re.tc
Open in
urlscan Pro
2400:cb00:2048:1::681b:bea7
Malicious Activity!
Public Scan
Submission: On May 09 via manual from GB
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on May 2nd 2017. Valid for: 6 months.
This is the only time re.tc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2400:cb00:204... 2400:cb00:2048:1::681b:bea7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare) | |
1 | 54.154.113.1 54.154.113.1 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 151.101.112.207 151.101.112.207 | 54113 (FASTLY) (FASTLY - Fastly) | |
1 | 50.31.164.175 50.31.164.175 | 23352 (SERVERCEN...) (SERVERCENTRAL - Server Central Network) | |
16 | 209.50.248.143 209.50.248.143 | 25847 (SERVINT) (SERVINT - ServInt) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:803::200a | 15169 (GOOGLE) (GOOGLE - Google Inc.) | |
23 | 7 |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-154-113-1.eu-west-1.compute.amazonaws.com
segment.prod.bidr.io |
ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com |
ASN23352 (SERVERCENTRAL - Server Central Network, US)
PTR: bam-5.nr-data.net
bam.nr-data.net |
ASN25847 (SERVINT - ServInt, US)
PTR: raspberry.dynadot.com
handyhousellc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
handyhousellc.com
handyhousellc.com Failed |
182 KB |
2 |
re.tc
re.tc |
36 KB |
1 |
googleapis.com
fonts.googleapis.com |
476 B |
1 |
nr-data.net
bam.nr-data.net |
57 B |
1 |
newrelic.com
js-agent.newrelic.com |
9 KB |
1 |
bidr.io
segment.prod.bidr.io |
43 B |
23 | 6 |
Domain | Requested by | |
---|---|---|
16 | handyhousellc.com |
handyhousellc.com
|
2 | re.tc | |
1 | fonts.googleapis.com |
handyhousellc.com
|
1 | bam.nr-data.net |
js-agent.newrelic.com
|
1 | js-agent.newrelic.com |
re.tc
|
1 | segment.prod.bidr.io |
re.tc
|
23 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni77713.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2017-05-02 - 2017-11-08 |
6 months | crt.sh |
*.segment.prod.bidr.io Amazon |
2017-04-27 - 2018-05-27 |
a year | crt.sh |
*.d.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2 |
2017-04-11 - 2017-12-21 |
8 months | crt.sh |
*.nr-data.net GeoTrust SSL CA - G3 |
2016-03-17 - 2018-03-17 |
2 years | crt.sh |
This page contains 2 frames:
Frame:
http://handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/login.php?cmd=login_submit&id=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca&session=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca
Frame ID: 26061.1
Requests: 6 HTTP requests in this frame
Frame:
http://handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/login.php?cmd=login_submit&id=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca&session=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca
Frame ID: 26090.1
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request 0- https://segment.prod.bidr.io/associate-segment?buzz_key=stinger&segment_key=stinger-2077&value=
- https://segment.prod.bidr.io/associate-segment?buzz_key=stinger&segment_key=stinger-2077&value=&_bee_ppp=1
- http://handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/
- http://handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/login.php?cmd=login_submit&id=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca&session=0563085d74ecb6...
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
szrf87rd
re.tc/ |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
associate-segment
segment.prod.bidr.io/ Redirect Chain
|
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nr-1026.min.js
js-agent.newrelic.com/ |
22 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
re.tc/ |
34 KB 34 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
8cc64a7907
bam.nr-data.net/1/ |
57 B 57 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
login.php
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.php
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/ Frame 2609 |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/ Frame 2609 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/css/ Frame 2609 |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
reset.css
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/css/ Frame 2609 |
265 B 265 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gcontainer.css
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/css/ Frame 2609 |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
em-valid.js
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/js/java2/ Frame 2609 |
259 B 259 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.1.min.js
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/js/java2/ Frame 2609 |
567 B 567 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Screenshot_1.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
108 KB 108 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
live.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
off.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
other.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
web.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
work.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/images/ Frame 2609 |
26 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
e-m-a-i.png
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/style-images/ Frame 2609 |
396 B 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ Frame 2609 |
2 KB 476 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favico.ico
handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/ Frame 2609 |
382 B 382 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- handyhousellc.com
- URL
- http://handyhousellc.com/SD90SH789/D-48trS0517/04315d7e36394f9d6f5c14c252224655/login.php?cmd=login_submit&id=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca&session=0563085d74ecb697b54f1a3eb1c118ca0563085d74ecb697b54f1a3eb1c118ca
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bam.nr-data.net
fonts.googleapis.com
handyhousellc.com
js-agent.newrelic.com
re.tc
segment.prod.bidr.io
handyhousellc.com
151.101.112.207
209.50.248.143
2400:cb00:2048:1::681b:bea7
2607:f8b0:4004:803::200a
50.31.164.175
54.154.113.1
0daa6430508490437200b512c5a176d1b1df0d60bc7bed373d421875c69f2baf
2601d7e2f5da0a6aa6b9503c99c79ef50cb40d1f91c14278379f86ecfdbc28af
2d10816bada4d94734c1cb7e191ffb89ea7d9bb5c11b3e680f6b00c3a28d4e41
32236e194e73be0d4a7b62e8cc21ea09daa3867c97d4f150d7b8fa916994ac47
3cddc5ea4ff7f1983b5d9d6053ccbfb48a29f57ded969f67ba693ec968e316ae
4583d48494416deed1822b99f8b391cefe5c5429e930010a97a5e7bf3e373d63
4589d223b4c7a29d5328291fef61838747ceeb393fcf2bb33ed8be7ca1f9a2fb
50763d2d5cecbc57718b86478438b2fef9c24aea05c068988fbf9a79d594d436
5ec1977be773e0ed70e040f4e627818e00ebdaaee36b87264e76aa1c80148c65
7432c805974fb008eabaab6346412e2b74bb1bd7f4e61e9c5d1e1f2d10cf98f2
8e9666cc2f4b1c894acfd975c792b316f6c966a7348088a198fb43f9ec9c51b8
a4342adace3edf284d8181f22a899b8f642f83e80d2553ecab0882812594e988
ae9b2d6795e9ca69794b16afa8f7f0a1fa25bb85ff92b314f0f2b6b04d94a88a
b04538aa2467a2a88e274a36a093bf7c2338a318ba69e08025ed1fba972793d5
b5d1b0439d2a20460fccba307ded4305041b768aa77bc9c750e4a3f0aaf4f18d
c4c625002167050db73464ee89e5b822eab0277a0c4e94872b60dc0bd73d1db6
d0e19b3886f38ddb57c002cbe1476a16c3c6579f5e89c5f0d1efd94c3a0d91a2
d1ceea8ad7e9a665d58bae70a59f1d76d3c8d7fe49ea93be8eb2ada6cd00b6ac
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
fbcb393e0092e54954225643a72253cfa1c3ecae8b459e69c94c10ba4e304a30