posadapedroelgrande.com.ve
Open in
urlscan Pro
162.252.57.68
Malicious Activity!
Public Scan
Submitted URL: http://repetitors.ge/31.asp
Effective URL: https://posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/
Submission: On February 21 via manual from US
Effective URL: https://posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/
Submission: On February 21 via manual from US
Summary
This website contacted 1 IPs
in 1 countries
across 2 domains to perform 3 HTTP transactions.
The main IP is 162.252.57.68, located in
Miami, United States and
belongs to NETROUTING-AS, NL.
The main domain is posadapedroelgrande.com.ve.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 20th 2018. Valid for: 3 months.
This is the only time posadapedroelgrande.com.ve was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 20th 2018. Valid for: 3 months.
This is the only time posadapedroelgrande.com.ve was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rackspace (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 198.27.88.131 198.27.88.131 | 16276 (OVH) (OVH) | |
| 3 | 162.252.57.68 162.252.57.68 | 47869 (NETROUTIN...) (NETROUTING-AS) | |
| 3 | 1 |
1
198.27.88.131
(Newark, United States)
ASN16276 (OVH, FR)
PTR: platinum.ownmyserver.com
ASN16276 (OVH, FR)
PTR: platinum.ownmyserver.com
| repetitors.ge |
3
162.252.57.68
(Miami, United States)
ASN47869 (NETROUTING-AS, NL)
PTR: ns11.wnetserver.com
ASN47869 (NETROUTING-AS, NL)
PTR: ns11.wnetserver.com
| posadapedroelgrande.com.ve |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
posadapedroelgrande.com.ve
posadapedroelgrande.com.ve |
24 KB |
| 1 |
repetitors.ge
1 redirects
repetitors.ge |
293 B |
| 3 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | posadapedroelgrande.com.ve |
posadapedroelgrande.com.ve
|
| 1 | repetitors.ge | 1 redirects |
| 3 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| posadapedroelgrande.com.ve cPanel, Inc. Certification Authority |
2018-12-20 - 2019-03-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/
Frame ID: 07C2463E607AB17346526B3959A0FF89
Requests: 3 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://repetitors.ge/31.asp
HTTP 302
https://posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/ Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://repetitors.ge/31.asp
HTTP 302
https://posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
1.png
posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/images/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
2.png
posadapedroelgrande.com.ve/web/wp-content/themes/.twentyfourteen/rackspace/1/images/ |
740 B 770 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rackspace (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
posadapedroelgrande.com.ve
repetitors.ge
162.252.57.68
198.27.88.131
67736584515e0a0471f6b826cb3d88a88e69defa9aa14d6ae8bd01b0eed10a74
aa4ec92512fe886a146ea44c078d56694b1a72aaf28d6529db89333cf105e8e5
c07ce4c2abf01cfcffdf9179efcd6a7ddac93c9dd5c6d35e549b2329cb7217d6