westiegolden.icu - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700:30::681b:bbea, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is westiegolden.icu.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on February 25th 2019. Valid for: a year.

This is the only time westiegolden.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Outlook (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:30:... 2606:4700:30::681b:baea	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2606:4700:30:... 2606:4700:30::681b:bbea	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2

1 2606:4700:30::681b:baea (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

westiegolden.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:30::681b:bbea (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

westiegolden.icu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	westiegolden.icu 1 redirects westiegolden.icu	12 KB
1	sitepoint.com www.sitepoint.com	6 KB
3	2

	Domain	Requested by
3	westiegolden.icu	1 redirects westiegolden.icu
1	www.sitepoint.com	westiegolden.icu
3	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-02-25` - `2020-02-25`	a year	crt.sh
sitepoint.com SSL.com Premium EV CA	`2018-08-07` - `2019-09-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php
Frame ID: A96D0EBFA3BE7B064C0AD54940C53117
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php HTTP 301
https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

3
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

18 kB
Transfer

30 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php HTTP 301
https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request LL1.php Show response westiegolden.icu/SharepointInvoiceDue/onedri/one/ Redirect Chain http://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php	2 KB 1 KB	151ms 119ms	Document text/html	2606:4700:30::681b:bbea Cloudflare
General Check archive.org Show headers Download Go to Full URL https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:bbea , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `08ef479c2b4c5c6e184b6240415c0a9ca81595a4270d1bbb72fa69daabe30ecd` Request headers :method GET :authority westiegolden.icu :scheme https :path /SharepointInvoiceDue/onedri/one/LL1.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Wed, 27 Feb 2019 06:50:13 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d4ac84111ea18454f838e4329430ed8981551250213; expires=Thu, 27-Feb-20 06:50:13 GMT; path=/; domain=.westiegolden.icu; HttpOnly; Secure expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 4af8b749b8fe63af-FRA content-encoding br Redirect headers Date Wed, 27 Feb 2019 06:50:13 GMT Transfer-Encoding chunked Connection keep-alive Cache-Control max-age=3600 Expires Wed, 27 Feb 2019 07:50:13 GMT Location https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php Vary Accept-Encoding Server cloudflare CF-RAY 4af8b7497aabc288-FRA
GET H/1.1	200 OK	MaskedPassword.js Show response www.sitepoint.com/examples/password/MaskedPassword/	17 KB 6 KB	864ms 177ms	Script application/javascript	54.148.84.95 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js Requested by Host: westiegolden.icu URL: https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-148-84-95.us-west-2.compute.amazonaws.com Software Apache/2.2.22 (Debian) / Resource Hash `2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825` Request headers Referer https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 27 Feb 2019 05:07:50 GMT Content-Encoding gzip X-Cache-Lookup HIT from ip-172-31-17-101.us-west-2.compute.internal:3128 Last-Modified Fri, 15 Oct 2010 00:03:45 GMT Server Apache/2.2.22 (Debian) Age 6144 ETag "680936-4208-4929c8f629a40" Vary Accept-Encoding X-Cache HIT from ip-172-31-17-101.us-west-2.compute.internal Content-Type application/javascript Accept-Ranges bytes Content-Length 5767
GET H2	200	LL1.png westiegolden.icu/SharepointInvoiceDue/onedri/one/live_files/	11 KB 11 KB	27ms 26ms	Image image/png	2606:4700:30::681b:bbea Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://westiegolden.icu/SharepointInvoiceDue/onedri/one/live_files/LL1.png Requested by Host: westiegolden.icu URL: https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:bbea , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `80005e519c9f37c4e4ea12b2e19d53376f268f318e99bcf8731f76899885a809` Request headers :path /SharepointInvoiceDue/onedri/one/live_files/LL1.png pragma no-cache cookie __cfduid=d4ac84111ea18454f838e4329430ed8981551250213 accept-encoding gzip, deflate, br user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority westiegolden.icu referer https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php :scheme https :method GET Referer https://westiegolden.icu/SharepointInvoiceDue/onedri/one/LL1.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Wed, 27 Feb 2019 06:50:13 GMT cf-cache-status MISS last-modified Wed, 17 Jan 2018 09:32:18 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/png status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 4af8b74a79e763af-FRA content-length 10776 expires Wed, 27 Feb 2019 10:50:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Outlook (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| MaskedPassword

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.westiegolden.icu/	1970-01-19 07:39:46	Name: __cfduid Value: d4ac84111ea18454f838e4329430ed8981551250213

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

westiegolden.icu
www.sitepoint.com
2606:4700:30::681b:baea
2606:4700:30::681b:bbea
54.148.84.95
08ef479c2b4c5c6e184b6240415c0a9ca81595a4270d1bbb72fa69daabe30ecd
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
80005e519c9f37c4e4ea12b2e19d53376f268f318e99bcf8731f76899885a809

westiegolden.icu Open in urlscan Pro 2606:4700:30::681b:bbea Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

18 kBTransfer

30 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

westiegolden.icu Open in urlscan Pro
2606:4700:30::681b:bbea Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

18 kB
Transfer

30 kB
Size

1
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!