Submitted URL: https://x5.re/2JxK6
Effective URL: https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb...
Submission: On May 29 via manual

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 18 HTTP transactions. The main IP is 192.158.237.226, located in Bend, United States and belongs to H4Y-TECHNOLOGIES - H4Y Technologies LLC, US. The main domain is oneseo.in.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 10th 2019. Valid for: 3 months.
This is the only time oneseo.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:30:... 13335 (CLOUDFLAR...)
2 212.32.255.93 60781 (LEASEWEB-...)
2 2a00:1450:400... 15169 (GOOGLE)
1 3 192.158.237.226 397373 (H4Y-TECHN...)
18 5
Domain Requested by
3 oneseo.in 1 redirects oneseo.in
2 www.google-analytics.com x5.re
1 www.hostingcloud.racing
1 www.freecontent.bid x5.re
1 x5.re
0 Failed oneseo.in
18 6

This site contains no links.

Subject Issuer Validity Valid
sni139975.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-02-14 -
2019-08-23
6 months crt.sh
freecontent.bid
Let's Encrypt Authority X3
2019-04-27 -
2019-07-26
3 months crt.sh
*.google-analytics.com
Google Internet Authority G3
2019-05-07 -
2019-07-30
3 months crt.sh
hostingcloud.racing
Let's Encrypt Authority X3
2019-04-27 -
2019-07-26
3 months crt.sh
oneseo.in
cPanel, Inc. Certification Authority
2019-05-10 -
2019-08-08
3 months crt.sh

This page contains 1 frames:

Primary Page: https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
Frame ID: 8CA20D566CB7CD824A14F2A1F016EAC2
Requests: 19 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://x5.re/2JxK6 Page URL
  2. https://oneseo.in/fax/Main/index.php HTTP 302
    https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fabab... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Page Statistics

18
Requests

39 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

487 kB
Transfer

1599 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://x5.re/2JxK6 Page URL
  2. https://oneseo.in/fax/Main/index.php HTTP 302
    https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
2JxK6
x5.re/
885 B
1 KB
Document
General
Full URL
https://x5.re/2JxK6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:9360 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
79c0286400b0de1b536d70a6eab1ccc10e8c70ea176027ade3bf254452a362e6

Request headers

:method
GET
:authority
x5.re
:scheme
https
:path
/2JxK6
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
301
date
Wed, 29 May 2019 20:48:38 GMT
content-type
text/html
set-cookie
__cfduid=d0ad4d66a2f7d05dca0c326445fd3f51d1559162918; expires=Thu, 28-May-20 20:48:38 GMT; path=/; domain=.x5.re; HttpOnly
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4deb54918ee9c2ea-FRA
9cpv.js
www.freecontent.bid/
406 KB
151 KB
Script
General
Full URL
https://www.freecontent.bid/9cpv.js
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.32.255.93 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
8dc4286333f67c256894efabb3ccf940f6ec3a3b8a4fc9e452cd32eb604d8547

Request headers

Referer
https://x5.re/2JxK6
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 29 May 2019 20:48:38 GMT
content-encoding
gzip
last-modified
Wed, 29 May 2019 16:15:10 GMT
server
nginx
access-control-allow-origin
*
etag
W/"5ceeb00e-657c4"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=10800
expires
Wed, 29 May 2019 21:59:05 GMT
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
b079b055-33fb-4b22-80b1-d74d0bf5db4f
https://x5.re/
88 KB
0
Other
General
Full URL
blob:https://x5.re/b079b055-33fb-4b22-80b1-d74d0bf5db4f
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7f089fccbf1e51db5dacf755189df0b6055220bdb90fc3249914c61e0c1976c3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length
90444
analytics.js
www.google-analytics.com/
43 KB
17 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8f88cb7a1cd4134f5d616b9fca90b9069fa16c162b7ae66ba1b500c490b41dd2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://x5.re/2JxK6
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 21 May 2019 23:53:44 GMT
server
Golfe2
age
4565
date
Wed, 29 May 2019 19:32:33 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17595
expires
Wed, 29 May 2019 21:32:33 GMT
collect
www.google-analytics.com/r/
35 B
101 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j76&a=272761736&t=pageview&_s=1&dl=https%3A%2F%2Fx5.re%2F2JxK6&ul=en-us&de=windows-1252&dt=URL%20Shortener&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1343320902&gjid=466673591&cid=962292491.1559162919&tid=UA-71323887-1&_gid=1832351437.1559162919&_r=1&z=406620689
Requested by
Host: x5.re
URL: https://x5.re/2JxK6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:815::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://x5.re/2JxK6
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 29 May 2019 20:48:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
access-control-allow-origin
*
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
U4lhHUTM.png
www.hostingcloud.racing/
123 KB
123 KB
Image
General
Full URL
https://www.hostingcloud.racing/U4lhHUTM.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.32.255.93 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software
nginx /
Resource Hash
effc5776b93433516d403e70ad45af69493979779553b9ec78a6bd4e2a115d9c

