managegreatly-theprogressivefile.best Open in urlscan Pro
54.160.85.184 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://worldwidetds.com/QMRB9g
Effective URL:
https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Submission: On April 13 via manual (April 13th 2021, 3:37:22 pm UTC) from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 13 HTTP transactions. The main IP is 54.160.85.184, located in United States and belongs to AMAZON-AES, US. The main domain is managegreatly-theprogressivefile.best.
TLS certificate: Issued by R3 on April 11th 2021. Valid for: 3 months.

This is the only time managegreatly-theprogressivefile.best was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fake Flash Update

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3031::6815:291	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	139.45.197.236 139.45.197.236	9002 (RETN-AS) (RETN-AS)
1 1	52.44.196.184 52.44.196.184	14618 (AMAZON-AES) (AMAZON-AES)
11	54.160.85.184 54.160.85.184	14618 (AMAZON-AES) (AMAZON-AES)
1	172.67.149.165 172.67.149.165	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	4

1 2606:4700:3031::6815:291 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

worldwidetds.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 139.45.197.236 (United Kingdom)

ASN9002 (RETN-AS, GB)

abdurantom.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.44.196.184 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

cash.admobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 54.160.85.184 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-160-85-184.compute-1.amazonaws.com

managegreatly-theprogressivefile.best	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.149.165 (United States)

ASN13335 (CLOUDFLARENET, US)

webjscontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	managegreatly-theprogressivefile.best managegreatly-theprogressivefile.best	533 KB
1	webjscontent.com webjscontent.com	7 KB
1	admobe.com 1 redirects cash.admobe.com	292 B
1	abdurantom.com abdurantom.com	1 KB
1	worldwidetds.com 1 redirects worldwidetds.com	1 KB
13	5

	Domain	Requested by
11	managegreatly-theprogressivefile.best	abdurantom.com managegreatly-theprogressivefile.best
1	webjscontent.com	managegreatly-theprogressivefile.best
1	cash.admobe.com	1 redirects
1	abdurantom.com
1	worldwidetds.com	1 redirects
13	5

This site contains no links.

Subject Issuer	Validity	Valid
abdurantom.com R3	`2021-03-13` - `2021-06-11`	3 months	crt.sh
managegreatly-theprogressivefile.best R3	`2021-04-11` - `2021-07-10`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-26` - `2021-08-26`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Frame ID: 64B0AD48580482523BA318F76286054A
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://worldwidetds.com/QMRB9g HTTP 302
https://abdurantom.com/afu.php?zoneid=2609450 Page URL
https://cash.admobe.com/erg/rsthjsh.php?utm_source=24&utm_campaign=14235280&cid=405860580209996174&s... HTTP 302
https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450 Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

542 kB
Transfer

572 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://worldwidetds.com/QMRB9g HTTP 302
https://abdurantom.com/afu.php?zoneid=2609450 Page URL
https://cash.admobe.com/erg/rsthjsh.php?utm_source=24&utm_campaign=14235280&cid=405860580209996174&sid=2609450 HTTP 302
https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://worldwidetds.com/QMRB9g HTTP 302
https://abdurantom.com/afu.php?zoneid=2609450

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

afu.php Show response
abdurantom.com/
Redirect Chain

https://worldwidetds.com/QMRB9g
https://abdurantom.com/afu.php?zoneid=2609450

1 KB
1 KB

142ms
56ms

Document
text/html

139.45.197.236
RETN-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://abdurantom.com/afu.php?zoneid=2609450

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

139.45.197.236 , United Kingdom, ASN9002 (RETN-AS, GB),

Reverse DNS

Software

nginx /

Resource Hash

f12e71912010ed6c8e7860342edb296f918d8b60e3f69433e046d28ccc9236d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: abdurantom.com
:scheme: https
:path: /afu.php?zoneid=2609450
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Tue, 13 Apr 2021 15:37:02 GMT
content-type: text/html; charset=utf8
x-trace-id: a5829144f19c68666485f6ef02b584a6
link: <https://propeller-tracking.com>; rel="dns-prefetch preconnect",<//>; rel="dns-prefetch preconnect" <https://cash.admobe.com>; rel="dns-prefetch preconnect",<https://propeller-tracking.com>; rel="dns-prefetch preconnect"
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
timing-allow-origin: * *
set-cookie: OAID=a760f9a856cb4a9b9821f88ab2b9b16e; expires=Wed, 13 Apr 2022 15:37:02 GMT; path=/; secure; SameSite=None oaidts=1618328222; expires=Wed, 13 Apr 2022 15:37:02 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
content-encoding: gzip

