cavycomforter.com Open in urlscan Pro
51.75.67.123  Malicious Activity! Public Scan

Submitted URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Effective URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Submission: On November 15 via manual from GB

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 51.75.67.123, located in United Kingdom and belongs to OVH, FR. The main domain is cavycomforter.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 12th 2018. Valid for: 3 months.
This is the only time cavycomforter.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 51.75.67.123 16276 (OVH)
8 104.111.234.198 16625 (AKAMAI-AS)
1 151.101.2.110 54113 (FASTLY)
1 162.247.242.20 23467 (NEWRELIC-...)
1 23.5.96.76 16625 (AKAMAI-AS)
12 5
Domain Requested by
8 img1.wsimg.com cavycomforter.com
img1.wsimg.com
1 gui.secureserver.net img1.wsimg.com
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com cavycomforter.com
1 cavycomforter.com
12 5

This site contains links to these domains. Also see Links.

Domain
www.secureserver.net
Subject Issuer Validity Valid
cavycomforter.com
cPanel, Inc. Certification Authority
2018-11-12 -
2019-02-10
3 months crt.sh
*.wsimg.com
Starfield Secure Certificate Authority - G2
2018-09-25 -
2020-09-25
2 years crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2018-11-07 -
2019-04-14
5 months crt.sh
*.nr-data.net
GeoTrust RSA CA 2018
2018-01-11 -
2020-03-17
2 years crt.sh
*.secureserver.net
Starfield Secure Certificate Authority - G2
2016-11-01 -
2019-11-01
3 years crt.sh

This page contains 1 frames:

Primary Page: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Frame ID: 25324507A3822735A06FE27B37DD6E3C
Requests: 12 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • env /^NREUM/i

Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

295 kB
Transfer

745 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.htm
cavycomforter.com/apps/godaddy-webmail/godaddy/
63 KB
63 KB
Document
General
Full URL
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.75.67.123 , United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
123.ip-51-75-67.eu
Software
Apache /
Resource Hash
13807065385399bb10a14efa2391674214f6abd3102bf74f9569b2ccfd36ff44

Request headers

Host
cavycomforter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 15 Nov 2018 13:22:31 GMT
Server
Apache
Last-Modified
Tue, 17 Apr 2018 18:34:28 GMT
Accept-Ranges
bytes
Content-Length
64062
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
uxcore-pl.min.css
img1.wsimg.com/ux/1.3.50-brand/css/
145 KB
25 KB
Stylesheet
General
Full URL
https://img1.wsimg.com/ux/1.3.50-brand/css/uxcore-pl.min.css
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0e9c92ce3fb08350e36aa2504c2edf3bae82be0168478e03ae5a8ac0f1702bc5

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:31 GMT
content-encoding
gzip
last-modified
Thu, 09 Nov 2017 21:38:40 GMT
status
200
etag
"c67c171ca359d31:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
25192
expires
Fri, 15 Nov 2019 13:22:31 GMT
bg-pass-reseller.png
img1.wsimg.com/auth/v1/static/1117/img/
303 B
303 B
Image
General
Full URL
https://img1.wsimg.com/auth/v1/static/1117/img/bg-pass-reseller.png
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b8248716a149758eebeabc57266fbbc93c7c9f84b8d2806dc097300a11b8a7f9

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:32 GMT
content-encoding
gzip
status
404
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
content-length
247
expires
Fri, 15 Nov 2019 13:22:32 GMT
Boing-Bold.woff2
img1.wsimg.com/ux/fonts/1.4/woff2/
28 KB
28 KB
Font
General
Full URL
https://img1.wsimg.com/ux/fonts/1.4/woff2/Boing-Bold.woff2
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
49f6c1034e3661e29c5de12d1c97e489565c7d55fec513c2668a57329367e082

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://img1.wsimg.com/ux/1.3.50-brand/css/uxcore-pl.min.css
Origin
https://cavycomforter.com

Response headers

date
Thu, 15 Nov 2018 13:22:31 GMT
last-modified
Wed, 04 May 2016 22:29:16 GMT
etag
"59c6cd6454a6d11:0"
status
200
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
28220
expires
Fri, 15 Nov 2019 13:22:31 GMT
uxfont.woff2
img1.wsimg.com/ux/1.3.50-brand/fonts/
25 KB
25 KB
Font
General
Full URL
https://img1.wsimg.com/ux/1.3.50-brand/fonts/uxfont.woff2
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
429525935077de20eaff6dce3bfc28f3d0701679975c812f7a85b16f705e7363

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://img1.wsimg.com/ux/1.3.50-brand/css/uxcore-pl.min.css
Origin
https://cavycomforter.com

