URL: http://fcajans.com/pfsl/webmail/index.php
Submission: On January 20 via automatic, source openphish

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 45.143.99.90, located in Turkey and belongs to TEKNOSOS, TR. The main domain is fcajans.com.
This is the only time fcajans.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
11 45.143.99.90 207459 (TEKNOSOS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
12 3
Apex Domain
Subdomains
Transfer
11 fcajans.com
fcajans.com
105 KB
1 cloudflare.com
cdnjs.cloudflare.com
28 KB
12 2
Domain Requested by
11 fcajans.com fcajans.com
1 cdnjs.cloudflare.com fcajans.com
12 2

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-21 -
2021-10-20
a year crt.sh

This page contains 1 frames:

Primary Page: http://fcajans.com/pfsl/webmail/index.php
Frame ID: 2C6B761F8D95EF8E00EF7128A4602BB2
Requests: 14 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

12
Requests

8 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

133 kB
Transfer

319 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
fcajans.com/pfsl/webmail/
23 KB
6 KB
Document
General
Full URL
http://fcajans.com/pfsl/webmail/index.php
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
88fcfc4573549f742cec1b0c56e79018e286a853cd494a1a646b647e9253bf3c

Request headers

Host
fcajans.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
5911
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Wed, 20 Jan 2021 01:27:11 GMT
Server
LiteSpeed
open_sans.min.css
fcajans.com/pfsl/webmail/assets/css/
4 KB
825 B
Stylesheet
General
Full URL
http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/index.php
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
a2d608e2f755cb6c339f110acac489157ad28c1d2cd8c0f3a9c35ec387ada65b

Request headers

Referer
http://fcajans.com/pfsl/webmail/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:11 GMT
Content-Encoding
gzip
Last-Modified
Fri, 25 Jan 2019 07:19:14 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
487
Expires
Wed, 27 Jan 2021 01:27:11 GMT
style_v2_optimized.css
fcajans.com/pfsl/webmail/assets/css/
130 KB
25 KB
Stylesheet
General
Full URL
http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/index.php
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
c29b66c11b9d413704d5ed33cd205f242d268ed8b858684e373b8a18d701349f

Request headers

Referer
http://fcajans.com/pfsl/webmail/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 25 Jan 2019 07:31:30 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
25771
Expires
Wed, 27 Jan 2021 01:27:12 GMT
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/
85 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
http://fcajans.com/pfsl/webmail/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 20 Jan 2021 01:27:13 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
364070
cross-origin-resource-policy
cross-origin
vary
Accept-Encoding
content-length
27433
cf-request-id
07bf0035ee00002b1a77a7a000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-1538f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1V%2FurPLxqNMe1DWGisk3ChGexWU2qU9VYNQqznmOQpwKd0kc10rmZ6Fxt8IvG9ittiQN37lLythrHgkB6BXSZrxR1vtdSy5W8MXzw0LQ%2FvvWPeoado%2BJnXr9jgp%2FaQPhyw%3D%3D"}]}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6145030319f62b1a-FRA
expires
Mon, 10 Jan 2022 01:27:13 GMT
webmail-logo.svg
fcajans.com/pfsl/webmail/assets/images/
5 KB
3 KB
Image
General
Full URL
http://fcajans.com/pfsl/webmail/assets/images/webmail-logo.svg
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/index.php
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
998cd48cdc0414f694d0a3a299dd2beb1134769d5666c7e5567e7d20b4174ef8

Request headers

Referer
http://fcajans.com/pfsl/webmail/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Content-Encoding
gzip
Last-Modified
Fri, 25 Jan 2019 07:26:14 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2333
Expires
Wed, 27 Jan 2021 01:27:12 GMT
notice-error.png
fcajans.com/pfsl/webmail/assets/images/
1 KB
1 KB
Image
General
Full URL
http://fcajans.com/pfsl/webmail/assets/images/notice-error.png
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
bcaf01928e5c7246ab0bb7e83f609b485a67a5e442d3dd94539a883c11fb70cd

