urlscan.io logo urlscan.io
SecurityTrails logo

ic-constructora.com Open in urlscan Pro
192.163.226.125  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
Effective URL: https://ic-constructora.com/Archivos/adds/epay/
Submission: On December 02 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 9 HTTP transactions. The main IP is 192.163.226.125, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is ic-constructora.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 7th 2018. Valid for: 3 months.
This is the only time ic-constructora.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

IP Address AS Autonomous System
1 209.235.144.9 30447 (INFB2-AS)
2 66.175.41.113 30447 (INFB2-AS)
2 192.163.226.125 46606 (UNIFIEDLA...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700::68... 13335 (CLOUDFLAR...)
9 6
1    209.235.144.9 (Fort Lauderdale, United States)

ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US)
PTR: hostedc31.carrierzone.com
www.lj-couriers.co.uk
2    66.175.41.113 (Davis, United States)

ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US)
PTR: wiredminds.carrierzone.com
count.carrierzone.com
2    192.163.226.125 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: server.pablus.co
ic-constructora.com
2    2606:4700::6813:c797 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
1    2a00:1450:4001:81b::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com
1    2606:4700::6813:c397 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com
Domain Requested by
3 cdnjs.cloudflare.com ic-constructora.com
ajax.googleapis.com
2 ic-constructora.com ic-constructora.com
2 count.carrierzone.com www.lj-couriers.co.uk
1 ajax.googleapis.com ic-constructora.com
1 www.lj-couriers.co.uk
9 5

This site contains no links.

Subject Issuer Validity Valid
*.carrierzone.com
COMODO RSA Domain Validation Secure Server CA		 2017-09-12 -
2020-09-11		 3 years crt.sh
ic-constructora.com
cPanel, Inc. Certification Authority		 2018-10-07 -
2019-01-05		 3 months crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-09-22 -
2019-03-31		 6 months crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-11-07 -
2019-01-30		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ic-constructora.com/Archivos/adds/epay/
Frame ID: 4789A6EE6CC7EC1913DFFE67ACEEB08F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/ Page URL
  2. https://ic-constructora.com/Archivos/adds/epay/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
  • script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

9
Requests

78 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

123 kB
Transfer

308 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/ Page URL
  2. https://ic-constructora.com/Archivos/adds/epay/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
www.lj-couriers.co.uk/Checker/Account/Login/Support81/ 		657 B
847 B 		Document
General
Check archive.org
Download Go to
Full URL
http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
Protocol
HTTP/1.1
Server
209.235.144.9 Fort Lauderdale, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US),
Reverse DNS
hostedc31.carrierzone.com
Software
Apache /
Resource Hash
6bd092af3b62ab3e3f4630fac845cf60bf4ae30feda9fc7a3e179b2a61a43411

Request headers

Host
www.lj-couriers.co.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 02 Dec 2018 18:33:09 GMT
Server
Apache
Content-Length
657
Keep-Alive
timeout=10, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
count.js
count.carrierzone.com/app/count_server/ 		35 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://count.carrierzone.com/app/count_server/count.js
Requested by
Host: www.lj-couriers.co.uk
URL: http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
66.175.41.113 Davis, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US),
Reverse DNS
wiredminds.carrierzone.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e

Request headers

Referer
http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 02 Dec 2018 18:33:09 GMT
Last-Modified
Fri, 08 Jun 2012 10:17:02 GMT
Server
Apache/2.2.15 (CentOS)
Content-Type
text/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=10, max=100
Content-Length
36029
ctin.php
count.carrierzone.com/track/ 		42 B
610 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://count.carrierzone.com/track/ctin.php?t=1543775590617&custnum=6f936d126c7574eb&sname=www.lj-couriers.co.uk&pagename=index.php&group=%2Fservices%2Fwebpages%2Fl%2Fj%2Flj-couriers.co.uk%2Fpublic%2FChecker%2FAccount%2FLogin%2FSupport81&version=%24Rev%3A%207840%20%24&js=1&jv=0&resolution=1600x1200&color_depth=24&campaign=&referrer=&page_url=http%253A%252F%252Fwww.lj-couriers.co.uk%252FChecker%252FAccount%252FLogin%252FSupport81%252F&plugins=
Requested by
Host: www.lj-couriers.co.uk
URL: http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
Protocol
HTTP/1.1
Server
66.175.41.113 Davis, United States, ASN30447 (INFB2-AS - InternetNamesForBusiness.com, US),
Reverse DNS
wiredminds.carrierzone.com
Software
Apache/2.2.15 (CentOS) / PHP/5.2.17
Resource Hash
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947

