assosmarmer.com
Open in
urlscan Pro
2a02:4780:8:1116:0:2993:3961:2
Malicious Activity!
Public Scan
Submitted URL: http://liceogregoriocordovez.cl/hh/jafafafa.html
Effective URL: https://assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/bellzAll.html
Submission: On July 06 via automatic, source openphish — Scanned from DE
Effective URL: https://assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/bellzAll.html
Submission: On July 06 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 9 HTTP transactions.
The main IP is 2a02:4780:8:1116:0:2993:3961:2, located in
Meppel, Netherlands and
belongs to AS-HOSTINGER, CY.
The main domain is assosmarmer.com.
TLS certificate: Issued by R3 on May 16th 2023. Valid for: 3 months.
This is the only time assosmarmer.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on May 16th 2023. Valid for: 3 months.
This is the only time assosmarmer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BCE-BellAliant (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 186.64.114.35 186.64.114.35 | 52368 (ZAM LTDA.) (ZAM LTDA.) | |
| 8 | 2a02:4780:8:1... 2a02:4780:8:1116:0:2993:3961:2 | 47583 (AS-HOSTINGER) (AS-HOSTINGER) | |
| 9 | 2 |
1
186.64.114.35
(Chile)
ASN52368 (ZAM LTDA., CL)
PTR: mail.pyme74.pymedns.net
ASN52368 (ZAM LTDA., CL)
PTR: mail.pyme74.pymedns.net
| liceogregoriocordovez.cl |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
assosmarmer.com
assosmarmer.com |
101 KB |
| 1 |
liceogregoriocordovez.cl
liceogregoriocordovez.cl |
752 B |
| 9 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | assosmarmer.com |
assosmarmer.com
|
| 1 | liceogregoriocordovez.cl | |
| 9 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| assosmarmer.com R3 |
2023-05-16 - 2023-08-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/bellzAll.html
Frame ID: 44F30016A6B5A49897CC3FD5A56A284E
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Bells EmailPage URL History Show full URLs
- http://liceogregoriocordovez.cl/hh/jafafafa.html Page URL
- https://assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/bellzAll.html Page URL
Detected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /wp-(?:content|includes)/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://liceogregoriocordovez.cl/hh/jafafafa.html Page URL
- https://assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/bellzAll.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
jafafafa.html
liceogregoriocordovez.cl/hh/ |
295 B 752 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
bellzAll.html
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/ |
2 KB 1005 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
headerlogo.jpg
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
textmsg.png
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
submit.jpg
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
msgboard.jpg
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
52 KB 52 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
copyright.png
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
headerbg.jpg
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
381 B 465 B |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
menuBg.jpg
assosmarmer.com/wp-content/plugins/wp-file-upload/xx/bellaliant/images/ |
36 KB 36 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BCE-BellAliant (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubdomains; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assosmarmer.com
liceogregoriocordovez.cl
186.64.114.35
2a02:4780:8:1116:0:2993:3961:2
12278e8c8ce810a412a655f72007eb9bdf2285065526f682ca5044b159bb8788
18334a650cdddc593f2a0cfb3a07de8aeb445fb876c59c023057bfad61c2865b
430e012f0e54db7c7c5e8cc95dbee0d47d3c972b3ddd07852f2c8ef7b6f18cc6
47ad59f6d006cdb7355fbb52b0692dfecf144c1e489750e45a57c4a29e51798d
4a7d804ead7811b801d515158899b408016b83e3938ff7f05ac8e9c61bc5a207
5518571d276e064f6b8a40c1703b4520ab52c622b1a89dad3ed8437c5c158253
842a32e2f47fe426b07307df5be442f781f466f1eadde6629508768c87f601d2
9ae2be16a6fe4f5104eb41cbe8a4f44d54e1bca508f8dcc60dbde3ecc84d49fa
d414ab00aa5ef1cc4347bcc019394bdaad9d2da23011e4396d86a2a6f7adb836