www.vodafone.aman-win.site Open in urlscan Pro
2a02:7b40:3e4d:9978::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.vodafone.aman-win.site/
Submission: On March 27 via automatic, source certstream-suspicious (March 27th 2020, 3:46:58 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2a02:7b40:3e4d:9978::1, located in Lithuania and belongs to RACKRAY UAB Rakrejus, LT. The main domain is www.vodafone.aman-win.site.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 27th 2020. Valid for: 3 months.

This is the only time www.vodafone.aman-win.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
11	2a02:7b40:3e4... 2a02:7b40:3e4d:9978::1	62282 (RACKRAY U...) (RACKRAY UAB Rakrejus)
1	2606:4700:20:... 2606:4700:20::681a:caf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3038::681f:db9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:ec2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	4

11 2a02:7b40:3e4d:9978::1 (Lithuania)

ASN62282 (RACKRAY UAB Rakrejus, LT)

www.vodafone.aman-win.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:caf (United States)

ASN13335 (CLOUDFLARENET, US)

cpabuild.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3038::681f:db9 (United States)

ASN13335 (CLOUDFLARENET, US)

b7ax3cyzhq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:ec2 (United States)

ASN13335 (CLOUDFLARENET, US)

images.clickfunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	aman-win.site www.vodafone.aman-win.site	144 KB
4	b7ax3cyzhq.com b7ax3cyzhq.com	5 KB
1	clickfunnels.com images.clickfunnels.com	212 KB
1	cpabuild.com cpabuild.com	6 KB
17	4

	Domain	Requested by
11	www.vodafone.aman-win.site	www.vodafone.aman-win.site
4	b7ax3cyzhq.com	cpabuild.com
1	images.clickfunnels.com	www.vodafone.aman-win.site
1	cpabuild.com	www.vodafone.aman-win.site
17	4

This site contains no links.

Subject Issuer	Validity	Valid
vodafone.aman-win.site Let's Encrypt Authority X3	`2020-03-27` - `2020-06-25`	3 months	crt.sh
cpabuild.com CloudFlare Inc ECC CA-2	`2019-11-09` - `2020-10-09`	a year	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-10-19` - `2020-10-09`	a year	crt.sh
ssl566619.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-02-02` - `2020-08-10`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.vodafone.aman-win.site/
Frame ID: 70E58E2E3818591049545A0078BFC82B
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /apis\.google\.com\/js\/[a-z]*\.js/i

