![](/screenshots/05ccad9b-79d4-48fc-bd20-f37dbb6267a6.png)
advancedwatersolutions.mycustomerconnect.com
Open in
urlscan Pro
54.68.60.236
Malicious Activity!
Public Scan
Effective URL: https://advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/login.php?9ce4ccaae5caff2d84a62761a9f9ea...
Submission: On February 27 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on April 25th 2023. Valid for: a year.
This is the only time advancedwatersolutions.mycustomerconnect.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Network Solutions (Internet)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 45.223.20.152 45.223.20.152 | 19551 (INCAPSULA) (INCAPSULA) | |
1 1 | 3.18.56.123 3.18.56.123 | 16509 (AMAZON-02) (AMAZON-02) | |
1 1 | 2a06:98c1:58::92 2a06:98c1:58::92 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 191.252.138.136 191.252.138.136 | 27715 (Locaweb S...) (Locaweb Servicos de Internet SA) | |
1 2 | 54.68.60.236 54.68.60.236 | 16509 (AMAZON-02) (AMAZON-02) | |
12 | 205.178.146.249 205.178.146.249 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
15 | 4 |
ASN16509 (AMAZON-02, US)
PTR: el2.convertkit-mail2.com
click.convertkit-mail2.com |
ASN27715 (Locaweb Servicos de Internet SA, BR)
PTR: iuri0160.hospedagemdesites.ws
iuri0160.hospedagemdesites.ws |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-68-60-236.us-west-2.compute.amazonaws.com
advancedwatersolutions.mycustomerconnect.com |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: oxmail.networksolutionsemail.com
webmailb.networksolutionsemail.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
networksolutionsemail.com
webmailb.networksolutionsemail.com |
207 KB |
2 |
mycustomerconnect.com
1 redirects
advancedwatersolutions.mycustomerconnect.com |
15 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 226 |
28 KB |
1 |
hospedagemdesites.ws
iuri0160.hospedagemdesites.ws |
1 KB |
1 |
convertkit.com
1 redirects
app.convertkit.com — Cisco Umbrella Rank: 17202 |
2 KB |
1 |
convertkit-mail2.com
1 redirects
click.convertkit-mail2.com — Cisco Umbrella Rank: 129744 |
548 B |
1 |
sportsbook.ag
1 redirects
www.sportsbook.ag |
715 B |
15 | 7 |
Domain | Requested by | |
---|---|---|
12 | webmailb.networksolutionsemail.com |
advancedwatersolutions.mycustomerconnect.com
|
2 | advancedwatersolutions.mycustomerconnect.com |
1 redirects
iuri0160.hospedagemdesites.ws
|
1 | cdnjs.cloudflare.com |
advancedwatersolutions.mycustomerconnect.com
|
1 | iuri0160.hospedagemdesites.ws | |
1 | app.convertkit.com | 1 redirects |
1 | click.convertkit-mail2.com | 1 redirects |
1 | www.sportsbook.ag | 1 redirects |
15 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hospedagemdesites.ws AlphaSSL CA - SHA256 - G4 |
2023-10-05 - 2024-11-05 |
a year | crt.sh |
*.mycustomerconnect.com Go Daddy Secure Certificate Authority - G2 |
2023-04-25 - 2024-05-26 |
a year | crt.sh |
*.networksolutionsemail.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-07 - 2025-02-06 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/login.php?9ce4ccaae5caff2d84a62761a9f9ea259ce4ccaae5caff2d84a62761a9f9ea25&pid=9ce4ccaae5caff2d84a62761a9f9ea259ce4ccaae5caff2d84a62761a9f9ea25&kapaichu9ce4ccaae5caff2d84a62761a9f9ea25=9ce4ccaae5caff2d84a62761a9f9ea259ce4ccaae5caff2d84a62761a9f9ea25&nameuser=amltQGdhc2JhcnJvLmNvbQ==&kernel=9ce4ccaae5caff2d84a62761a9f9ea25&unix=9ce4ccaae5caff2d84a62761a9f9ea25-linux
Frame ID: DD65190314D11F0EF7230EBEC422A811
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/05ccad9b-79d4-48fc-bd20-f37dbb6267a6.png)
Page Title
NETW0RK SOLUT10NS© WEBMA1L L0G1NPage URL History Show full URLs
-
https://www.sportsbook.ag/ctr/acctmgt/pl/openLink.ctr?OtW6hkjyZ5NIYQWtKID731mrShVAbJHL02eqIWHqIWH02eHL...
