yourfaztrw.com
Open in
urlscan Pro
69.55.55.84
Malicious Activity!
Public Scan
Submitted URL: http://suckhoevang24h.org/wp-content/plugins/related-posts-by-taxonomy/includes/assets//?email=carol.palmer@vtmednet.org
Effective URL: https://yourfaztrw.com/One/login.php?email=carol.palmer@vtmednet.org
Submission: On February 07 via manual from US
Effective URL: https://yourfaztrw.com/One/login.php?email=carol.palmer@vtmednet.org
Submission: On February 07 via manual from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 7 HTTP transactions.
The main IP is 69.55.55.84, located in
North Bergen, United States and
belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US.
The main domain is yourfaztrw.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 7th 2019. Valid for: 3 months.
This is the only time yourfaztrw.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 7th 2019. Valid for: 3 months.
This is the only time yourfaztrw.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 45.252.248.10 45.252.248.10 | 63760 (AZDIGI-AS...) (AZDIGI-AS-VN AZDIGI Corporation) | |
| 1 7 | 69.55.55.84 69.55.55.84 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
| 7 | 2 |
1
45.252.248.10
(Binh Duong, Viet Nam)
ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN)
PTR: h6.azdigi.com
ASN63760 (AZDIGI-AS-VN AZDIGI Corporation, VN)
PTR: h6.azdigi.com
| suckhoevang24h.org |
7
69.55.55.84
(North Bergen, United States)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
| yourfaztrw.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
yourfaztrw.com
1 redirects
yourfaztrw.com |
201 KB |
| 1 |
suckhoevang24h.org
1 redirects
suckhoevang24h.org |
345 B |
| 7 | 2 |
| Domain | Requested by | |
|---|---|---|
| 7 | yourfaztrw.com |
1 redirects
yourfaztrw.com
|
| 1 | suckhoevang24h.org | 1 redirects |
| 7 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| yourfaztrw.com cPanel, Inc. Certification Authority |
2019-02-07 - 2019-05-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://yourfaztrw.com/One/login.php?email=carol.palmer@vtmednet.org
Frame ID: 07A1B6623B2710EE5672DFE03CB1A23E
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://suckhoevang24h.org/wp-content/plugins/related-posts-by-taxonomy/includes/assets//?email=carol.p...
HTTP 302
https://yourfaztrw.com/One/?email=carol.palmer@vtmednet.org HTTP 302
https://yourfaztrw.com/One/index1.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.17... Page URL
- https://yourfaztrw.com/One/login.php?email=carol.palmer@vtmednet.org Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://suckhoevang24h.org/wp-content/plugins/related-posts-by-taxonomy/includes/assets//?email=carol.palmer@vtmednet.org
HTTP 302
https://yourfaztrw.com/One/?email=carol.palmer@vtmednet.org HTTP 302
https://yourfaztrw.com/One/index1.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=carol.palmer@vtmednet.org Page URL
- https://yourfaztrw.com/One/login.php?email=carol.palmer@vtmednet.org Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://suckhoevang24h.org/wp-content/plugins/related-posts-by-taxonomy/includes/assets//?email=carol.palmer@vtmednet.org HTTP 302
- https://yourfaztrw.com/One/?email=carol.palmer@vtmednet.org HTTP 302
- https://yourfaztrw.com/One/index1.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=carol.palmer@vtmednet.org
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
index1.php
yourfaztrw.com/One/ Redirect Chain
|
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
point.gif
yourfaztrw.com/One/:abstract.simplenet.com/ |
354 B 354 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
point2.html
yourfaztrw.com/One/abstract.simplenet.com/ |
355 B 355 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.jpg
yourfaztrw.com/One/files/ |
82 KB 83 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
loader.gif
yourfaztrw.com/One/files/ |
101 KB 101 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
login.php
yourfaztrw.com/One/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
logo.jpg
yourfaztrw.com/One/files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- yourfaztrw.com
- URL
- https://yourfaztrw.com/One/files/logo.jpg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| login0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
suckhoevang24h.org
yourfaztrw.com
yourfaztrw.com
45.252.248.10
69.55.55.84
21307da7adc5e8938405ce5202b788a129e90a226bc75e51afa8e9d1e55ef04e
36cb3b74eab05dfb9cfe8ee2e74e498d87b80033f6c251f4150cd0eb9433ebbd
3bfed2833f76afe747cd3ea2f0dd04dd00420e418706de65d9449b9dbf036e78
723b72b501627fdd6029f39e99e87433f0c365b3e99759800e00f1e5fbd99f4f
824fe77300dde85ab948d8dddf0664a0f77d8e5d79edcde87e23755009218024
b2a37ae2c53c03d48836e073941338c7a69a18f5f905fb701df7174f6dfd3b1e