-transport-security max-age=15465600 content-type image/gif access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	Primary Request / Show response stclhost3.com/ddico/cgi-bin/docbyemail/	389 B 675 B	951ms 793ms	Document text/html	66.235.200.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stclhost3.com/ddico/cgi-bin/docbyemail/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS host77.ipowerweb.com Software cloudflare / Resource Hash ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793 Request headers :method GET :authority stclhost3.com :scheme https :path /ddico/cgi-bin/docbyemail/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://britwears.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Referer https://britwears.com/ Response headers date Tue, 07 Sep 2021 22:57:57 GMT content-type text/html; charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache set-cookie cazanova=67f6c88f4ca2ce4e8c8c7451ad453448ec5700bf; expires=Wed, 08-Sep-2021 00:57:57 GMT; Max-Age=7200; path=/; HttpOnly vary Accept-Encoding host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== cf-cache-status MISS expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 68b389fb5f9468e8-CDG content-encoding gzip
GET H2	200	captcha.js Show response stclhost3.com/ddico/cgi-bin/docbyemail/assets/js/	118 KB 52 KB	2538ms 2538ms	Script application/javascript	66.235.200.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stclhost3.com/ddico/cgi-bin/docbyemail/assets/js/captcha.js Requested by Host: stclhost3.com URL: https://stclhost3.com/ddico/cgi-bin/docbyemail/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS host77.ipowerweb.com Software cloudflare / Resource Hash 0d4a37bae155121fce6f09ae7e6a08e0f50d9e3e5fc6c7ddbdc8c2f1295783a8 Request headers :path /ddico/cgi-bin/docbyemail/assets/js/captcha.js pragma no-cache cookie cazanova=67f6c88f4ca2ce4e8c8c7451ad453448ec5700bf accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority stclhost3.com referer https://stclhost3.com/ddico/cgi-bin/docbyemail/ :scheme https sec-fetch-site same-origin :method GET Referer https://stclhost3.com/ddico/cgi-bin/docbyemail/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Tue, 07 Sep 2021 22:57:58 GMT content-encoding gzip cf-cache-status MISS last-modified Mon, 07 Sep 2020 17:01:30 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== cf-ray 68b38a00581e68e8-CDG
GET H2	200	captcha.png stclhost3.com/ddico/cgi-bin/docbyemail/	6 KB 6 KB	771ms 771ms	Image image/png	66.235.200.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://stclhost3.com/ddico/cgi-bin/docbyemail/captcha.png?_1631055482374 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS host77.ipowerweb.com Software cloudflare / Resource Hash 3f54f54cd99faeb6aab05cb608a7c7df66946fe799e8d1b5dfc9634821b83259 Request headers :path /ddico/cgi-bin/docbyemail/captcha.png?_1631055482374 pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority stclhost3.com referer https://stclhost3.com/ddico/cgi-bin/docbyemail/ :scheme https sec-fetch-site same-origin :method GET Referer https://stclhost3.com/ddico/cgi-bin/docbyemail/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers pragma no-cache date Tue, 07 Sep 2021 22:58:03 GMT content-encoding gzip cf-cache-status MISS server cloudflare host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png cache-control no-store, no-cache, must-revalidate set-cookie cazanova=d574eff8cd162e3b6814f151daaf4862cbfabc51; expires=Wed, 08-Sep-2021 00:58:03 GMT; Max-Age=7200; path=/; HttpOnly accept-ranges bytes cf-ray 68b38a1cea2668e8-CDG content-length 6045 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	KeyBank-logo.png stclhost3.com/ddico/cgi-bin/docbyemail/	27 KB 27 KB	473ms 473ms	Image image/png	66.235.200.147 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://stclhost3.com/ddico/cgi-bin/docbyemail/KeyBank-logo.png Requested by Host: stclhost3.com URL: https://stclhost3.com/ddico/cgi-bin/docbyemail/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.235.200.147 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS host77.ipowerweb.com Software cloudflare / Resource Hash 241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29 Request headers :path /ddico/cgi-bin/docbyemail/KeyBank-logo.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority stclhost3.com referer https://stclhost3.com/ddico/cgi-bin/docbyemail/ :scheme https sec-fetch-site same-origin :method GET Referer https://stclhost3.com/ddico/cgi-bin/docbyemail/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers date Tue, 07 Sep 2021 22:58:02 GMT content-encoding gzip cf-cache-status REVALIDATED last-modified Mon, 07 Sep 2020 16:44:54 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== cf-ray 68b38a1cea2868e8-CDG

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: KeyBank (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| setImmediate function| clearImmediate function| Vue

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

britwears.com
media.giphy.com
stclhost3.com
t.co
104.244.42.197
151.101.14.2
162.214.72.205
66.235.200.147
0d4a37bae155121fce6f09ae7e6a08e0f50d9e3e5fc6c7ddbdc8c2f1295783a8
0e33d269ccb25743aa3eda26000df6b797bd1818a0f18d49258ca9212a1c3473
241eca53a73b5954ae742575918848c979bfa80530c7381a8a4ab8979180af29
3f54f54cd99faeb6aab05cb608a7c7df66946fe799e8d1b5dfc9634821b83259
b366ae5155ba40cc4a3cc52e76e96538e1051bceafd8b2197f6e5d761ff159d8
ea771cbf42a69918c0f50d76bf7b318ea505715f81dcd60e6b264967ea488793