myzyav1.org Open in urlscan Pro
54.38.134.239 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://myzyav1.org/step2.php
Submission: On September 09 via automatic, source openphish (September 9th 2018, 11:05:03 am UTC)

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 20 HTTP transactions. The main IP is 54.38.134.239, located in Woodbridge, United States and belongs to OVH, FR. The main domain is myzyav1.org.

This is the only time myzyav1.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Wells Fargo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	54.38.134.239 54.38.134.239	16276 (OVH) (OVH)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	2400:cb00:204... 2400:cb00:2048:1::6813:c497	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
20	3

14 54.38.134.239 (Woodbridge, United States)

ASN16276 (OVH, FR)
PTR: ip239.ip-54-38-134.eu

myzyav1.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2400:cb00:2048:1::6813:c497 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	myzyav1.org myzyav1.org	41 KB
5	cloudflare.com cdnjs.cloudflare.com	107 KB
1	sitepoint.com www.sitepoint.com	6 KB
20	3

	Domain	Requested by
14	myzyav1.org	myzyav1.org
5	cdnjs.cloudflare.com	myzyav1.org
1	www.sitepoint.com	myzyav1.org
20	3

This site contains no links.

Subject Issuer	Validity	Valid
sitepoint.com SSL.com Premium EV CA	`2018-08-07` - `2019-09-23`	a year	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-04-14` - `2018-10-21`	6 months	crt.sh

This page contains 1 frames:

Primary Page: http://myzyav1.org/step2.php
Frame ID: 087331F733786BA1C6F4D5DD3A2286AB
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

20
Requests

30 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

154 kB
Transfer

420 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request step2.php Show response
myzyav1.org/ 7 KB
7 KB 79ms
37ms Document
text/html 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 220b01e6a14c2038ab1906bdd39aded729953278eed873795c27ce55ab85d080

Request headers

Host: myzyav1.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 087331F733786BA1C6F4D5DD3A2286AB

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK MaskedPassword.js Show response
www.sitepoint.com/examples/password/MaskedPassword/ 17 KB
6 KB 770ms
190ms Script
application/javascript 54.148.84.95
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
Software: Apache/2.2.22 (Debian) /
Resource Hash: 2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825

Request headers

Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 00:23:21 GMT
Content-Encoding: gzip
X-Cache-Lookup: HIT from ip-172-31-22-247.us-west-2.compute.internal:3128
Last-Modified: Fri, 15 Oct 2010 00:03:45 GMT
Server: Apache/2.2.22 (Debian)
Age: 2472
ETag: "680936-4208-4929c8f629a40"
Vary: Accept-Encoding
X-Cache: HIT from ip-172-31-22-247.us-west-2.compute.internal
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 5767

GET
S 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ 256 KB
78 KB 40ms
16ms Script
application/javascript 2400:cb00:2048:1::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/jquery.js

Requested by

Host: myzyav1.org
URL: http://myzyav1.org/step2.php

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 09 Sep 2018 11:04:53 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
status: 200
served-in-seconds: 0.003
last-modified: Thu, 17 May 2018 09:21:00 GMT
server: cloudflare
etag: W/"5afd497c-40023"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 45792d335c5196c4-FRA
expires: Fri, 30 Aug 2019 11:04:53 GMT

GET
S 200 jquery.validate.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ 45 KB
13 KB 34ms
10ms Script
application/javascript 2400:cb00:2048:1::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/jquery.validate.js

Requested by

Host: myzyav1.org
URL: http://myzyav1.org/step2.php

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2aecc3e7494318d2398eafe2a6de21c03a52264ddf86c7934758ddbda06864bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 09 Sep 2018 11:04:53 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
status: 200
served-in-seconds: 0.006
last-modified: Thu, 17 May 2018 09:20:58 GMT
server: cloudflare
etag: W/"5afd497a-b4b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 45792d335c5696c4-FRA
expires: Fri, 30 Aug 2019 11:04:53 GMT

GET
S 200 additional-methods.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ 38 KB
11 KB 39ms
15ms Script
application/javascript 2400:cb00:2048:1::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/additional-methods.js