Response headers

date
Thu, 15 Nov 2018 13:22:31 GMT
last-modified
Thu, 09 Nov 2017 21:40:30 GMT
etag
"d2d1285da359d31:0"
status
200
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
25292
expires
Fri, 15 Nov 2019 13:22:31 GMT
nr-1071.min.js
js-agent.newrelic.com/
23 KB
9 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-1071.min.js
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.110 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:32 GMT
content-encoding
gzip
x-amz-request-id
481FE111768851BD
x-cache
HIT
status
200
content-length
9086
x-amz-id-2
0YRbL+xndniUNryTFyPMh7blhTKIHFgax7VZOYNB0faQOHdTX/PT1kK81w0HdqDzPFNiC/1Ey3g=
x-served-by
cache-fra19146-FRA
last-modified
Wed, 28 Feb 2018 23:33:31 GMT
server
AmazonS3
x-timer
S1542288152.244104,VS0,VE0
etag
"a1a545c95f313a230157b47dca555c25"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3861
uxcore.en.min.js
img1.wsimg.com/ux/1.3.50-brand/js/
448 KB
138 KB
Script
General
Full URL
https://img1.wsimg.com/ux/1.3.50-brand/js/uxcore.en.min.js
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4e9eb39bd2d4a943ebc78767969a9b62c5490ae30dff9dc6d29c8f4cd3e4c112

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:32 GMT
content-encoding
gzip
last-modified
Thu, 09 Nov 2017 21:42:31 GMT
status
200
etag
"374694a5a359d31:0"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
141232
expires
Fri, 15 Nov 2019 13:22:32 GMT
4549d38e45
bam.nr-data.net/1/
57 B
260 B
Script
General
Full URL
https://bam.nr-data.net/1/4549d38e45?a=42733734&v=1071.385e752&to=bwAAMhFZCBJSAhddX1ZKJBMNWxIIXA9MVUVMDUwQCl0REh0NAk1fTRFMEApdERIdFQZZQFQEFgM8Tg8ERFs3UV1ICQMSBm4PBERPBFFE&rst=477&ref=https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm&qt=1&ap=76&be=77&fe=465&dc=137&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1542288151777,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:35,%22c%22:35,%22s%22:42,%22ce%22:56,%22rq%22:56,%22rp%22:65,%22rpe%22:84,%22dl%22:72,%22di%22:137,%22ds%22:137,%22de%22:137,%22dc%22:464,%22l%22:464,%22le%22:466%7D,%22navigation%22:%7B%7D%7D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1071.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.20 , United States, ASN23467 (NEWRELIC-AS-1 - New Relic, US),
Reverse DNS
bam-8.nr-data.net
Software
/
Resource Hash
33c3bf91a25c2b7a355ab82043af5b30efd739892586c6fef51a740c1429265d

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Length
57
Content-Type
text/javascript;charset=ISO-8859-1
languageheader.min.js
img1.wsimg.com/ux/eldorado/1.5.111/js/
13 KB
5 KB
Script
General
Full URL
https://img1.wsimg.com/ux/eldorado/1.5.111/js/languageheader.min.js
Requested by
Host: cavycomforter.com
URL: https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
72a403fb208a5a640bc06861e1e8faa10d0ab3077513d73f273f3e9081f65c09

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:32 GMT
content-encoding
gzip
last-modified
Wed, 14 Mar 2018 17:34:36 GMT
status
200
etag
"6936dbb8babbd31:0"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
4993
expires
Fri, 15 Nov 2019 13:22:32 GMT
includemarket
gui.secureserver.net/pcjson/support/
359 B
1 KB
Script
General
Full URL
https://gui.secureserver.net/pcjson/support/includemarket?plid=3153&callback=jQuery18302738257430115849_1542288152295&_=1542288152332
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/ux/1.3.50-brand/js/uxcore.en.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.5.96.76 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-5-96-76.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/8.5 / ARR/2.5, ASP.NET
Resource Hash
34321ae8c3318e0003639ef086a5d855dad85a67e84de82e4b801a043fa65549

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 15 Nov 2018 13:22:32 GMT
Content-Type
text/javascript; charset=utf-8
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
X-Powered-By
ARR/2.5, ASP.NET
P3P
policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR OUR IND", policyref="/w3c/p3p.xml", CP="COM CNT DEM FIN GOV INT NAV ONL PHY PRE PUR STA UNI IDC CAO OTI DSP COR CUR i OUR IND"
Cache-Control
no-cache
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
359
Expires
-1
login.js
img1.wsimg.com/auth/v1/static/1117/js/src/
0
0
Script
General
Full URL
https://img1.wsimg.com/auth/v1/static/1117/js/src/login.js
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/ux/1.3.50-brand/js/uxcore.en.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:32 GMT
content-encoding
gzip
status
404
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
content-length
240
expires
Fri, 15 Nov 2019 13:22:32 GMT
form.js
img1.wsimg.com/auth/v1/static/1117/js/src/
0
0
Script
General
Full URL
https://img1.wsimg.com/auth/v1/static/1117/js/src/form.js
Requested by
Host: img1.wsimg.com
URL: https://img1.wsimg.com/ux/1.3.50-brand/js/uxcore.en.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.234.198 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-234-198.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Referer
https://cavycomforter.com/apps/godaddy-webmail/godaddy/index.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 15 Nov 2018 13:22:32 GMT
content-encoding
gzip
status
404
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
access-control-allow-origin
*
cache-control
max-age=31536000
timing-allow-origin
*
content-length
239
expires
Fri, 15 Nov 2019 13:22:32 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| newrelic function| __nr_require object| ux object| Globals object| translate_dict object| uxel object| _trfq function| fire_virtual_page function| require object| openit function| $ function| jQuery function| _ object| jQuery18302738257430115849 undefined| jQuery18302738257430115849_1542288152295

0 Cookies