powertechnologies.net Open in urlscan Pro
209.59.133.238 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://powertechnologies.net/www/
Effective URL:
https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Submission: On January 29 via automatic, source openphish (January 29th 2020, 12:25:32 am UTC)

Summary HTTP 15 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 15 HTTP transactions. The main IP is 209.59.133.238, located in Lansing, United States and belongs to LIQUIDWEB, US. The main domain is powertechnologies.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 23rd 2019. Valid for: 3 months.

This is the only time powertechnologies.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Target (Retail)

Domain & IP information

	IP Address	AS Autonomous System
8	209.59.133.238 209.59.133.238	32244 (LIQUIDWEB) (LIQUIDWEB)
6	156.55.203.146 156.55.203.146	18434 (FNIS) (FNIS)
1	151.101.1.195 151.101.1.195	54113 (FASTLY) (FASTLY)
15	3

8 209.59.133.238 (Lansing, United States)

ASN32244 (LIQUIDWEB, US)
PTR: host2.strykerdigital.com

powertechnologies.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 156.55.203.146 (United States)

ASN18434 (FNIS, US)
PTR: aka6042-rcam.fisglobal.com

rcam.target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.195 (United States)

ASN54113 (FASTLY, US)

track-card.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	powertechnologies.net powertechnologies.net	537 KB
6	target.com rcam.target.com	551 KB
1	web.app track-card.web.app	335 B
15	3

	Domain	Requested by
8	powertechnologies.net	powertechnologies.net
6	rcam.target.com	powertechnologies.net
1	track-card.web.app	powertechnologies.net
15	3

This site contains links to these domains. Also see Links.

Domain
rcam.target.com
www.target.com

Subject Issuer	Validity	Valid
powertechnologies.net cPanel, Inc. Certification Authority	`2019-12-23` - `2020-03-22`	3 months	crt.sh
rcam.target.com DigiCert SHA2 Secure Server CA	`2019-09-20` - `2020-09-23`	a year	crt.sh
web.app GTS CA 1O1	`2019-10-28` - `2020-10-26`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Frame ID: 17312D8B6195420BE01292FCED785277
Requests: 14 HTTP requests in this frame

Frame: https://powertechnologies.net/www/Login_files/saved_resource.html
Frame ID: 990B360543B1430CE85A2CD224CE8234
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://powertechnologies.net/www/ Page URL
https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842= Page URL

Detected technologies

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

1088 kB
Transfer

2432 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://rcam.target.com/
Title: Skip to Main Content

Search URL Search Domain Scan URL

URL: https://rcam.target.com/#/

Search URL Search Domain Scan URL

URL: https://www.target.com/c/redcard/-/N-4tfyn
Title:

Search URL Search Domain Scan URL

URL: https://www.target.com/c/download-app/-/N-4th2r?lnk=IntroducingWall
Title:

Search URL Search Domain Scan URL

URL: https://rcam.target.com/#/Enrollment
Title: Sign Up

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://powertechnologies.net/www/ Page URL
https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
powertechnologies.net/www/ 152 B
407 B 517ms
154ms Document
text/html 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://powertechnologies.net/www/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash

Request headers

Host: powertechnologies.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Date: Wed, 29 Jan 2020 00:25:13 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
Keep-Alive: timeout=2, max=25
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request Login.html Show response
powertechnologies.net/www/ 155 KB
155 KB 118ms
118ms Document
text/html 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: 4b1d6890613d06d10f48885af815dcac94628f134a25e4635d2ff0bdc0652af4

Request headers

Host: powertechnologies.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Referer: https://powertechnologies.net/www/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://powertechnologies.net/www/

Response headers

Date: Wed, 29 Jan 2020 00:25:13 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
Last-Modified: Tue, 28 May 2019 17:30:12 GMT
ETag: "5dd503-26bf1-589f604615100"
Accept-Ranges: bytes
Content-Length: 158705
Keep-Alive: timeout=2, max=24
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK css
powertechnologies.net/www/Login_files/ 211 KB
212 KB 337ms
113ms Stylesheet
text/plain 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://powertechnologies.net/www/Login_files/css
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: da4f4edeee2842eee016a1a138fa5811ce3179cc1602752224854d8ec7a770ea