Requested by

Host: myzyav1.org
URL: http://myzyav1.org/step2.php

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d95e0e21c160558eb3d2bacd76779048cb600cc04e15264e0835f4f86b4b375

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 09 Sep 2018 11:04:53 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
status: 200
served-in-seconds: 0.002
last-modified: Thu, 17 May 2018 09:20:13 GMT
server: cloudflare
etag: W/"5afd494d-985d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 45792d335c5596c4-FRA
expires: Fri, 30 Aug 2019 11:04:53 GMT

GET
S 200 jquery.maskedinput.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/ 10 KB
3 KB 40ms
16ms Script
application/javascript 2400:cb00:2048:1::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/jquery.maskedinput.js

Requested by

Host: myzyav1.org
URL: http://myzyav1.org/step2.php

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 09 Sep 2018 11:04:53 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
status: 200
served-in-seconds: 0.002
last-modified: Thu, 17 May 2018 09:20:13 GMT
server: cloudflare
etag: W/"5afd494d-284d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 45792d335c5496c4-FRA
expires: Fri, 30 Aug 2019 11:04:53 GMT

GET
S 200 jquery.payment.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.payment/1.3.2/ 17 KB
4 KB 48ms
25ms Script
application/javascript 2400:cb00:2048:1::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.payment/1.3.2/jquery.payment.js

Requested by

Host: myzyav1.org
URL: http://myzyav1.org/step2.php

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

60499c4335239d51fa6ef40bd909ba8e62a2a468b16b74f0fd9fadac1eee4bbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sun, 09 Sep 2018 11:04:53 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
status: 200
served-in-seconds: 0.000
last-modified: Thu, 17 May 2018 09:20:14 GMT
server: cloudflare
etag: W/"5afd494e-421b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 45792d335c5396c4-FRA
expires: Fri, 30 Aug 2019 11:04:53 GMT

GET
H/1.1 200
OK ws6.png
myzyav1.org/images/ 3 KB
3 KB 27ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/ws6.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 6caea485cd6ddf33e86b25d8675d868008fbf0bb061506e8a7ecc6d08b52cf41

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Fri, 04 Aug 2017 15:09:26 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3256

GET
H/1.1 200
OK logo.png
myzyav1.org/images/ 2 KB
3 KB 27ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/logo.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 593011e4c5e2416a84cc50d01760a22c0667cd65fdbb8924b69417fa9206c628

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:09:00 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2440

GET
H/1.1 200
OK secu.png
myzyav1.org/images/ 907 B
1 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/secu.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: accf2ac7a8cdd42af0374fd634ee14bedcffbb3338c4ae571545f7c61706a4bc

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:35:12 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 907

GET
H/1.1 200
OK wf17.png
myzyav1.org/images/ 265 B
506 B 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/wf17.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 30c71ce57687cb04f333ebce07c6098bd1a0ce6556e52f73dbf853dc5d56dd2a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:34:56 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 265

GET
H/1.1 200
OK wf20.png
myzyav1.org/images/ 3 KB
4 KB 27ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/wf20.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 79a3b908565aac75c2c635ed9a03ac88effed84dc4467317b324573a1cbb0a46

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:40:02 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 3350

GET
H/1.1 200
OK wf21.png
myzyav1.org/images/ 1 KB
1 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/wf21.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: ffbb4b951f2a769fa461c96def503f4a208f25e12e9eabd8a765f641f0a8ea58

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:40:34 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 1287

GET
H/1.1 200
OK wf22.png
myzyav1.org/images/ 274 B
515 B 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/wf22.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 5ea300fe42055ada46470525c1a89801811ffd2a99506e224ade747dae87c06c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:41:06 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 274

GET
H/1.1 200
OK wf18.png
myzyav1.org/images/ 5 KB
5 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/wf18.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: 799d66f9d6cd6cd336a5c39fb7d7208c5e8eac8b4818fb22715d991a91657896

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 04:35:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 5346

GET
H/1.1 200
OK z5.png
myzyav1.org/images/ 6 KB
6 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/z5.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: ae61eb886ea85df9cbe65fbc56c154f5871347cc405c65a907db8d2cd085c579