Request headers

Referer
http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Sun, 02 Dec 2018 18:33:11 GMT
Last-Modified
Sun, 02 Dec 2018 18:33:11 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.2.17
P3P
CP="NOI NID ADMa OUR IND UNI COM NAV"
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Content-Type
image/gif
Keep-Alive
timeout=10, max=100
Content-Length
42
Expires
Thu, 01 Jan 1970 01:23:45 GMT
Primary Request /
ic-constructora.com/Archivos/adds/epay/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ic-constructora.com/Archivos/adds/epay/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.163.226.125 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
server.pablus.co
Software
Apache /
Resource Hash
dce00000a72ac5b7bd9760dc01e61a319f75c422a0bc420f06a1e571f42f51a5

Request headers

Host
ic-constructora.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://www.lj-couriers.co.uk/Checker/Account/Login/Support81/

Response headers

Date
Sun, 02 Dec 2018 18:33:11 GMT
Server
Apache
Last-Modified
Fri, 23 Nov 2018 19:11:07 GMT
Accept-Ranges
bytes
Content-Length
3613
Keep-Alive
timeout=5, max=150
Connection
Keep-Alive
Content-Type
text/html
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Requested by
Host: ic-constructora.com
URL: https://ic-constructora.com/Archivos/adds/epay/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://ic-constructora.com/Archivos/adds/epay/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 02 Dec 2018 18:33:11 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
status
200
served-in-seconds
0.003
last-modified
Thu, 17 May 2018 09:27:13 GMT
server
cloudflare
etag
W/"5afd4af1-1d970"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
482fe168699464ff-FRA
expires
Fri, 22 Nov 2019 18:33:11 GMT
ppcom.png
ic-constructora.com/Archivos/adds/epay/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ic-constructora.com/Archivos/adds/epay/ppcom.png
Requested by
Host: ic-constructora.com
URL: https://ic-constructora.com/Archivos/adds/epay/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.163.226.125 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
server.pablus.co
Software
Apache /
Resource Hash
75b2a0dc7d426973a27f3dfd8c50f5754ce3b342adb89bbb753d42e9debc63ad

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
ic-constructora.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://ic-constructora.com/Archivos/adds/epay/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://ic-constructora.com/Archivos/adds/epay/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sun, 02 Dec 2018 18:33:11 GMT
Last-Modified
Fri, 23 Nov 2018 19:11:07 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=149
Content-Length
1677
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Requested by
Host: ic-constructora.com
URL: https://ic-constructora.com/Archivos/adds/epay/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81b::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ic-constructora.com/Archivos/adds/epay/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 27 Nov 2018 18:45:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
431269
status
200
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
33951
x-xss-protection
1; mode=block
last-modified
Tue, 20 Dec 2016 18:17:03 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Nov 2019 18:45:22 GMT
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js
Requested by
Host: ic-constructora.com
URL: https://ic-constructora.com/Archivos/adds/epay/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6813:c797 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Referer
https://ic-constructora.com/Archivos/adds/epay/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Sun, 02 Dec 2018 18:33:11 GMT
content-encoding
gzip
vary
Accept-Encoding
cf-cache-status
HIT
status
200
served-in-seconds
0.001
last-modified
Thu, 17 May 2018 09:27:13 GMT
server
cloudflare
etag
W/"5afd4af1-90b5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
482fe168699664ff-FRA
expires
Fri, 22 Nov 2019 18:33:11 GMT
glyphicons-halflings-regular.woff2
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/fonts/glyphicons-halflings-regular.woff2
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/css/bootstrap.min.css
Origin
https://ic-constructora.com

Response headers

date
Sun, 02 Dec 2018 18:33:11 GMT
vary
Accept-Encoding
cf-cache-status
MISS
status
200
content-length
18028
served-in-seconds
0.001
last-modified
Thu, 17 May 2018 09:26:03 GMT
server
cloudflare
etag
"5afd4aab-466c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
482fe168bb0597e0-FRA
expires
Fri, 22 Nov 2019 18:33:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| jQuery112408570137900890598

0 Cookies