axsurveys.com
Open in
urlscan Pro
2606:4700:3031::681b:95fe
Malicious Activity!
Public Scan
Effective URL: http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/anjejfctuj9taub6ocvj5qtu.php?D25FJ1158398...
Submission: On March 12 via manual from IN
Summary
This is the only time axsurveys.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2600:9000:215... 2600:9000:2156:d200:19:9934:6a80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
4 11 | 2606:4700:303... 2606:4700:3031::681b:95fe | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
axsurveys.com
4 redirects
axsurveys.com |
338 KB |
1 |
app.link
1 redirects
mam81.app.link |
709 B |
7 | 2 |
Domain | Requested by | |
---|---|---|
11 | axsurveys.com |
4 redirects
axsurveys.com
|
1 | mam81.app.link | 1 redirects |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/anjejfctuj9taub6ocvj5qtu.php?D25FJ115839837953effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add&email=&error=
Frame ID: 170A3E068D3D79E73711649E13E8D1C8
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://mam81.app.link/3EOWlzuqx4
HTTP 307
http://axsurveys.com/wp-content/ed/Encoded?_branch_match_id=766490469961066113&utm_source=29&utm_... HTTP 301
http://axsurveys.com/wp-content/ed/Encoded/?_branch_match_id=766490469961066113&utm_source=29&utm... HTTP 302
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf HTTP 301
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/ HTTP 302
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/anjejfctuj9taub6ocvj5... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://mam81.app.link/3EOWlzuqx4
HTTP 307
http://axsurveys.com/wp-content/ed/Encoded?_branch_match_id=766490469961066113&utm_source=29&utm_campaign=29&utm_medium=29 HTTP 301
http://axsurveys.com/wp-content/ed/Encoded/?_branch_match_id=766490469961066113&utm_source=29&utm_campaign=29&utm_medium=29 HTTP 302
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf HTTP 301
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/ HTTP 302
http://axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/anjejfctuj9taub6ocvj5qtu.php?D25FJ115839837953effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add3effa9bcc2c9c5470a299c245ee90add&email=&error= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
anjejfctuj9taub6ocvj5qtu.php
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/ Redirect Chain
|
526 B 662 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myscr956753.js
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/js/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
myscr776710.js
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/js/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ms-logo-v2.jpg
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/images/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.jpg
axsurveys.com/wp-content/ed/Encoded/9369c3d390f49d00cb212fc39a16ccaf/images/ |
291 KB 292 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| _0xe8f0 object| erp string| em number| tmp function| $ function| jQuery function| isValidEmailAddress object| _0x57281 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.axsurveys.com/ | Name: __cfduid Value: d75fee80244bcfa26ca444869395cfa9b1583983795 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
axsurveys.com
mam81.app.link
2600:9000:2156:d200:19:9934:6a80:93a1
2606:4700:3031::681b:95fe
60c0d1ebfae4b91933a1ede7de3f91352b09ae81b1d36299cb5fc9162ef7fe4a
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
a49bac41c69e3cc996449d6d89391396b9ae6504a63f35bbd73a94bf88b7b5fc
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
cd30910e2ad38b6015b402b465fb8d812c384589a9b2ef6dd8e1ac86efacd67d
f789b3df769e82858fd604f17dbf7932a17e6dd98ce375472c5d1de3672da584