Page Statistics

17
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

367 kB
Transfer

393 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.vodafone.aman-win.site/	13 KB 13 KB	420ms 49ms	Document text/html	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `8904d6990bdd87271d4d34f867050b05a7644339b1cce0640bc4e1689ec9f18c` Request headers :method GET :authority www.vodafone.aman-win.site :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Fri, 27 Mar 2020 15:46:37 GMT server Apache last-modified Fri, 27 Mar 2020 15:39:57 GMT accept-ranges bytes content-length 13099 content-type text/html
GET H2	200	2549344219-widget_css_bundle.css www.vodafone.aman-win.site/VODAFON%20E.G_files/	31 KB 31 KB	44ms 43ms	Stylesheet text/css	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/VODAFON%20E.G_files/2549344219-widget_css_bundle.css Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `d539a910089008f073b426d44a496f1952ba01b9ff018425c18d21bea42aa128` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 27 Mar 2020 15:46:37 GMT last-modified Mon, 23 Mar 2020 14:05:22 GMT server Apache content-type text/css status 200 cache-control max-age=604800 accept-ranges bytes content-length 31611 expires Fri, 03 Apr 2020 15:46:37 GMT
GET H2	200	locker.js Show response cpabuild.com/public/external/	22 KB 6 KB	63ms 23ms	Script text/javascript	2606:4700:20::681a:caf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cpabuild.com/public/external/locker.js Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:caf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e1283e4ec130e45b2775b89ae683abe7f75dfc0c61f1cd012d6b3c9109d5419e` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 27 Mar 2020 15:46:37 GMT content-encoding br cf-cache-status HIT last-modified Mon, 13 Jan 2020 04:52:03 GMT server cloudflare age 2459 etag W/"5791-59bfe3c868853" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript status 200 cache-control max-age=691200 cf-ray 57aa3ec99bcac2c7-FRA
GET H2	404	plusone.js www.vodafone.aman-win.site/apis.google.com/js/	0 0	44ms 44ms	Script text/html	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/apis.google.com/js/plusone.js Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 404 date Fri, 27 Mar 2020 15:46:37 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	vodafon%20logo.png www.vodafone.aman-win.site/VODAFON%20E.G_files/	46 KB 47 KB	44ms 43ms	Image image/png	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://www.vodafone.aman-win.site/VODAFON%20E.G_files/vodafon%20logo.png Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `d6132034f4f669da00e7c3fdfa79c64682916ce4d95c6d337d281d5b6935730e` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 27 Mar 2020 15:46:37 GMT last-modified Mon, 23 Mar 2020 16:15:46 GMT server Apache content-type image/png status 200 cache-control max-age=604800 accept-ranges bytes content-length 47305 expires Fri, 03 Apr 2020 15:46:37 GMT
GET H2	200	v1.jpg www.vodafone.aman-win.site/VODAFON%20E.G_files/	17 KB 17 KB	43ms 43ms	Image image/jpeg	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://www.vodafone.aman-win.site/VODAFON%20E.G_files/v1.jpg Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `326f40e996ccd3011d1ed443792bd56272e9c5b76bdbe25c569242aa003f76d3` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 27 Mar 2020 15:46:37 GMT last-modified Mon, 23 Mar 2020 14:05:22 GMT server Apache content-type image/jpeg status 200 cache-control max-age=604800 accept-ranges bytes content-length 17439 expires Fri, 03 Apr 2020 15:46:37 GMT
GET H2	200	v2.jpg www.vodafone.aman-win.site/VODAFON%20E.G_files/	17 KB 17 KB	45ms 44ms	Image image/jpeg	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://www.vodafone.aman-win.site/VODAFON%20E.G_files/v2.jpg Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `1cad715f4bd4bd5169051ccaa96409aa45c346d3d3cfb090ec3797a21c663015` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 27 Mar 2020 15:46:37 GMT last-modified Mon, 23 Mar 2020 14:05:22 GMT server Apache content-type image/jpeg status 200 cache-control max-age=604800 accept-ranges bytes content-length 17508 expires Fri, 03 Apr 2020 15:46:37 GMT
GET H2	200	v3.jpg www.vodafone.aman-win.site/VODAFON%20E.G_files/	19 KB 19 KB	44ms 43ms	Image image/jpeg	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Show image Full URL https://www.vodafone.aman-win.site/VODAFON%20E.G_files/v3.jpg Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash `d8b6e55aef25e5872c9b5229cf3ac0e7ada08029f7b3b5cd6ea0b2c391046eca` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 27 Mar 2020 15:46:37 GMT last-modified Mon, 23 Mar 2020 14:05:22 GMT server Apache content-type image/jpeg status 200 cache-control max-age=604800 accept-ranges bytes content-length 19153 expires Fri, 03 Apr 2020 15:46:37 GMT
GET H2	404	1833189695-widgets.js www.vodafone.aman-win.site/www.blogger.com/static/v1/widgets/	0 0	48ms 47ms	Script text/html	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/www.blogger.com/static/v1/widgets/1833189695-widgets.js Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 404 date Fri, 27 Mar 2020 15:46:37 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	html.797669.396c8.0.js Show response b7ax3cyzhq.com/public/external/v2/	10 KB 3 KB	411ms 340ms	Script application/javascript	2606:4700:3038::681f:db9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b7ax3cyzhq.com/public/external/v2/html.797669.396c8.0.js Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::681f:db9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.32 Resource Hash `3df23973c7b90d71761bd821205d6cfe8c1be9179cd28d6d7617bd7ffbcff6b9` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 27 Mar 2020 15:46:38 GMT content-encoding br cf-cache-status MISS server cloudflare x-powered-by PHP/5.6.32 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 57aa3eca5d699760-FRA