Redirect headers

date: Tue, 13 Apr 2021 15:37:02 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dd610e31c98be923d8f54f39177d599de1618328222; expires=Thu, 13-May-21 15:37:02 GMT; path=/; domain=.worldwidetds.com; HttpOnly; SameSite=Lax; Secure _subid=m4vpvqarm9a;Expires=Friday, 14-May-2021 15:37:02 GMT;Max-Age=2678400;Path=/ _token=uuid_m4vpvqarm9a_m4vpvqarm9a6075ba9e98f849.42833150;Expires=Friday, 14-May-2021 15:37:02 GMT;Max-Age=2678400;Path=/ 875b3=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjM2XCI6MTYxODMyODIyMn0sXCJjYW1wYWlnbnNcIjp7XCIyXCI6MTYxODMyODIyMn0sXCJ0aW1lXCI6MTYxODMyODIyMn0ifQ.xsj22NtAyiriYFyRLkFN_sTSamTOXF1HzXgjk0DKtl0;Expires=Tuesday, 26-Jul-2072 07:14:04 GMT;Max-Age=1618414622;Path=/
cache-control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
expires: 0
last-modified: Tue, 13 Apr 2021 15:37:02 GMT
location: https://abdurantom.com/afu.php?zoneid=2609450
pragma: no-cache
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-request-id: 096d7a136900002bdd573d7000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lZsy8QoTOv%2FS%2BJ%2B4KVMKp9dIc19GqF32a%2FM58ryNUWLzsLc7tgNpo%2FLkizISfFLK6fTVlDzmMB3kLiDUdxUTIFWcxf65T50A1j%2BQ5%2Fdi%2BTPUgPW3b251JbNrsOJj"}]}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 63f5c5ff0a012bdd-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1

200
OK

Primary Request

Cookie set 1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8 Show response
managegreatly-theprogressivefile.best/
Redirect Chain

https://cash.admobe.com/erg/rsthjsh.php?utm_source=24&utm_campaign=14235280&cid=405860580209996174&sid=2609450
https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450

225 KB
225 KB

1253ms
988ms

Document
text/html

54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Requested by: Host: abdurantom.com
URL: https://abdurantom.com/afu.php?zoneid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 6c7a8a775f27c4c9d29a1cc3de8b23b35ea317dd1aa9d1cd729a635a8db28552

Request headers

Host: managegreatly-theprogressivefile.best
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://abdurantom.com/afu.php?zoneid=2569433&var=2609450

Response headers

Date: Tue, 13 Apr 2021 15:37:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: session=8a7e73c6-29dd-4ecc-b2cc-7c8a14617150
Server: nginx

Redirect headers

Date: Tue, 13 Apr 2021 15:37:03 GMT
Content-Type: text/html
Content-Length: 158
Connection: keep-alive
Location: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Server: nginx

GET
H2 200 dl.min.js Show response
webjscontent.com/ 19 KB
7 KB 351ms
246ms Script
text/javascript 172.67.149.165
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://webjscontent.com/dl.min.js
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.149.165 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75e003aaceb7ae5b5571bad8f8056f106b41b993d633d5ef31066b92bc3d1aec

Request headers

Referer: https://managegreatly-theprogressivefile.best/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 13 Apr 2021 15:37:04 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sun, 18 Oct 2020 06:17:02 GMT
server: cloudflare
etag: W/"763d14-4a67-5b1ebf22cb380"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fXgGSHOJDV6ZXCQ6ykke0XkK12QAtYcfsQ2sjN55muUd6xEnOXxR4UAqb2Mp15QyVyxVNzm2EqGhBvE%2B5Z8BtkIAm2KgFzaIT1PEQlbqGVFD"}],"group":"cf-nel"}
content-type: text/javascript
cf-ray: 63f5c60bd80fc795-AMS
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 096d7a1b680000c795f1add000000001

GET
H/1.1 200
OK step_1moz_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 28 KB
28 KB 191ms
116ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_1moz_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 36dc7c37393ee468e4efd16b9a915114943db37d5937b0beb5cd01f628a23469

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:04 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-7085"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28805

GET
H/1.1 200
OK step_2moz_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 32 KB
32 KB 116ms
116ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_2moz_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: d7187aeacacd4d14c0e0b31c2d3686a10e334e61a4a8b3c64dd38aed62eba4d1

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:04 GMT
Last-Modified: Tue, 13 Apr 2021 15:36:49 GMT
Server: nginx
ETag: "6075ba91-80a7"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 32935

GET
H/1.1 200
OK step_1ch_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 22 KB
22 KB 116ms
116ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_1ch_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ee2a07bd37a9929e7dd189ad0c05e3eb27ea31e6ddc6beb2d6a4db5a89962441

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:04 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-58ef"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22767

GET
H/1.1 200
OK step_2ch_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 24 KB
24 KB 216ms
216ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_2ch_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 00e13ef52545e82fa4d31907ef274a76d7755e102b10029a54b2a650c6d380a5

