therootfoundation.org

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 67.220.188.162, located in Piscataway, United States and belongs to 24SHELLS, US. The main domain is therootfoundation.org.

This is the only time therootfoundation.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 5	67.220.188.162 67.220.188.162		55081 (24SHELLS) (24SHELLS)
4	1

5 67.220.188.162 (Piscataway, United States) 1 redirects

ASN55081 (24SHELLS, US)
PTR: host1.smartwebng.com

therootfoundation.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	therootfoundation.org 1 redirects therootfoundation.org	103 KB
4	1

	Domain	Requested by
5	therootfoundation.org	1 redirects therootfoundation.org
4	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/
Frame ID: 550AC6778E9A2BA56CB38456F6BA845D
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31 HTTP 301
http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

103 kB
Transfer

103 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31 HTTP 301
http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Redirect Chain http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31 http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/	2 KB 1 KB	119ms 119ms	Document text/html	67.220.188.162 24SHELLS
General Check archive.org Show headers Download Go to Full URL http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Protocol HTTP/1.1 Server 67.220.188.162 Piscataway, United States, ASN55081 (24SHELLS, US), Reverse DNS host1.smartwebng.com Software LiteSpeed / Resource Hash `fc9cae8d94a96ed9322b046be37952ed3c3bc1268a0abafb1c14a6086e99666d` Request headers Host therootfoundation.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 1052 Content-Encoding gzip Vary Accept-Encoding Date Sun, 19 Jul 2020 02:44:46 GMT Server LiteSpeed Redirect headers Connection Keep-Alive Content-Type text/html Content-Length 706 Date Sun, 19 Jul 2020 02:44:46 GMT Server LiteSpeed Location http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/
GET H/1.1	200 OK	A5BVjiII.png therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/File/	51 KB 52 KB	88ms 87ms	Image image/png	67.220.188.162 24SHELLS
General Check archive.org Show headers Download Go to Show image Full URL http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/File/A5BVjiII.png Requested by Host: therootfoundation.org URL: http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Protocol HTTP/1.1 Server 67.220.188.162 Piscataway, United States, ASN55081 (24SHELLS, US), Reverse DNS host1.smartwebng.com Software LiteSpeed / Resource Hash `467440ccc13d40b65c25732dd563d6939dabd577439eedc2943504eae0fa0d7a` Request headers Referer http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 19 Jul 2020 02:44:46 GMT Last-Modified Sat, 23 May 2020 00:25:19 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 52577 Expires Sun, 26 Jul 2020 02:44:46 GMT
GET H/1.1	200 OK	wFFWgTmQ.png therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/File/	2 KB 2 KB	183ms 170ms	Image image/png	67.220.188.162 24SHELLS
General Check archive.org Show headers Download Go to Show image Full URL http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/File/wFFWgTmQ.png Requested by Host: therootfoundation.org URL: http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Protocol HTTP/1.1 Server 67.220.188.162 Piscataway, United States, ASN55081 (24SHELLS, US), Reverse DNS host1.smartwebng.com Software LiteSpeed / Resource Hash `9a289c26a4317848fad8c1d8811496e7c377f12586c8b34a0fd4fb25ec549ea5` Request headers Referer http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 19 Jul 2020 02:44:46 GMT Last-Modified Sat, 23 May 2020 00:25:19 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 1645 Expires Sun, 26 Jul 2020 02:44:46 GMT
GET H/1.1	200 OK	2Q0000001.jpg therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/File/	48 KB 48 KB	182ms 170ms	Image image/jpeg	67.220.188.162 24SHELLS
General Check archive.org Show headers Download Go to Show image Full URL http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/File/2Q0000001.jpg Requested by Host: therootfoundation.org URL: http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ Protocol HTTP/1.1 Server 67.220.188.162 Piscataway, United States, ASN55081 (24SHELLS, US), Reverse DNS host1.smartwebng.com Software LiteSpeed / Resource Hash `c478865ae5c3a0f9760c223b8e801278adb3df7d1aaccbea48109fb177d95833` Request headers Referer http://therootfoundation.org/ssc/gurn/dd927ebf576bcfd160194d977e5aef31/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 19 Jul 2020 02:44:46 GMT Last-Modified Sat, 23 May 2020 00:25:19 GMT Server LiteSpeed Content-Type image/jpeg Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 48859 Expires Sun, 26 Jul 2020 02:44:46 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| unhideBody

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

therootfoundation.org
67.220.188.162
467440ccc13d40b65c25732dd563d6939dabd577439eedc2943504eae0fa0d7a
9a289c26a4317848fad8c1d8811496e7c377f12586c8b34a0fd4fb25ec549ea5
c478865ae5c3a0f9760c223b8e801278adb3df7d1aaccbea48109fb177d95833
fc9cae8d94a96ed9322b046be37952ed3c3bc1268a0abafb1c14a6086e99666d

therootfoundation.org Open in urlscan Pro 67.220.188.162 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

103 kBTransfer

103 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

therootfoundation.org Open in urlscan Pro
67.220.188.162 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

103 kB
Transfer

103 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!