www.cmanextstep.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3037::6818:77b9, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.cmanextstep.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on January 30th 2020. Valid for: 8 months.

This is the only time www.cmanextstep.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3037::6818:77b9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.101.12.193 151.101.12.193	54113 (FASTLY) (FASTLY)
1	104.16.2.35 104.16.2.35	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	3

3 2606:4700:3037::6818:77b9 (United States)

ASN13335 (CLOUDFLARENET, US)

www.cmanextstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.2.35 (United States)

ASN13335 (CLOUDFLARENET, US)

i.stack.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cmanextstep.com www.cmanextstep.com	3 KB
2	imgur.com i.imgur.com i.stack.imgur.com	276 KB
5	2

	Domain	Requested by
3	www.cmanextstep.com	www.cmanextstep.com
1	i.stack.imgur.com	www.cmanextstep.com
1	i.imgur.com	www.cmanextstep.com
5	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-01-30` - `2020-10-09`	8 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2020-01-15` - `2022-03-16`	2 years	crt.sh
i.stack.imgur.com DigiCert SHA2 Secure Server CA	`2018-10-16` - `2020-11-25`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.cmanextstep.com/strap/ht/?email
Frame ID: 598817C64368696AAF31798D3F4B1EB0
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

279 kB
Transfer

283 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.cmanextstep.com/strap/ht/	8 KB 3 KB	553ms 515ms	Document text/html	2606:4700:3037::6818:77b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.cmanextstep.com/strap/ht/?email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6818:77b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f972e0c68acc7543b14396067ef589df4890dac9d269945f8256d9997a0071cd` Request headers :method GET :authority www.cmanextstep.com :scheme https :path /strap/ht/?email pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Sat, 18 Apr 2020 02:14:54 GMT content-type text/html; charset=utf-8 set-cookie __cfduid=d88130fbf2aa847ea0d112d64f1d951f11587176093; expires=Mon, 18-May-20 02:14:53 GMT; path=/; domain=.cmanextstep.com; HttpOnly; SameSite=Lax; Secure cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 585adffb1bf12488-FRA content-encoding br cf-request-id 022caa50ec00002488ea8c4200000001
GET H2	404	jquery.js www.cmanextstep.com/strap/ht/js/	0 0	2181ms 2179ms	Script text/html	2606:4700:3037::6818:77b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.cmanextstep.com/strap/ht/js/jquery.js Requested by Host: www.cmanextstep.com URL: https://www.cmanextstep.com/strap/ht/?email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6818:77b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://www.cmanextstep.com/strap/ht/?email User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sat, 18 Apr 2020 02:14:56 GMT cf-cache-status BYPASS server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html; charset=UTF-8 status 404 cache-control no-transform, no-cache, no-store, must-revalidate cf-ray 585adffeffcd2488-FRA link <https://www.cmanextstep.com/wp-json/>; rel="https://api.w.org/" cf-request-id 022caa535a00002488ea8d9200000001 expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	vofCsbF.jpg i.imgur.com/	2 KB 2 KB	163ms 51ms	Image image/jpeg	151.101.12.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/vofCsbF.jpg Requested by Host: www.cmanextstep.com URL: https://www.cmanextstep.com/strap/ht/?email Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash `11ea121407753d8dde37c8bef8f75ae33f377ca071e047faab7ffe53f66e2281` Request headers Referer https://www.cmanextstep.com/strap/ht/?email User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sat, 18 Apr 2020 02:14:54 GMT age 855626 x-cache HIT, HIT status 200 content-length 1860 x-served-by cache-bwi5142-BWI, cache-fra19160-FRA last-modified Wed, 08 Apr 2020 04:33:31 GMT server cat factory 1.0 x-timer S1587176095.691489,VS0,VE1 etag "7149ee0eeddd419b1ccda377ca4ed763" access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	ms-logo-v1%20copy.svg www.cmanextstep.com/wp-content/uploads/	756 B 556 B	14ms 13ms	Image image/svg+xml	2606:4700:3037::6818:77b9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.cmanextstep.com/wp-content/uploads/ms-logo-v1%20copy.svg Requested by Host: www.cmanextstep.com URL: https://www.cmanextstep.com/strap/ht/?email Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::6818:77b9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69` Request headers Referer https://www.cmanextstep.com/strap/ht/?email User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sat, 18 Apr 2020 02:14:54 GMT content-encoding br cf-cache-status HIT last-modified Wed, 08 Apr 2020 04:55:23 GMT server cloudflare age 60483 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type image/svg+xml status 200 cache-control public, max-age=16070400 cf-ray 585adffff8c62488-FRA cf-request-id 022caa53ff00002488ea8e2200000001 expires Sun, 17 May 2020 09:26:51 GMT
GET H2	200	vzbuQ.jpg i.stack.imgur.com/	273 KB 274 KB	223ms 74ms	Image image/jpeg	104.16.2.35 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://i.stack.imgur.com/vzbuQ.jpg Requested by Host: www.cmanextstep.com URL: https://www.cmanextstep.com/strap/ht/?email Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.16.2.35 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f` Request headers Referer https://www.cmanextstep.com/strap/ht/?email User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sat, 18 Apr 2020 02:14:56 GMT cf-cache-status HIT age 6085078 status 200 content-type image/jpeg content-length 279841 cf-request-id 022caa5c960000ee2b881d0200000001 last-modified Sun, 17 Jun 2018 23:41:30 GMT server cloudflare etag "bcc8c3add31d42b2c4b6d13c0db8d3a5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-amz-version-id V.CiiONugOFcBvoHG0Y85bcKnjQRsbB5 cache-control public, max-age=315360000 accept-ranges bytes cf-ray 585ae00dbd23ee2b-CDG expires Tue, 16 Apr 2030 02:14:56 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.cmanextstep.com/	1970-01-19 09:36:08	Name: __cfduid Value: d88130fbf2aa847ea0d112d64f1d951f11587176093

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
i.stack.imgur.com
www.cmanextstep.com
104.16.2.35
151.101.12.193
2606:4700:3037::6818:77b9
11ea121407753d8dde37c8bef8f75ae33f377ca071e047faab7ffe53f66e2281
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6bde963a562ffd594492bdff280c01e9e6518856aa3a9f14b96fcad867ce2f0f
f972e0c68acc7543b14396067ef589df4890dac9d269945f8256d9997a0071cd

www.cmanextstep.com Open in urlscan Pro 2606:4700:3037::6818:77b9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

279 kBTransfer

283 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

www.cmanextstep.com Open in urlscan Pro
2606:4700:3037::6818:77b9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

279 kB
Transfer

283 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!