HTTP 302
https://click.convertkit-mail2.com/5qulddwnezc9fdzdkqf6hrq4kv44/z2hghnh3edk9wnbp/aHR0cHM6Ly9hcHAuY29udmVydGtpdC... HTTP 302
https://app.convertkit.com/forms/confirm?key=1e1bbda53d6aef6e8f8f82a1e2de7b8aad0b620c&sid=7305124962 HTTP 302
https://iuri0160.hospedagemdesites.ws/~fixen/wp-content/languages/themes/.NS/.ns.html Page URL
-
https://advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/?FeFzwkUDu0sBMByfAs6...
HTTP 302
https://advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/login.php?9ce4ccaae5... Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.sportsbook.ag/ctr/acctmgt/pl/openLink.ctr?OtW6hkjyZ5NIYQWtKID731mrShVAbJHL02eqIWHqIWH02eHLJOtW6hkjyQWtKID731mrShVAbZ5NIYhHR6HQWagYrmj&URL=https%3A%2F%2Fwww.oracle.com%2FMZkGhawyEClpCRtCCTvSwZjUXtxcuzJwielJIwZjUXtxcuzJwielJIWagYrmjMZkGhawyEClpCRtCCTvSwZjUXtxcuzJwielJIMZkGhawyEClpCRtCCTvSwZjUXtxcuzJwielJI&wZjUXtxcuzJwielJIWagYrmjMZkGhawyEClpCRtCCTvSy&ctrPage=https%3A%2F%2Fclick%2Econvertkit%2Dmail2%2Ecom%2F5qulddwnezc9fdzdkqf6hrq4kv44%2Fz2hghnh3edk9wnbp%2FaHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9MWUxYmJkYTUzZDZhZWY2ZThmOGY4MmExZTJkZTdiOGFhZDBiNjIwYyZzaWQ9NzMwNTEyNDk2Mg%3D%3D%23wZjUXtxcuamltQGdhc2JhcnJvLmNvbQ==&mrShVAb4813215OtW6hkjy42980046QWtKID731135630667
HTTP 302
https://click.convertkit-mail2.com/5qulddwnezc9fdzdkqf6hrq4kv44/z2hghnh3edk9wnbp/aHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9MWUxYmJkYTUzZDZhZWY2ZThmOGY4MmExZTJkZTdiOGFhZDBiNjIwYyZzaWQ9NzMwNTEyNDk2Mg== HTTP 302
https://app.convertkit.com/forms/confirm?key=1e1bbda53d6aef6e8f8f82a1e2de7b8aad0b620c&sid=7305124962 HTTP 302
https://iuri0160.hospedagemdesites.ws/~fixen/wp-content/languages/themes/.NS/.ns.html Page URL
-
https://advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/?FeFzwkUDu0sBMByfAs6hmDTNWoycopKg=FeFzwkUDu0sBMByfAs6hmDTNWoycopKgFeFzwkUDu0sBMByfAs6hmDTNWoycopKg&FeFzwkUDu0sBMByfAs6hmDTNWoycopKgFeFzwkUDu0sBMByfAs6hmDTNWoycopKg&nameuser=amltQGdhc2JhcnJvLmNvbQ==&FeFzwkUDu0sBMByfAs6hmDTNWoycopKg
HTTP 302
https://advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/login.php?9ce4ccaae5caff2d84a62761a9f9ea259ce4ccaae5caff2d84a62761a9f9ea25&pid=9ce4ccaae5caff2d84a62761a9f9ea259ce4ccaae5caff2d84a62761a9f9ea25&kapaichu9ce4ccaae5caff2d84a62761a9f9ea25=9ce4ccaae5caff2d84a62761a9f9ea259ce4ccaae5caff2d84a62761a9f9ea25&nameuser=amltQGdhc2JhcnJvLmNvbQ==&kernel=9ce4ccaae5caff2d84a62761a9f9ea25&unix=9ce4ccaae5caff2d84a62761a9f9ea25-linux Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.sportsbook.ag/ctr/acctmgt/pl/openLink.ctr?OtW6hkjyZ5NIYQWtKID731mrShVAbJHL02eqIWHqIWH02eHLJOtW6hkjyQWtKID731mrShVAbZ5NIYhHR6HQWagYrmj&URL=https%3A%2F%2Fwww