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 00:25:14 GMT
Last-Modified: Tue, 28 May 2019 16:52:36 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
ETag: "6bcbc4-34dc6-589f57de97d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=25
Content-Length: 216518

GET
H/1.1 200
OK css
rcam.target.com/bundles/ 211 KB
42 KB 411ms
142ms Stylesheet
text/css 156.55.203.146
FNIS

General

Check archive.org

Show headers Download Go to

Full URL

https://rcam.target.com/bundles/css?v=sIveZNzJp18_HLP7hMqMHtZ1HJYdVC8uO0R9I-6XO4Q1

Requested by

Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

156.55.203.146 , United States, ASN18434 (FNIS, US),

Reverse DNS

aka6042-rcam.fisglobal.com

Software

eZCard / ASP.NET

Resource Hash

da4f4edeee2842eee016a1a138fa5811ce3179cc1602752224854d8ec7a770ea

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
ntCoent-Length: 216518
Transfer-Encoding: chunked
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Vary: User-Agent
X-XSS-Protection: 1; mode=block
Last-Modified: Wed, 29 Jan 2020 00:25:15 GMT
Server: eZCard
Date: Wed, 29 Jan 2020 00:25:14 GMT
X-Machine-Name: WB09
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET, PUT, POST, OPTIONS, DELETE
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: rcam.target.com, null
Cache-Control: private
Access-Control-Allow-Credentials: true
Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Access-Control-Allow-Headers: null
Expires: Thu, 28 Jan 2021 00:25:15 GMT

GET
H/1.1 200
OK modernizr Show response
rcam.target.com/bundles/ 11 KB
6 KB 408ms
140ms Script
text/javascript 156.55.203.146
FNIS

General

Check archive.org

Show headers Download Go to

Full URL

https://rcam.target.com/bundles/modernizr?v=YW8jDg0T8iocvUwhCOjeAtql8F2f08tm10dlTXSymBk1

Requested by

Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

156.55.203.146 , United States, ASN18434 (FNIS, US),

Reverse DNS

aka6042-rcam.fisglobal.com

Software

eZCard / ASP.NET

Resource Hash

04b3057863de952f4289296ba9180b84645ca07d69796b1e89eaf6d8b2498063

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
ntCoent-Length: 11171
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 4665
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: eZCard
Date: Wed, 29 Jan 2020 00:25:14 GMT
X-Machine-Name: WB09
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET, PUT, POST, OPTIONS, DELETE
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: rcam.target.com, null
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Access-Control-Allow-Headers: null
Expires: -1

GET
H/1.1 200
OK 022239b7-6807-405c-a880-00674c4ed325
powertechnologies.net/www/Login_files/ 63 KB
63 KB 123ms
117ms Image
image/png 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://powertechnologies.net/www/Login_files/022239b7-6807-405c-a880-00674c4ed325
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: aaa0e36dd2faec5d0f7226089281d0c9faa8900ddbc53826db558e35568e51e2

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 00:25:14 GMT
Last-Modified: Tue, 28 May 2019 16:52:36 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
ETag: "6bcbbe-fc86-589f57de97d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=23
Content-Length: 64646

GET
H/1.1 200
OK 1c458642-8677-4bb8-a03e-ebfdf9d7627d
powertechnologies.net/www/Login_files/ 17 KB
18 KB 346ms
117ms Image
image/png 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://powertechnologies.net/www/Login_files/1c458642-8677-4bb8-a03e-ebfdf9d7627d
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: 8e53953f90ff52f3c55f7e7050af2e17fa6f1879694db4c1672e36bbbb2e9321

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 00:25:14 GMT
Last-Modified: Tue, 28 May 2019 16:52:36 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
ETag: "6bcbbf-45cd-589f57de97d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=22
Content-Length: 17869

GET
H/1.1 200
OK 8ef4f20e-8b91-406a-808c-3278f94b9021
powertechnologies.net/www/Login_files/ 26 KB
26 KB 113ms
112ms Image
image/png 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://powertechnologies.net/www/Login_files/8ef4f20e-8b91-406a-808c-3278f94b9021
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: c59e2ee2b0d32a173bd48a79729ea70024f843163a595473d23c18a1078816c8

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 00:25:15 GMT
Last-Modified: Tue, 28 May 2019 16:52:36 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
ETag: "6bcbc2-6616-589f57de97d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=24
Content-Length: 26134

