webmail.rlcarriers.com
Open in
urlscan Pro
198.147.255.31
Malicious Activity!
Public Scan
Effective URL: https://webmail.rlcarriers.com/owa_fczmoehcnfm_form?L293YQ==
Submission: On March 23 via api from US — Scanned from US
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 7th 2023. Valid for: a year.
This is the only time webmail.rlcarriers.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 8 | 198.147.255.31 198.147.255.31 | 55156 (RLR-EAS) (RLR-EAS) | |
5 | 1 |
ASN55156 (RLR-EAS, US)
PTR: autodiscover.rlc.com
webmail.rlcarriers.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
rlcarriers.com
3 redirects
webmail.rlcarriers.com |
92 KB |
5 | 1 |
Domain | Requested by | |
---|---|---|
8 | webmail.rlcarriers.com |
3 redirects
webmail.rlcarriers.com
|
5 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
rpcmail.rlcarriers.com Go Daddy Secure Certificate Authority - G2 |
2023-03-07 - 2024-04-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://webmail.rlcarriers.com/owa_fczmoehcnfm_form?L293YQ==
Frame ID: 4EAE6D0B925C287D6402415AFD29BC20
Requests: 5 HTTP requests in this frame
Screenshot
Page Title
Outlook WebAppPage URL History Show full URLs
-
http://webmail.rlcarriers.com/
HTTP 301
https://webmail.rlcarriers.com/ HTTP 302
https://webmail.rlcarriers.com/owa HTTP 302
https://webmail.rlcarriers.com/owa_fczmoehcnfm_form?L293YQ== Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://webmail.rlcarriers.com/
HTTP 301
https://webmail.rlcarriers.com/ HTTP 302
https://webmail.rlcarriers.com/owa HTTP 302
https://webmail.rlcarriers.com/owa_fczmoehcnfm_form?L293YQ== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
owa_fczmoehcnfm_form
webmail.rlcarriers.com/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles_responsive.css
webmail.rlcarriers.com/REF_WAFDefaultAuthProfileForm/ |
78 KB 78 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
olk_logo_white.png
webmail.rlcarriers.com/REF_WAFDefaultAuthProfileForm/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
webmail.rlcarriers.com/REF_WAFDefaultAuthProfileForm/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Sign_in_arrow.png
webmail.rlcarriers.com/REF_WAFDefaultAuthProfileForm/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| window_onload function| checkSubmit function| SubmitForm0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
webmail.rlcarriers.com
198.147.255.31
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
7c9b1fdee5abb849c8ed9a2218673feb4ba476c0a0091c8353ce4594b3da9691
ade26d8513e7948ffb4a9b6091a343b221e389d2d489eb545ae07cb6316913ef
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b