.oracle.com%2FMZkGhawyEClpCRtCCTvSwZjUXtxcuzJwielJIwZjUXtxcuzJwielJIWagYrmjMZkGhawyEClpCRtCCTvSwZjUXtxcuzJwielJIMZkGhawyEClpCRtCCTvSwZjUXtxcuzJwielJI&wZjUXtxcuzJwielJIWagYrmjMZkGhawyEClpCRtCCTvSy&ctrPage=https%3A%2F%2Fclick%2Econvertkit%2Dmail2%2Ecom%2F5qulddwnezc9fdzdkqf6hrq4kv44%2Fz2hghnh3edk9wnbp%2FaHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9MWUxYmJkYTUzZDZhZWY2ZThmOGY4MmExZTJkZTdiOGFhZDBiNjIwYyZzaWQ9NzMwNTEyNDk2Mg%3D%3D%23wZjUXtxcuamltQGdhc2JhcnJvLmNvbQ==&mrShVAb4813215OtW6hkjy42980046QWtKID731135630667 HTTP 302
- https://click.convertkit-mail2.com/5qulddwnezc9fdzdkqf6hrq4kv44/z2hghnh3edk9wnbp/aHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9MWUxYmJkYTUzZDZhZWY2ZThmOGY4MmExZTJkZTdiOGFhZDBiNjIwYyZzaWQ9NzMwNTEyNDk2Mg== HTTP 302
- https://app.convertkit.com/forms/confirm?key=1e1bbda53d6aef6e8f8f82a1e2de7b8aad0b620c&sid=7305124962 HTTP 302
- https://iuri0160.hospedagemdesites.ws/~fixen/wp-content/languages/themes/.NS/.ns.html
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
.ns.html
iuri0160.hospedagemdesites.ws/~fixen/wp-content/languages/themes/.NS/ Redirect Chain
|
845 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
advancedwatersolutions.mycustomerconnect.com/mapping/includes/webmai1-oxcs.networkso1utionsemai1.com/ Redirect Chain
|
14 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/css/ |
111 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/css/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui-1.10.3.custom.min.css
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.9.1.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
271 KB 79 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.form.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
42 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
42 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui-personalized-1.10.3.min.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
223 KB 60 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.dimensions.js
webmailb.networksolutionsemail.com/interfaces/sso/js/cluetip/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.cluetip.min.js
webmailb.networksolutionsemail.com/interfaces/sso/js/cluetip/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oxedhelpers.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
1 KB 1015 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oxedlogin.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
