e-w-y.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 164.90.129.28, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is e-w-y.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 20th 2022. Valid for: 3 months.

This is the only time e-w-y.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Squarespace (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
6	164.90.129.28 164.90.129.28		14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
6	1

6 164.90.129.28 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: s412.nyc1.mysecurecloudhost.com

e-w-y.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	e-w-y.com e-w-y.com	81 KB
6	1

	Domain	Requested by
6	e-w-y.com	e-w-y.com
6	1

This site contains links to these domains. Also see Links.

Domain
squareup.com

Subject Issuer	Validity	Valid
e-w-y.com cPanel, Inc. Certification Authority	`2022-01-20` - `2022-04-20`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://e-w-y.com/login/wa=wsignin1.0.php?&rpsnv=auth0_submit&id=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261&session=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261
Frame ID: 70B67D6203342AC9DCD86E91E5D685B4
Requests: 5 HTTP requests in this frame

Frame: https://e-w-y.com/login/index_1.html
Frame ID: 020A289D87269CCE91EFA0D0D42BAFB5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

81 kB
Transfer

232 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://squareup.com/signup?lang_code=en-US
Title: Sign up

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/article/5245-square-dashboard-troubleshooting#Enable-Cookies
Title: Learn how to enable cookies >

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/article/3798-square-s-information-collection-policies
Title: Learn more about Square's Information Collection Policies >

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/article/5593-2-step-verification
Title: Learn More >

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/contact?panel=36405A439AFD
Title: I don't remember my email address

Search URL Search Domain Scan URL

URL: https://squareup.com/help/article/6212
Title: Learn More >

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request wa=wsignin1.0.php Show response e-w-y.com/login/	54 KB 6 KB	678ms 463ms	Document text/html	164.90.129.28 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://e-w-y.com/login/wa=wsignin1.0.php?&rpsnv=auth0_submit&id=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261&session=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 164.90.129.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS s412.nyc1.mysecurecloudhost.com Software LiteSpeed / Resource Hash `4007d303b8744a477eb705c0cbc0d581fd8fb0364a881841350702cdfeedc81d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers content-type text/html; charset=UTF-8 content-length 5854 content-encoding br vary Accept-Encoding,User-Agent date Thu, 20 Jan 2022 13:01:46 GMT server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET H2	200	login.css e-w-y.com/login/	71 KB 11 KB	98ms 98ms	Stylesheet text/css	164.90.129.28 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://e-w-y.com/login/login.css Requested by Host: e-w-y.com URL: https://e-w-y.com/login/wa=wsignin1.0.php?&rpsnv=auth0_submit&id=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261&session=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 164.90.129.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS s412.nyc1.mysecurecloudhost.com Software LiteSpeed / Resource Hash `1a8f78dcae935b7b42150f3ac41ff507cb58c476a5addf6369caef69fffb930b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://e-w-y.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 20 Jan 2022 13:01:46 GMT content-encoding br last-modified Wed, 25 Nov 2020 01:21:36 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 11396 expires Thu, 27 Jan 2022 13:01:46 GMT
GET H2	200	info_gray.svg e-w-y.com/login/	562 B 353 B	98ms 98ms	Image image/svg+xml	164.90.129.28 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://e-w-y.com/login/info_gray.svg Requested by Host: e-w-y.com URL: https://e-w-y.com/login/wa=wsignin1.0.php?&rpsnv=auth0_submit&id=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261&session=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 164.90.129.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS s412.nyc1.mysecurecloudhost.com Software LiteSpeed / Resource Hash `50a7da9ad8921fa90ab51b3c906eb9fa0efbd49345cd216b3678c1b156458175` Request headers Accept-Language de-DE,de;q=0.9 Referer https://e-w-y.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 20 Jan 2022 13:01:46 GMT content-encoding br last-modified Wed, 25 Nov 2020 01:21:38 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type image/svg+xml cache-control public, max-age=604800 accept-ranges bytes content-length 285 expires Thu, 27 Jan 2022 13:01:46 GMT
GET H2	404	index_1.html Show response e-w-y.com/login/ Frame 020A	1 KB 1 KB	190ms 189ms	Document text/html	164.90.129.28 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://e-w-y.com/login/index_1.html Requested by Host: e-w-y.com URL: https://e-w-y.com/login/wa=wsignin1.0.php?&rpsnv=auth0_submit&id=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261&session=7b97139792a3e56bb643bd6ab87f52617b97139792a3e56bb643bd6ab87f5261 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 164.90.129.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS s412.nyc1.mysecurecloudhost.com Software LiteSpeed / Resource Hash `5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://e-w-y.com/ Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 pragma no-cache content-type text/html content-length 1238 date Thu, 20 Jan 2022 13:01:46 GMT server LiteSpeed vary User-Agent
GET H2	200	sqmarket-regular.otf e-w-y.com/login/	49 KB 29 KB	100ms 99ms	Font font/otf	164.90.129.28 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://e-w-y.com/login/sqmarket-regular.otf Requested by Host: e-w-y.com URL: https://e-w-y.com/login/login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 164.90.129.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS s412.nyc1.mysecurecloudhost.com Software LiteSpeed / Resource Hash `1fc4881cab9110cf5a212890ce46537bb5192d99bc820fb447a7cd708c78e8da` Request headers Referer https://e-w-y.com/login/login.css Origin https://e-w-y.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 20 Jan 2022 13:01:46 GMT content-encoding br last-modified Wed, 25 Nov 2020 01:21:38 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type font/otf accept-ranges bytes content-length 29453
GET H2	200	sqmarket-medium.otf e-w-y.com/login/	56 KB 34 KB	192ms 192ms	Font font/otf	164.90.129.28 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://e-w-y.com/login/sqmarket-medium.otf Requested by Host: e-w-y.com URL: https://e-w-y.com/login/login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 164.90.129.28 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS s412.nyc1.mysecurecloudhost.com Software LiteSpeed / Resource Hash `550adada1bc65c641da935bced98f7240863cc6ca61f9d38fe0ffdf1a085aeb3` Request headers Referer https://e-w-y.com/login/login.css Origin https://e-w-y.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Thu, 20 Jan 2022 13:01:46 GMT content-encoding br last-modified Wed, 25 Nov 2020 01:21:38 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type font/otf accept-ranges bytes content-length 34346

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Squarespace (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://e-w-y.com/login/index_1.html Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

e-w-y.com
164.90.129.28
1a8f78dcae935b7b42150f3ac41ff507cb58c476a5addf6369caef69fffb930b
1fc4881cab9110cf5a212890ce46537bb5192d99bc820fb447a7cd708c78e8da
4007d303b8744a477eb705c0cbc0d581fd8fb0364a881841350702cdfeedc81d
50a7da9ad8921fa90ab51b3c906eb9fa0efbd49345cd216b3678c1b156458175
550adada1bc65c641da935bced98f7240863cc6ca61f9d38fe0ffdf1a085aeb3
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

e-w-y.com Open in urlscan Pro 164.90.129.28 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

81 kBTransfer

232 kBSize

0 Cookies

6 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

e-w-y.com Open in urlscan Pro
164.90.129.28 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

81 kB
Transfer

232 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!