GET
H/1.1 200
OK 58c253b6-ee93-4521-8633-5b55ca418030
powertechnologies.net/www/Login_files/ 56 KB
57 KB 118ms
117ms Image
image/png 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://powertechnologies.net/www/Login_files/58c253b6-ee93-4521-8633-5b55ca418030
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: ca454202a9ab11a154de6b845a28d481cf1c11b727dab70a2df7a4dc3a22f540

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 00:25:15 GMT
Last-Modified: Tue, 28 May 2019 16:52:36 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
ETag: "6bcbc0-e1c3-589f57de97d00"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=21
Content-Length: 57795

GET
H/1.1 200
OK vendors Show response
rcam.target.com/bundles/ 1 MB
465 KB 313ms
134ms Script
text/javascript 156.55.203.146
FNIS

General

Check archive.org

Show headers Download Go to

Full URL

https://rcam.target.com/bundles/vendors?v=4GlOgOZoNBMaP_coUXUwiGAwa-sPXXP5iPOAsY1KI1c1

Requested by

Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

156.55.203.146 , United States, ASN18434 (FNIS, US),

Reverse DNS

aka6042-rcam.fisglobal.com

Software

eZCard / ASP.NET

Resource Hash

8538928bc832d7416b1a9df96430135bb8b7c0c07a92d99d84bdbab3eeeddd81

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
ntCoent-Length: 1571433
Transfer-Encoding: chunked
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: eZCard
Date: Wed, 29 Jan 2020 00:25:15 GMT
X-Machine-Name: WB07
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET, PUT, POST, OPTIONS, DELETE
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: rcam.target.com, null
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Access-Control-Allow-Headers: null
Expires: -1

GET
H/1.1 200
OK angular-locale_en-US.js Show response
rcam.target.com/Scripts/i18n/ 3 KB
2 KB 278ms
134ms Script
application/javascript 156.55.203.146
FNIS

General

Check archive.org

Show headers Download Go to

Full URL

https://rcam.target.com/Scripts/i18n/angular-locale_en-US.js

Requested by

Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

156.55.203.146 , United States, ASN18434 (FNIS, US),

Reverse DNS

aka6042-rcam.fisglobal.com

Software

eZCard / ASP.NET

Resource Hash

be1a99b11acde26fa93149b45583b86994c7d7e388ffd24b0b4da17eb7d33f4b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 964
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 28 Oct 2019 14:41:18 GMT
Server: eZCard
X-Frame-Options: SAMEORIGIN
Date: Wed, 29 Jan 2020 00:25:14 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: null
Access-Control-Allow-Credentials: true
ETag: "0bbe9c19d8dd51:0"
Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Accept-Ranges: bytes
Access-Control-Allow-Headers: null

GET
H/1.1 200
OK login Show response
rcam.target.com/bundles/ 1 KB
2 KB 129ms
128ms Script
text/javascript 156.55.203.146
FNIS

General

Check archive.org

Show headers Download Go to

Full URL

https://rcam.target.com/bundles/login?v=N-zpb67vi3rJeAvoIQ_Y6COz3-pTTvGHrQlv8vTcLb01

Requested by

Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

156.55.203.146 , United States, ASN18434 (FNIS, US),

Reverse DNS

aka6042-rcam.fisglobal.com

Software

eZCard / ASP.NET

Resource Hash

dc5c0bcfa82f5c72e95aad33b885c5aaf0d09a22642b0e23608b1256ddcdbd29

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
ntCoent-Length: 1195
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
Content-Length: 614
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: eZCard
Date: Wed, 29 Jan 2020 00:25:15 GMT
X-Machine-Name: WB07
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET, PUT, POST, OPTIONS, DELETE
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: rcam.target.com, null
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Access-Control-Allow-Headers: null
Expires: -1

GET
H/1.1 200
OK login-dependencies Show response
rcam.target.com/bundles/ 137 KB
35 KB 191ms
138ms Script
text/javascript 156.55.203.146
FNIS

General

Check archive.org

Show headers Download Go to

Full URL

https://rcam.target.com/bundles/login-dependencies?v=9sFN9xzVvzpkPDnKZ7M_6mxvrUlQD6xTLVu57dPMLQk1