24 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Network Solutions (Internet)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| ffconsole function| getSessionIDFromJSESSIONCookie string| file string| waitholder string| waitnote string| placeholder function| createCookie function| ShowResult function| wait function| pause function| wipe function| FilterForm number| firstTime function| cookieTest function| errorTest function| url_query string| user string| pass function| corsReq7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.sportsbook.ag/ctr/ | Name: JSESSIONID Value: 189DE33555DDE075157DCA411AD09EB8 |
|
.sportsbook.ag/ctr/ | Name: CTRREFINERY Value: CTR2|Zd0wn |
|
.sportsbook.ag/ | Name: visid_incap_2286874 Value: p3seGwdLQRGpgrRsndD3gJow3WUAAAAAQUIPAAAAAAB+iW64vuijCO3xZlTm+JbL |
|
.sportsbook.ag/ | Name: incap_ses_1288_2286874 Value: PY4FDn7w72TzbLWIL+bfEZow3WUAAAAA+U3fn5aFThDWJN02rUZzOA== |
|
app.convertkit.com/ | Name: XSRF-TOKEN Value: _7ByliZWxbWedj9lckdlaqbXpOA0WuG6pyHyoxeravYvGyKPqnwk79ykTd4MtIQahbfQISrR0KWBZ_32ZoScrQ |
|
app.convertkit.com/ | Name: _mailapp_session Value: VHM1UEdReTVXTHdLWExiY2pvajR4Umc2aWpuakZ3cytaaXlXcytXUlR0eWtLZmRwckFzcHoyNzkremdxYnVFaDIzdTBPcWpoNkJQK2hsb0IzN2l3Nk5Ma3JqV0pMZyttc0cwemtBRzlBOWl5MkdQdDNqdk1XVUtobEt1VnZ1b2YrVzVpNnY4d2JtdWxDZkxqd3cyMHRBOFFJek5uU1Q5LzUrTnM1NitucnllQmhCczVlMWpnclN3eC9QeVlYYkFELS1PZW9BOXkwaDMwUWNNWWxzSG16U3J3PT0%3D--7c788df7125d48eb543ae75cc9cd064f779a0306 |
|
.convertkit.com/ | Name: __cf_bm Value: jPiMgLlezp2ApqgNDwH6kYYHREymECh7RWthdleOJ3c-1708994715-1.0-AfPWxC0Z+xEYzkRhgC7YILnq2XgMEAC2sMLA3sGF3tPph14ZlwWK/o01tqCafpy57CUBo/pGhB/7UMpf7Teqa0WNeREKXIzZIEkUoCLj5mbT |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
advancedwatersolutions.mycustomerconnect.com
app.convertkit.com
cdnjs.cloudflare.com
click.convertkit-mail2.com
iuri0160.hospedagemdesites.ws
webmailb.networksolutionsemail.com
www.sportsbook.ag
191.252.138.136
205.178.146.249
2606:4700::6811:190e
2a06:98c1:58::92
3.18.56.123
45.223.20.152
54.68.60.236
38f4cd5c0c12b0655856bb8470b15392154ebad70467d63a577ff730e8f248df
4b0805ba4d4fbd2e3a4a933eae6d149a419b851d5ff08930c4cfdc8dc4011bf3
59b4263a265031051e406ca3a2005ec3af03b4b9a7fbb130b857fcc2850bc3d6
82ec09fc2cd7a569557c4a620415b88cd1d5ee608e2ab8798b6a64916c431b6c
8c329e2d278b6e53b6d7f9238332b0524d836e9a931938bf0f03e6571d6a34db
9671f8be70ad94a5362e60f4656d5d53ba214d32ab70a3f9d1603d7dadf9d1c1
96b126417447a9c5d415f06e00e2e6372248c9857f5ff60b6477f8c6f55c449a
990f4e4269eea505b56ea62b131d1725b2abc0e532894132e51b8e2c270846db
9d16623082446707b3e760f17360f1ff00b4625a3f67821f0f7c038f9541f4fc
a8f4ea9e99a88723406402485fea1e48d794e86c94b4c294bd0db79861480e77
ea2f5cc5ff3e25162d8ec3aefe2f02cddbd63e3e8f54fef390b65b1dc280700e
eb6c63da87c0cbe25a1ee49f9d501aa0b362d4aa5a73416925393e5a50c27b05
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e