wwt-support.com Open in urlscan Pro
193.25.101.67  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set a0vg1hbptpx3emxv Show response wwt-support.com/	2 KB 1 KB	530ms 499ms	Document text/html	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash bd1bdfe99f5472f329ae0648105f6d6d289934266ac6c60009e5cc2fead1e960 Request headers Host wwt-support.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Server Lucy Set-Cookie PHPSESSID=0uldemrvaf8hahpjep0ov45775; path=/; secure; HttpOnly link=a0vg1hbptpx3emxv; expires=Sat, 18-Apr-2020 16:48:26 GMT; Max-Age=2592000; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Vary Accept-Encoding Content-Encoding gzip Access-Control-Allow-Origin * Access-Control-Allow-Methods * Access-Control-Allow-Headers * Content-Length 882 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	events.js Show response wwt-support.com/js/	558 B 917 B	31ms 30ms	Script text/javascript	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/js/events.js Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150 Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 558 Keep-Alive timeout=5, max=99 Expires Fri, 20 Mar 2020 16:48:26 GMT
GET H/1.1	200 OK	detect.js Show response wwt-support.com/js/	1 KB 2 KB	46ms 32ms	Script text/javascript	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/js/detect.js Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash d95a220da93b714c2da52067ef8fba38858e02b4d401f343b95cc797a95e32fc Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 1367 Keep-Alive timeout=5, max=100 Expires Fri, 20 Mar 2020 16:48:26 GMT
GET H/1.1	200 OK	bootstrap.min.css wwt-support.com/public/campaign/106/194/11/static/style/	138 KB 21 KB	54ms 41ms	Stylesheet text/css	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/public/campaign/106/194/11/static/style/bootstrap.min.css Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash 3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Content-Encoding gzip Last-Modified Wed, 26 Feb 2020 17:48:27 GMT Server Lucy ETag "2268e-59f7e3632f7c7-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 21052
GET H/1.1	200 OK	style.min.css wwt-support.com/public/campaign/106/194/11/static/style/	3 KB 1 KB	50ms 37ms	Stylesheet text/css	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/public/campaign/106/194/11/static/style/style.min.css Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash 51cd7d764079ca8f4af4140745894447b1f1c7cd872a1ddaed2ba93a09623be3 Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Content-Encoding gzip Last-Modified Wed, 26 Feb 2020 17:48:27 GMT Server Lucy ETag "c1d-59f7e3632f7c7-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1069
GET H/1.1	200 OK	timeme.min.js Show response wwt-support.com/js/	4 KB 4 KB	48ms 34ms	Script text/javascript	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/js/timeme.min.js Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash 3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 4210 Keep-Alive timeout=5, max=100 Expires Fri, 20 Mar 2020 16:48:26 GMT
GET H/1.1	200 OK	time-tracker.js Show response wwt-support.com/js/	927 B 1 KB	59ms 45ms	Script text/javascript	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/js/time-tracker.js Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash fa84ab42f56278cee474176c64f7c9441d0429387777d66e35a2b791e51a5728 Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:26 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/javascript;charset=UTF-8 Access-Control-Allow-Origin * Cache-Control max-age=86400 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 927 Keep-Alive timeout=5, max=100 Expires Fri, 20 Mar 2020 16:48:26 GMT
POST H/1.1	200 OK	plugin-list Show response wwt-support.com/	65 B 660 B	217ms 217ms	XHR text/html	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Full URL http://wwt-support.com/plugin-list Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash 4c9982e87539a138b92f05a5583ff9e1c3c68745eaee1c92b307000c228ef6e7 Request headers Referer http://wwt-support.com/a0vg1hbptpx3emxv Origin http://wwt-support.com X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers Pragma no-cache Date Thu, 19 Mar 2020 16:48:26 GMT Server Lucy Access-Control-Allow-Methods * Content-Type text/html; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Access-Control-Allow-Headers * Content-Length 65 Keep-Alive timeout=5, max=99 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	bg.jpg wwt-support.com/public/campaign/106/194/11/static/img/	277 KB 277 KB	23ms 23ms	Image image/jpeg	193.25.101.67 FIRSTROOT-AS
General Check archive.org Show headers Download Go to Show image Full URL http://wwt-support.com/public/campaign/106/194/11/static/img/bg.jpg Requested by Host: wwt-support.com URL: http://wwt-support.com/a0vg1hbptpx3emxv Protocol HTTP/1.1 Server 193.25.101.67 , Germany, ASN41108 (FIRSTROOT-AS, DE), Reverse DNS mail.cloudserver67.com Software Lucy / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer http://wwt-support.com/public/campaign/106/194/11/static/style/style.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 19 Mar 2020 16:48:27 GMT Last-Modified Wed, 26 Feb 2020 17:48:27 GMT Server Lucy ETag "452d7-59f7e3632f7c7" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 283351

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| lucyDispatchEvent function| getPluginName function| getPluginVersion function| getPlugins function| sendPlugins object| TimeMe function| trackTime function| sendData

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wwt-support.com/	1970-01-19 08:53:48	Name: link Value: a0vg1hbptpx3emxv

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

wwt-support.com
193.25.101.67
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
3ae66a8d261814acf0678914f1832973fe5be31912abf545f81fe4f97fd707dd
3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c
4c9982e87539a138b92f05a5583ff9e1c3c68745eaee1c92b307000c228ef6e7
51cd7d764079ca8f4af4140745894447b1f1c7cd872a1ddaed2ba93a09623be3
a8f7e59c2a6d75c51e1898b2d1ff9f6f666caad39a12d215e506202fce2ce150
bd1bdfe99f5472f329ae0648105f6d6d289934266ac6c60009e5cc2fead1e960
d95a220da93b714c2da52067ef8fba38858e02b4d401f343b95cc797a95e32fc
fa84ab42f56278cee474176c64f7c9441d0429387777d66e35a2b791e51a5728