Requested by

Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

156.55.203.146 , United States, ASN18434 (FNIS, US),

Reverse DNS

aka6042-rcam.fisglobal.com

Software

eZCard / ASP.NET

Resource Hash

7b1819fc946cab66d6c69e9c568b5157582c039f8c818e42142d4a5e85791ebf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Powered-By: ASP.NET
ntCoent-Length: 140464
Transfer-Encoding: chunked
P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: eZCard
Date: Wed, 29 Jan 2020 00:25:15 GMT
X-Machine-Name: WB07
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Methods: GET, PUT, POST, OPTIONS, DELETE
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: rcam.target.com, null
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Content-Security-Policy: default-src 'self'; connect-src 'self'; font-src fonts.gstatic.com 'self' data:; img-src 'self' csi.gstatic.com data:; media-src 'self'; object-src 'self'; script-src 'unsafe-inline' 'self'; style-src fonts.googleapis.com 'unsafe-inline' 'self';
Access-Control-Allow-Headers: null
Expires: -1

GET
H2 200 track
track-card.web.app/ 35 B
335 B 690ms
660ms Image
image/gif 151.101.1.195
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track-card.web.app/track
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Google Frontend / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 00:25:16 GMT
server: Google Frontend
x-timer: S1580257516.340471,VS0,VE647
x-powered-by: Express
vary: cookie,need-authorization, x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: image/gif
status: 200
x-cloud-trace-context: 2a997b0dd77cfb6bee25c9ba353ec816;o=1
cache-control: private
function-execution-id: wwtlax542wra
x-cache-hits: 0
accept-ranges: bytes, bytes
content-length: 35
x-served-by: cache-ams21035-AMS

GET
H/1.1 200
OK saved_resource.html Show response
powertechnologies.net/www/Login_files/ Frame 990B 5 KB
5 KB 118ms
118ms Document
text/html 209.59.133.238
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://powertechnologies.net/www/Login_files/saved_resource.html
Requested by: Host: powertechnologies.net
URL: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.59.133.238 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host2.strykerdigital.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: 069c30b8be95c95254ef2e863008030974e321738e3123ca59bcc672c117ba58

Request headers

Host: powertechnologies.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: nested-navigate
Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://powertechnologies.net/www/Login.html?=_af372168d5bb38a30e4962fa82c03842=

Response headers

Date: Wed, 29 Jan 2020 00:25:15 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
Last-Modified: Tue, 28 May 2019 16:52:36 GMT
ETag: "6bcbca-146e-589f57de97d00"
Accept-Ranges: bytes
Content-Length: 5230
Keep-Alive: timeout=2, max=20
Connection: Keep-Alive
Content-Type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Target (Retail)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

powertechnologies.net
rcam.target.com
track-card.web.app
151.101.1.195
156.55.203.146
209.59.133.238
04b3057863de952f4289296ba9180b84645ca07d69796b1e89eaf6d8b2498063
069c30b8be95c95254ef2e863008030974e321738e3123ca59bcc672c117ba58
4b1d6890613d06d10f48885af815dcac94628f134a25e4635d2ff0bdc0652af4
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
7b1819fc946cab66d6c69e9c568b5157582c039f8c818e42142d4a5e85791ebf
8538928bc832d7416b1a9df96430135bb8b7c0c07a92d99d84bdbab3eeeddd81
8e53953f90ff52f3c55f7e7050af2e17fa6f1879694db4c1672e36bbbb2e9321
aaa0e36dd2faec5d0f7226089281d0c9faa8900ddbc53826db558e35568e51e2
be1a99b11acde26fa93149b45583b86994c7d7e388ffd24b0b4da17eb7d33f4b
c59e2ee2b0d32a173bd48a79729ea70024f843163a595473d23c18a1078816c8
ca454202a9ab11a154de6b845a28d481cf1c11b727dab70a2df7a4dc3a22f540
da4f4edeee2842eee016a1a138fa5811ce3179cc1602752224854d8ec7a770ea
dc5c0bcfa82f5c72e95aad33b885c5aaf0d09a22642b0e23608b1256ddcdbd29

powertechnologies.net Open in urlscan Pro 209.59.133.238 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

1088 kBTransfer

2432 kBSize

0 Cookies

5 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

26 JavaScript Global Variables

0 Cookies

Indicators

powertechnologies.net Open in urlscan Pro
209.59.133.238 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

1088 kB
Transfer

2432 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!