Request headers

Referer
http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:26:52 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1026
Expires
Wed, 27 Jan 2021 01:27:12 GMT
icon-username.png
fcajans.com/pfsl/webmail/assets/images/
320 B
612 B
Image
General
Full URL
http://fcajans.com/pfsl/webmail/assets/images/icon-username.png
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
05ce0f813e6236158fa1d115faba62cd2041aab1878cac0960a0f45575cece1e

Request headers

Referer
http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:30:20 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
320
Expires
Wed, 27 Jan 2021 01:27:12 GMT
OpenSans-Regular-webfont.woff
fcajans.com/pfsl/webmail/assets/fonts/
22 KB
22 KB
Font
General
Full URL
http://fcajans.com/pfsl/webmail/assets/fonts/OpenSans-Regular-webfont.woff
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
22e7a1b10c110072f5a0bfd16e2197a76b279ec879bcce8978fada1dc9ee5d40

Request headers

Origin
http://fcajans.com
Referer
http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:23:38 GMT
Server
LiteSpeed
Content-Type
font/woff
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
22660
Expires
Wed, 27 Jan 2021 01:27:12 GMT
icon-password.png
fcajans.com/pfsl/webmail/assets/images/
450 B
742 B
Image
General
Full URL
http://fcajans.com/pfsl/webmail/assets/images/icon-password.png
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
a02998df88a6efb0baa526796b2b682ce9fdd6471ceb19170b326320f22f7053

Request headers

Referer
http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:30:56 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
450
Expires
Wed, 27 Jan 2021 01:27:12 GMT
or-separator-line.png
fcajans.com/pfsl/webmail/assets/images/
205 B
497 B
Image
General
Full URL
http://fcajans.com/pfsl/webmail/assets/images/or-separator-line.png
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
12b2ce87d28ac817f630e9e51b80cf90716eb848c5ff94a3b3f8a22cb4c8b6a6

Request headers

Referer
http://fcajans.com/pfsl/webmail/assets/css/style_v2_optimized.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:31:20 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
205
Expires
Wed, 27 Jan 2021 01:27:12 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fe4c02d75150ac018368a8d8e84afcee20e35a465063f97199d59cb5d6587695

Request headers

Referer
http://fcajans.com/pfsl/webmail/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
70667a94ef79118b93b13b1cb41fcb11b09e8fd3ce0c9c82680ed5f991ba9a32

Request headers

Referer
http://fcajans.com/pfsl/webmail/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
OpenSans-Semibold-webfont.woff
fcajans.com/pfsl/webmail/assets/fonts/
22 KB
23 KB
Font
General
Full URL
http://fcajans.com/pfsl/webmail/assets/fonts/OpenSans-Semibold-webfont.woff
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
26b216fadb2ffcd542ca56c2d84f9918f62e40de89bf88b4211fffacd2a4ad83

Request headers

Origin
http://fcajans.com
Referer
http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:27:52 GMT
Server
LiteSpeed
Content-Type
font/woff
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
22908
Expires
Wed, 27 Jan 2021 01:27:12 GMT
OpenSans-Bold-webfont.woff
fcajans.com/pfsl/webmail/assets/fonts/
22 KB
22 KB
Font
General
Full URL
http://fcajans.com/pfsl/webmail/assets/fonts/OpenSans-Bold-webfont.woff
Requested by
Host: fcajans.com
URL: http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
Protocol
HTTP/1.1
Server
45.143.99.90 , Turkey, ASN207459 (TEKNOSOS, TR),
Reverse DNS
manager.markahost.com.tr
Software
LiteSpeed /
Resource Hash
a0357cb694b5284870c77c0dbcaf33f238004800419288afde313317b0dbd0b7

Request headers

Origin
http://fcajans.com
Referer
http://fcajans.com/pfsl/webmail/assets/css/open_sans.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 20 Jan 2021 01:27:12 GMT
Last-Modified
Fri, 25 Jan 2019 07:20:38 GMT
Server
LiteSpeed
Content-Type
font/woff
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
22432
Expires
Wed, 27 Jan 2021 01:27:12 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

0 Cookies