clarksbuildingllc.com
Open in
urlscan Pro
162.241.69.59
Malicious Activity!
Public Scan
Submission: On October 20 via api from LU — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 27th 2021. Valid for: 3 months.
This is the only time clarksbuildingllc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ourtime.com (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 162.241.69.59 162.241.69.59 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
7 | 1 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-69-59.unifiedlayer.com
clarksbuildingllc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
clarksbuildingllc.com
clarksbuildingllc.com |
36 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
7 | clarksbuildingllc.com |
clarksbuildingllc.com
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
clarksbuildingllc.com cPanel, Inc. Certification Authority |
2021-09-27 - 2021-12-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://clarksbuildingllc.com/ourtime/urtme.html
Frame ID: 7FD38948A21A073C07F3F8AEA22CA878
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
urtme.html
clarksbuildingllc.com/ourtime/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btnn.png
clarksbuildingllc.com/ourtime/gbaz/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
frt.png
clarksbuildingllc.com/ourtime/gbaz/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cpt.png
clarksbuildingllc.com/ourtime/gbaz/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fut.png
clarksbuildingllc.com/ourtime/gbaz/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
baggy.png
clarksbuildingllc.com/ourtime/gbaz/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
baggy2.png
clarksbuildingllc.com/ourtime/gbaz/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ourtime.com (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
clarksbuildingllc.com
162.241.69.59
0797aedfb1514dacbcb53cd556cb0cfb796f2ae2ab983eeb060d76976c1a2eba
20e6a651fce15d9037f7500ee4726fc5a451241cb95441bef52856c3f5edb245
404e18d3e0763f8421cbb7059395b979b399ecf50638e1aa3cdb682c9da8be9e
8e11d16fa4c9225e4b314582ffca6995b5ac30a53b6faa8f6d32988da1ee5328
9e3d89cfa907691109213ed2dc3f76914cfd8627f2a1c41f3a0b46f10f7bd4c9
c2a5c07118a37c0bcaba257bdeb20952128457a8e8c5fb301617acace0353721
d0250c148ac0cf6a68c754d08a8e61eab68dfc5431acc4f6c9b8c246f45a917a