GET H2	200	css_front.css b7ax3cyzhq.com/public/external/	6 KB 2 KB	89ms 18ms	Stylesheet text/css	2606:4700:3038::681f:db9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b7ax3cyzhq.com/public/external/css_front.css Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::681f:db9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 27 Mar 2020 15:46:37 GMT content-encoding br cf-cache-status HIT last-modified Tue, 04 Dec 2018 23:08:50 GMT server cloudflare age 6360 etag W/"19c4-57c3a5934f53b" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 57aa3eca5d679760-FRA
GET H2	404	plusone.js www.vodafone.aman-win.site/apis.google.com/js/	0 0	49ms 48ms	Script text/html	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/apis.google.com/js/plusone.js Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 404 date Fri, 27 Mar 2020 15:46:37 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	red-geo.png images.clickfunnels.com/images/	211 KB 212 KB	65ms 64ms	Image image/png	2606:4700::6810:ec2 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://images.clickfunnels.com/images/red-geo.png Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6810:ec2 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5a14bde9d305f9729f2497b4559b38fdc424bdbb36c59d13d3af392736c5bcb0` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Fri, 27 Mar 2020 15:46:37 GMT cf-cache-status HIT age 709260 cf-polished status=not_needed status 200 content-type image/png content-length 216209 x-amz-id-2 JcnZKK2IdECOBkJkJWcVW/rxSaTkZtI6UjYQ6s56r5046/iYd0Q8wrn0XESA+Oepsv6WjQq26nM= last-modified Thu, 31 Aug 2017 17:33:18 GMT server cloudflare etag "87806c1e3c2884b8cdf16303578d34b8" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-amz-request-id B6B533116306E9E2 expires Mon, 27 Apr 2020 15:46:37 GMT cache-control public, max-age=2678400 accept-ranges bytes cf-ray 57aa3ec9eb63c281-FRA cf-bgj imgq:100
GET H2	404	f.txt www.vodafone.aman-win.site/pagead2.googlesyndication.com/pagead/js/	0 0	47ms 46ms	Script text/html	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/pagead2.googlesyndication.com/pagead/js/f.txt Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 404 date Fri, 27 Mar 2020 15:46:37 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	404	1833189695-widgets.js www.vodafone.aman-win.site/www.blogger.com/static/v1/widgets/	0 0	45ms 45ms	Script text/html	2a02:7b40:3e4d:9978::1 RACKRAY UAB Rakrejus
General Check archive.org Show headers Download Go to Full URL https://www.vodafone.aman-win.site/www.blogger.com/static/v1/widgets/1833189695-widgets.js Requested by Host: www.vodafone.aman-win.site URL: https://www.vodafone.aman-win.site/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:7b40:3e4d:9978::1 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT), Reverse DNS Software Apache / Resource Hash Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers status 404 date Fri, 27 Mar 2020 15:46:37 GMT server Apache content-length 315 content-type text/html; charset=iso-8859-1
GET H2	200	css.css b7ax3cyzhq.com/public/clockers/PrimeApps/	1010 B 502 B	12ms 12ms	Stylesheet text/css	2606:4700:3038::681f:db9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b7ax3cyzhq.com/public/clockers/PrimeApps/css.css Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::681f:db9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Fri, 27 Mar 2020 15:46:38 GMT content-encoding br cf-cache-status HIT last-modified Tue, 04 Dec 2018 23:26:58 GMT server cloudflare age 3445 etag W/"3f2-57c3a9a17efb1" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 57aa3ecc7f8c9760-FRA
GET H2	200	check.php Show response b7ax3cyzhq.com/public/external/	0 177 B	179ms 178ms	Script application/javascript	2606:4700:3038::681f:db9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://b7ax3cyzhq.com/public/external/check.php?time=1585324000162&it=797669 Requested by Host: cpabuild.com URL: https://cpabuild.com/public/external/locker.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::681f:db9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.6.32 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.vodafone.aman-win.site/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Fri, 27 Mar 2020 15:46:40 GMT cf-cache-status DYNAMIC server cloudflare x-powered-by PHP/5.6.32 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" content-type application/javascript status 200 cf-ray 57aa3ed90c2e9760-FRA content-length 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b7ax3cyzhq.com
cpabuild.com
images.clickfunnels.com
www.vodafone.aman-win.site
2606:4700:20::681a:caf
2606:4700:3038::681f:db9
2606:4700::6810:ec2
2a02:7b40:3e4d:9978::1
1cad715f4bd4bd5169051ccaa96409aa45c346d3d3cfb090ec3797a21c663015
326f40e996ccd3011d1ed443792bd56272e9c5b76bdbe25c569242aa003f76d3
3df23973c7b90d71761bd821205d6cfe8c1be9179cd28d6d7617bd7ffbcff6b9
5a14bde9d305f9729f2497b4559b38fdc424bdbb36c59d13d3af392736c5bcb0
8904d6990bdd87271d4d34f867050b05a7644339b1cce0640bc4e1689ec9f18c
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
d539a910089008f073b426d44a496f1952ba01b9ff018425c18d21bea42aa128
d6132034f4f669da00e7c3fdfa79c64682916ce4d95c6d337d281d5b6935730e
d8b6e55aef25e5872c9b5229cf3ac0e7ada08029f7b3b5cd6ea0b2c391046eca
e1283e4ec130e45b2775b89ae683abe7f75dfc0c61f1cd012d6b3c9109d5419e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

www.vodafone.aman-win.site Open in urlscan Pro 2a02:7b40:3e4d:9978::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

367 kBTransfer

393 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

0 Cookies

Indicators

www.vodafone.aman-win.site Open in urlscan Pro
2a02:7b40:3e4d:9978::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

367 kB
Transfer

393 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!