docuserve.w3spaces.com
Open in
urlscan Pro
2600:9000:206f:fa00:b:df74:43c0:93a1
Malicious Activity!
Public Scan
Submission: On November 07 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon on July 11th 2022. Valid for: a year.
This is the only time docuserve.w3spaces.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Adobe (Consumer) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2600:9000:206... 2600:9000:206f:fa00:b:df74:43c0:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 192.185.86.241 192.185.86.241 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 192.229.133.221 192.229.133.221 | 15133 (EDGECAST) (EDGECAST) | |
6 | 5 |
ASN16509 (AMAZON-02, US)
docuserve.w3spaces.com |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: dyvithhotel.com
jubileseyaa.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
jubileseyaa.com
jubileseyaa.com |
398 KB |
1 |
w3schools.com
www.w3schools.com — Cisco Umbrella Rank: 21815 |
5 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 361 |
29 KB |
1 |
w3spaces.com
docuserve.w3spaces.com |
2 KB |
6 | 4 |
Domain | Requested by | |
---|---|---|
3 | jubileseyaa.com |
cdnjs.cloudflare.com
docuserve.w3spaces.com |
1 | www.w3schools.com |
docuserve.w3spaces.com
|
1 | cdnjs.cloudflare.com |
docuserve.w3spaces.com
|
1 | docuserve.w3spaces.com | |
6 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.w3spaces.com Amazon |
2022-07-11 - 2023-08-09 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
jubileseyaa.com R3 |
2022-09-17 - 2022-12-16 |
3 months | crt.sh |
*.w3schools.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-04-08 - 2023-05-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://docuserve.w3spaces.com/serve.html
Frame ID: 7AA23FF74F033AB075EA83B2B5A9B028
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Share Point OnlineDetected technologies
WordPress (CMS) ExpandDetected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
serve.html
docuserve.w3spaces.com/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/ |
90 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
___.php
jubileseyaa.com//wp-includes/js/thickbox/v1/ |
46 KB 30 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
jubileseyaa.com/wp-includes/js/thickbox/v1/ |
666 KB 364 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
x3mj.js
jubileseyaa.com/wp-includes/js/thickbox/v1/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
30 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
157 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
771 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
50 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
50 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Adobe (Consumer) Generic (Online)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| _0x4b25 function| _0x41715a function| _0x3b250 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
docuserve.w3spaces.com
jubileseyaa.com
www.w3schools.com
192.185.86.241
192.229.133.221
2600:9000:206f:fa00:b:df74:43c0:93a1
2606:4700::6811:180e
0ddae43c6f857f48fc4606bb50bc202425d1dd8cdafde8f850c3544fedc00efc
26c62dbdf527b8dcbf378ea62f129cbbba3b244730687909ba21ecd729c9d2e6
51646392060a93f1f99c4e1d616abdcdb96fa30d15a0e08455a29257603786f3
57898461712a639d119bdf88b7145919dcc8956c7a271d2e4a1084b29eae6785
72a2b3b0b9e762f2d697a2579db7f93e221ff782f622362c46aa61641817d4ee
7829f065e0e10c8466f3d57766e0719421b7b652f6a1082f21b98702f1b28a30
b5dad0504353911e9b140783d59e2bb2775d35e0c926c433c8d6048f59d99313
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
c9cb8453e1b8c38bb95389a196a7feddda2fc52e3e5df2479a1945324d439f5f
d66de1e3dcd1d737b3a1afd965309d018d120d13fc37d56538ea0dd6b0f8721f