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Tue, 01 Aug 2017 13:31:12 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 5632

GET
H/1.1 200
OK ws2.png
myzyav1.org/images/ 3 KB
4 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/ws2.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: ef279d8ddd59ca93db7ae7f87a584b66f0624f2e0ce12e2f0473c15d93db123d

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Tue, 01 Aug 2017 13:33:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=90
Content-Length: 3348

GET
H/1.1 200
OK ws3.png
myzyav1.org/images/ 3 KB
3 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/ws3.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: cf8369003c926d4192195b84f30574f9847a2363ce12a487c8373cbef6858361

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Tue, 01 Aug 2017 13:34:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 2735

GET
H/1.1 200
OK ws7.png
myzyav1.org/images/ 1 KB
1 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/ws7.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: df3526375b4f6b40cca058a7ade8e5fd543db18416756da10843fb58eabf74b9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Tue, 16 May 2017 13:14:06 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 1093

GET
H/1.1 200
OK confirm.png
myzyav1.org/images/ 1 KB
1 KB 26ms
26ms Image
image/png 54.38.134.239
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://myzyav1.org/images/confirm.png
Requested by: Host: myzyav1.org
URL: http://myzyav1.org/step2.php
Protocol: HTTP/1.1
Server: 54.38.134.239 Woodbridge, United States, ASN16276 (OVH, FR),
Reverse DNS: ip239.ip-54-38-134.eu
Software: Apache /
Resource Hash: ea9f9e865ee6e566bb3d96cddb44b6b6603d845e728399a209423d2688e07d8b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: myzyav1.org
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://myzyav1.org/step2.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://myzyav1.org/step2.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sun, 09 Sep 2018 11:04:21 GMT
Last-Modified: Sat, 04 Mar 2017 05:23:28 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 1238

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Wells Fargo (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| MaskedPassword function| $ function| jQuery function| unhideBody

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
myzyav1.org
www.sitepoint.com
2400:cb00:2048:1::6813:c497
54.148.84.95
54.38.134.239
1d95e0e21c160558eb3d2bacd76779048cb600cc04e15264e0835f4f86b4b375
220b01e6a14c2038ab1906bdd39aded729953278eed873795c27ce55ab85d080
2aecc3e7494318d2398eafe2a6de21c03a52264ddf86c7934758ddbda06864bb
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
30c71ce57687cb04f333ebce07c6098bd1a0ce6556e52f73dbf853dc5d56dd2a
593011e4c5e2416a84cc50d01760a22c0667cd65fdbb8924b69417fa9206c628
5ea300fe42055ada46470525c1a89801811ffd2a99506e224ade747dae87c06c
60499c4335239d51fa6ef40bd909ba8e62a2a468b16b74f0fd9fadac1eee4bbf
6caea485cd6ddf33e86b25d8675d868008fbf0bb061506e8a7ecc6d08b52cf41
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
799d66f9d6cd6cd336a5c39fb7d7208c5e8eac8b4818fb22715d991a91657896
79a3b908565aac75c2c635ed9a03ac88effed84dc4467317b324573a1cbb0a46
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
accf2ac7a8cdd42af0374fd634ee14bedcffbb3338c4ae571545f7c61706a4bc
ae61eb886ea85df9cbe65fbc56c154f5871347cc405c65a907db8d2cd085c579
cf8369003c926d4192195b84f30574f9847a2363ce12a487c8373cbef6858361
df3526375b4f6b40cca058a7ade8e5fd543db18416756da10843fb58eabf74b9
ea9f9e865ee6e566bb3d96cddb44b6b6603d845e728399a209423d2688e07d8b
ef279d8ddd59ca93db7ae7f87a584b66f0624f2e0ce12e2f0473c15d93db123d
ffbb4b951f2a769fa461c96def503f4a208f25e12e9eabd8a765f641f0a8ea58

myzyav1.org Open in urlscan Pro 54.38.134.239 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

20 Requests

30 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

154 kBTransfer

420 kBSize

0 Cookies

0 Outgoing links

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

myzyav1.org Open in urlscan Pro
54.38.134.239 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

30 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

154 kB
Transfer

420 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!