![](/screenshots/0121d4b0-5f26-4c0f-8ba4-e136d88e95f0.png)
virl.ws
Open in
urlscan Pro
74.3.166.74
Malicious Activity!
Public Scan
Submission: On May 07 via api from JP — Scanned from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 5th 2022. Valid for: 3 months.
This is the only time virl.ws was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 74.3.166.74 74.3.166.74 | 11831 (ESECUREDATA) (ESECUREDATA) | |
1 4 | 192.124.249.6 192.124.249.6 | 30148 (SUCURI-SEC) (SUCURI-SEC) | |
1 | 2a02:4780:dea... 2a02:4780:dead:c89f::1 | 204915 (AWEX) (AWEX) | |
2 | 216.161.33.141 216.161.33.141 | 3912 (CHECS) (CHECS) | |
1 | 152.199.4.44 152.199.4.44 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2606:4700::68... 2606:4700::6813:b978 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 6 |
ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10006.sucuri.net
viralurl.com |
ASN3912 (CHECS, US)
PTR: enmuradfs.students.enmu-roswell.edu
enmuradfs.students.enmu-roswell.edu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
viralurl.com
1 redirects
viralurl.com |
19 KB |
4 |
virl.ws
virl.ws |
104 KB |
2 |
enmu-roswell.edu
enmuradfs.students.enmu-roswell.edu |
4 KB |
1 |
000webhost.com
cdn.000webhost.com — Cisco Umbrella Rank: 115119 |
2 KB |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 2686 |
2 KB |
1 |
000webhostapp.com
mlcroosoft.000webhostapp.com |
4 KB |
12 | 6 |
Domain | Requested by | |
---|---|---|
4 | viralurl.com |
1 redirects
virl.ws
|
4 | virl.ws |
virl.ws
|
2 | enmuradfs.students.enmu-roswell.edu |
mlcroosoft.000webhostapp.com
enmuradfs.students.enmu-roswell.edu |
1 | cdn.000webhost.com |
mlcroosoft.000webhostapp.com
|
1 | aadcdn.msftauth.net |
mlcroosoft.000webhostapp.com
|
1 | mlcroosoft.000webhostapp.com |
virl.ws
|
12 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
viralurl.com |
viralhosts.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
viralurl.com cPanel, Inc. Certification Authority |
2022-03-05 - 2022-06-03 |
3 months | crt.sh |
*.000webhostapp.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-07-10 - 2022-08-10 |
a year | crt.sh |
enmuradfs.students.enmu-roswell.edu Go Daddy Secure Certificate Authority - G2 |
2021-08-18 - 2022-07-21 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2022-04-01 - 2023-04-01 |
a year | crt.sh |
*.000webhost.com Sectigo RSA Domain Validation Secure Server CA |
2022-01-17 - 2023-01-13 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://virl.ws/s/msoffice-edu/
Frame ID: 70A66091936DC6F3F95E5FBA84D28999
Requests: 7 HTTP requests in this frame
Frame:
https://mlcroosoft.000webhostapp.com/office.html
Frame ID: 778BC6127F92F0E6322D94EAD9BEB985
Requests: 5 HTTP requests in this frame
Screenshot
![](/screenshots/0121d4b0-5f26-4c0f-8ba4-e136d88e95f0.png)
Page Title
Sign inDetected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Gravatar.png)
Detected patterns
- <[^>]+gravatar\.com/avatar/
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Want To Earn $128 Daily Online ?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://viralurl.com/go.php?id=824716&ua=Mozilla50WindowsNT100Win64x64AppleWebKit53736KHTMLlikeGeckoChrome1010495141Safari53736 HTTP 302
- https://mlcroosoft.000webhostapp.com/office.html
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
virl.ws/s/msoffice-edu/ |
14 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
virl.ws/aceadmin/dist/css/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsdisplay.php
viralurl.com/ |
149 B 368 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
virl.ws/aceadmin/assets/js/ |
82 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office.html
mlcroosoft.000webhostapp.com/ Frame 778B Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
viralurl.com/images/ |
16 KB 17 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bwLogo3.png
viralurl.com/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome-webfont.woff
virl.ws/aceadmin/dist/fonts/ |
64 KB 64 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
StyleSheet.css
enmuradfs.students.enmu-roswell.edu/adfs/ls/MasterPages/ Frame 778B |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ Frame 778B |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ Frame 778B |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header_background.png
enmuradfs.students.enmu-roswell.edu/adfs/ls/App_Themes/Default/ Frame 778B |
641 B 887 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| $ function| jQuery function| updateSize function| onLoadHandler3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.virl.ws/ | Name: mlcroosoft.000webhostapp.com Value: 302426%7C824716 |
|
.virl.ws/ | Name: aff Value: 302426 |
|
.virl.ws/ | Name: s--msoffice-edu Value: 2022-05-07 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
cdn.000webhost.com
enmuradfs.students.enmu-roswell.edu
mlcroosoft.000webhostapp.com
viralurl.com
virl.ws
152.199.4.44
192.124.249.6
216.161.33.141
2606:4700::6813:b978
2a02:4780:dead:c89f::1
74.3.166.74
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
199411f659f41aaccb959bacb1b0de30e54f244352a48c6f9894e65ae0f8a9a1
1e423fb9380b3f938e6e9b7e9163db597be86039c2fb036a7c65f9dc04810b0c
39449b586e7ecda417029c7a5b5b01cbfe668bd31c6ac6090dc1db3e412d5a79
57694df9004deaf34cd22628a66838db5ac944d585f7deafa9a9f92351738d83
619d0b508ce139b6c79bfe95cc9bcebd03054ceb06df7cbaa92de89ef538c65a
6562208ddb7e41dcb742ebf542ed2b37d880dfa0a2daf29836941f536818979e
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
b35a162d41837c0da38c00eebde236cfc2c166e949a50053cc508115f8546afe
c1a9c0710c772e0e874b5ab15db55dec80899c5a3133b8e7418c7e5bb379eee0
d7298628da2acbf82b415d8faade7117f6634a9882fc592815e27fe169e1ea59