Request headers

Referer
https://x5.re/2JxK6
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 29 May 2019 20:48:40 GMT
last-modified
Wed, 16 Jan 2019 09:19:37 GMT
server
nginx
access-control-allow-origin
*
etag
"5c3ef729-1ebe3"
content-type
image/png
status
200
cache-control
max-age=10800
accept-ranges
bytes
content-length
125923
expires
Wed, 29 May 2019 22:06:13 GMT
Primary Request Login.php
oneseo.in/fax/Main/
Redirect Chain
  • https://oneseo.in/fax/Main/index.php
  • https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
61 KB
61 KB
Document
General
Full URL
https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.158.237.226 Bend, United States, ASN397373 (H4Y-TECHNOLOGIES - H4Y Technologies LLC, US),
Reverse DNS
node2.indservers.co.in
Software
Apache /
Resource Hash
aaa8268410a693f4eab4ce1a19b06e33757ce7b82feb015b953f09449385c612

Request headers

:method
GET
:authority
oneseo.in
:scheme
https
:path
/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
referer
https://x5.re/2JxK6
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://x5.re/2JxK6

Response headers

status
200
date
Wed, 29 May 2019 20:48:45 GMT
server
Apache
content-type
text/html; charset=UTF-8

Redirect headers

status
302
date
Wed, 29 May 2019 20:48:44 GMT
server
Apache
location
Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
content-type
text/html; charset=UTF-8
VOWvdje.png
oneseo.in/fax/Main/
133 KB
134 KB
Image
General
Full URL
https://oneseo.in/fax/Main/VOWvdje.png
Requested by
Host: oneseo.in
URL: https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.158.237.226 Bend, United States, ASN397373 (H4Y-TECHNOLOGIES - H4Y Technologies LLC, US),
Reverse DNS
node2.indservers.co.in
Software
Apache /
Resource Hash
a6f2c8455e628c90e8bb7d96d12d80d19cb434ab1e297be37cec0601db23bff3

Request headers

Referer
https://oneseo.in/fax/Main/Login.php?cmd=login_submit&id=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1&session=fababa0769c30f2a521e01afb41d3ad1fababa0769c30f2a521e01afb41d3ad1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 29 May 2019 20:48:46 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 11 Apr 2019 20:59:56 GMT
server
Apache
etag
"21240-5864777e74b00"
content-type
image/png
status
200
cache-control
max-age=31536000
accept-ranges
bytes
content-length
135744
expires
Thu, 28 May 2020 20:48:46 GMT
truncated
/
38 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
69812007b33dc3d10ed9457eb8333c5292ce928d81814b75298a02dd6823acce

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
icon-username.png
/cPanel_magic_revision_1335428098/unprotected/cpanel/images/
0
0

icon-password.png
/cPanel_magic_revision_1335428098/unprotected/cpanel/images/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
URL
unsaved:///cPanel_magic_revision_1335428098/unprotected/cpanel/images/icon-username.png
Domain
URL
unsaved:///cPanel_magic_revision_1335428098/unprotected/cpanel/images/icon-password.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies