beta.warfareplugins.com Open in urlscan Pro
66.147.238.213  Malicious Activity! Public Scan

URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Submission: On September 21 via manual from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 66.147.238.213, located in Clifton Park, United States and belongs to HOSTROCKET, US. The main domain is beta.warfareplugins.com.
This is the only time beta.warfareplugins.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
9 66.147.238.213 23535 (HOSTROCKET)
9 1
Apex Domain
Subdomains
Transfer
9 warfareplugins.com
beta.warfareplugins.com
110 KB
9 1
Domain Requested by
9 beta.warfareplugins.com beta.warfareplugins.com
9 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Frame ID: E3CE00AB425B203D14E229F0B9C898B2
Requests: 9 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
  • script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

110 kB
Transfer

353 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set login.php
beta.warfareplugins.com/Signin/secure-docu/
3 KB
2 KB
Document
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
89c386963980456b9b21e2650368e21745bb793cab3c75c7f33746ebb5b59aae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Host
beta.warfareplugins.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
Set-Cookie
PHPSESSID=eb5bc9d35c996dfeee615a8710bcfd55; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Content-Type
text/html; charset=UTF-8
Content-Length
1257
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Mon, 21 Sep 2020 05:15:51 GMT
Server
www.fbi.gov
Strict-Transport-Security
max-age=31536000
X-Content-Type
nosniff
X_FORWARDED_FOR
104.16.77.187
REMOTE_ADDR
104.16.77.187
Host
www.fbi.gov
Origin
https://www.fbi.gov
Referer
https://www.fbi.gov
X-Forwarded-Host
www.fbi.gov
X-Forwarded-Proto
https
X-XSS-Protection
1; mode=block
bootstrap.css
beta.warfareplugins.com/Signin/secure-docu/assets/css/
138 KB
28 KB
Stylesheet
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/css/bootstrap.css
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
27937
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Sat, 13 Jul 2019 17:24:50 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
text/css
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
login.css
beta.warfareplugins.com/Signin/secure-docu/assets/css/
2 KB
1 KB
Stylesheet
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/css/login.css
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
4dec1bef9200f9e8594d0bbb80b18ba4fee8ce6b71167f59b1b8aeeabdfe615b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
737
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Thu, 21 May 2020 15:45:34 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
text/css
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
jquery.min.js
beta.warfareplugins.com/Signin/secure-docu/assets/js/
85 KB
34 KB
Script
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/js/jquery.min.js
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
34096
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Sat, 13 Jul 2019 17:27:16 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
popper.min.js
beta.warfareplugins.com/Signin/secure-docu/assets/js/
20 KB
8 KB
Script
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/js/popper.min.js
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
7812
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Sat, 13 Jul 2019 17:28:00 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
bootstrap.min.js
beta.warfareplugins.com/Signin/secure-docu/assets/js/
100 KB
32 KB
Script
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/js/bootstrap.min.js
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
829ad53bf9c48fdeef3adbea95a53e8b57c4499198be68b1b7c1ac353790f50c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
32208
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Sat, 13 Jul 2019 17:29:38 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
logo.svg
beta.warfareplugins.com/Signin/secure-docu/assets/images/
4 KB
2 KB
Image
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/images/logo.svg
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
1520
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Mon, 21 Jan 2019 10:45:04 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
ellipsis_white.svg
beta.warfareplugins.com/Signin/secure-docu/assets/images/
915 B
931 B
Image
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/images/ellipsis_white.svg
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/login.php
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
288
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Mon, 21 Jan 2019 10:45:04 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT
background.svg
beta.warfareplugins.com/Signin/secure-docu/assets/images/
2 KB
1 KB
Image
General
Full URL
http://beta.warfareplugins.com/Signin/secure-docu/assets/images/background.svg
Requested by
Host: beta.warfareplugins.com
URL: http://beta.warfareplugins.com/Signin/secure-docu/assets/css/login.css
Protocol
HTTP/1.1
Server
66.147.238.213 Clifton Park, United States, ASN23535 (HOSTROCKET, US),
Reverse DNS
Software
www.fbi.gov /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
http://beta.warfareplugins.com/Signin/secure-docu/assets/css/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 21 Sep 2020 05:15:51 GMT
Content-Encoding
gzip
Origin
https://www.fbi.gov
Connection
Keep-Alive
X_FORWARDED_FOR
104.16.77.187
X-Forwarded-Proto
https
Vary
Accept-Encoding
Content-Length
685
X-XSS-Protection
1; mode=block
Server
www.fbi.gov
X-Content-Type
nosniff
REMOTE_ADDR
104.16.77.187
Last-Modified
Thu, 21 May 2020 15:27:06 GMT
X-Forwarded-Host
www.fbi.gov
Host
www.fbi.gov
Strict-Transport-Security
max-age=31536000
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Referer
https://www.fbi.gov
Accept-Ranges
bytes
Expires
Mon, 28 Sep 2020 05:15:51 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| Popper

1 Cookies

Domain/Path Name / Value
beta.warfareplugins.com/ Name: PHPSESSID
Value: eb5bc9d35c996dfeee615a8710bcfd55

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block