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-5fdd"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24541

GET
H/1.1 200
OK step_1saf_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 36 KB
37 KB 138ms
116ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_1saf_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2750e17782b11cb2d53a78fd8cfe909a57cce7834d9f1d2b5aca999f6d23638c

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-91d4"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37332

GET
H/1.1 200
OK step_2saf_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 39 KB
39 KB 255ms
116ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_2saf_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 59eeda148701ab1739c450f45ebbc1abed681b4e732342b52968c478f30c0ec0

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:30 GMT
Server: nginx
ETag: "6075b916-9bd9"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 39897

GET
H/1.1 200
OK step_1edge_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 25 KB
25 KB 338ms
124ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_1edge_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1ae1e057debc221e1471354f15431c18d456c7fd7543fe8d968b1797a19ab722

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-6274"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25204

GET
H/1.1 200
OK step_2edge_win.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 30 KB
30 KB 450ms
218ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_2edge_win.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 730b5f27c8524eb5c38f182a45acda474d2117b6ae6b618ba19a8b92abca4de2

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-7630"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30256

GET
H/1.1 200
OK step_1edgeT.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 33 KB
33 KB 430ms
218ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_1edgeT.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 244d51c52be8f4aec58fe17d0383af45245f410fce160d0135a3ce173d51bcc1

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-84ca"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33994

GET
H/1.1 200
OK step_2edgeT.png
managegreatly-theprogressivefile.best/resources/lps/test_brow/images/ 37 KB
37 KB 312ms
217ms Image
image/png 54.160.85.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://managegreatly-theprogressivefile.best/resources/lps/test_brow/images/step_2edgeT.png
Requested by: Host: managegreatly-theprogressivefile.best
URL: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.160.85.184 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-160-85-184.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39311f6d6b968abe38b00398d4b9bec6909f2eea0dd7752d43d7a5c04e63a31e

Request headers

Referer: https://managegreatly-theprogressivefile.best/1keyhNeyPb_OI0a5-qp5eqJ0lxBGOAu07NfMhxBy4z8?cid=405860580209996174&sid=2609450
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 13 Apr 2021 15:37:05 GMT
Last-Modified: Tue, 13 Apr 2021 15:30:29 GMT
Server: nginx
ETag: "6075b915-93b8"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37816

GET
DATA 200
OK truncated
/ 22 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 645176a5b72abf4bd90019bf77fe76603c92146e62e9d69d2537e942188a4431

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fake Flash Update

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			managegreatly-theprogressivefile.best/	1969-12-31 23:59:59	Name: session Value: 8a7e73c6-29dd-4ecc-b2cc-7c8a14617150

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abdurantom.com
cash.admobe.com
managegreatly-theprogressivefile.best
webjscontent.com
worldwidetds.com
139.45.197.236
172.67.149.165
2606:4700:3031::6815:291
52.44.196.184
54.160.85.184
00e13ef52545e82fa4d31907ef274a76d7755e102b10029a54b2a650c6d380a5
1ae1e057debc221e1471354f15431c18d456c7fd7543fe8d968b1797a19ab722
244d51c52be8f4aec58fe17d0383af45245f410fce160d0135a3ce173d51bcc1
2750e17782b11cb2d53a78fd8cfe909a57cce7834d9f1d2b5aca999f6d23638c
36dc7c37393ee468e4efd16b9a915114943db37d5937b0beb5cd01f628a23469
39311f6d6b968abe38b00398d4b9bec6909f2eea0dd7752d43d7a5c04e63a31e
59eeda148701ab1739c450f45ebbc1abed681b4e732342b52968c478f30c0ec0
645176a5b72abf4bd90019bf77fe76603c92146e62e9d69d2537e942188a4431
6c7a8a775f27c4c9d29a1cc3de8b23b35ea317dd1aa9d1cd729a635a8db28552
730b5f27c8524eb5c38f182a45acda474d2117b6ae6b618ba19a8b92abca4de2
75e003aaceb7ae5b5571bad8f8056f106b41b993d633d5ef31066b92bc3d1aec
d7187aeacacd4d14c0e0b31c2d3686a10e334e61a4a8b3c64dd38aed62eba4d1
ee2a07bd37a9929e7dd189ad0c05e3eb27ea31e6ddc6beb2d6a4db5a89962441
f12e71912010ed6c8e7860342edb296f918d8b60e3f69433e046d28ccc9236d0

managegreatly-theprogressivefile.best Open in urlscan Pro 54.160.85.184 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

542 kBTransfer

572 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

managegreatly-theprogressivefile.best Open in urlscan Pro
54.160.85.184 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

542 kB
Transfer

572 kB
Size

1
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!