wa.ucoz.net Open in urlscan Pro
193.109.246.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://wa.ucoz.net/Outlook.html
Effective URL:
https://wa.ucoz.net/Outlook.html
Submission: On May 15 via manual (May 15th 2020, 6:49:27 am UTC) from TW

Summary HTTP 16 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 16 HTTP transactions. The main IP is 193.109.246.80, located in Moscow, Russian Federation and belongs to COMPUBYTE-AS, RU. The main domain is wa.ucoz.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 26th 2019. Valid for: 2 years.

This is the only time wa.ucoz.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	193.109.246.80 193.109.246.80	204343 (COMPUBYTE-AS) (COMPUBYTE-AS)
12	161.17.0.44 161.17.0.44	15404 (COLT Tech...) (COLT Technology Services Group)
1	2606:4700:10:... 2606:4700:10::6814:432e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.111.11.182 23.111.11.182	33438 (HIGHWINDS2) (HIGHWINDS2)
1	54.230.183.72 54.230.183.72	16509 (AMAZON-02) (AMAZON-02)
16	5

1 193.109.246.80 (Moscow, Russian Federation)

ASN204343 (COMPUBYTE-AS, RU)
PTR: dev.ucoz.net

wa.ucoz.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 161.17.0.44 (United Kingdom)

ASN15404 (COLT Technology Services Group, SE)

mail.gstt.nhs.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:432e (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.000webhost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.111.11.182 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

a.opmnstr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.183.72 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-183-72.ham50.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	gstt.nhs.uk mail.gstt.nhs.uk	27 KB
1	omappapi.com api.omappapi.com	506 B
1	opmnstr.com a.opmnstr.com	60 KB
1	000webhost.com cdn.000webhost.com	2 KB
1	ucoz.net wa.ucoz.net	6 KB
16	5

	Domain	Requested by
12	mail.gstt.nhs.uk	wa.ucoz.net
1	api.omappapi.com	a.opmnstr.com
1	a.opmnstr.com	wa.ucoz.net
1	cdn.000webhost.com	wa.ucoz.net
1	wa.ucoz.net
16	5

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
www.000webhost.com

Subject Issuer	Validity	Valid
*.ucoz.net Sectigo RSA Domain Validation Secure Server CA	`2019-04-26` - `2021-04-25`	2 years	crt.sh
outlook.gstt.nhs.uk TrustCubes ICA G1	`2019-06-03` - `2021-06-07`	2 years	crt.sh
*.000webhost.com COMODO RSA Domain Validation Secure Server CA	`2018-10-19` - `2020-12-17`	2 years	crt.sh
*.opmnstr.com Go Daddy Secure Certificate Authority - G2	`2019-04-11` - `2021-04-11`	2 years	crt.sh
api.opmnstr.com Amazon	`2020-04-09` - `2021-05-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://wa.ucoz.net/Outlook.html
Frame ID: 97556D2FD524933A2E69FEC8D082011A
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Outlook Web App (Web Mail) Expand

Overall confidence: 100%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

html /<link\s[^>]*href="[^"]*?([\d.]+)\/themes\/resources\/owafont\.css/i

Page Statistics

16
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

95 kB
Transfer

245 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://go.microsoft.com/fwlink/?LinkID=129362
Title: click here.

Search URL Search Domain Scan URL

URL: https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website&utm_content=footer_img

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Outlook.html Show response
wa.ucoz.net/ 16 KB
6 KB 334ms
98ms Document
text/html 193.109.246.80
COMPUBYTE-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://wa.ucoz.net/Outlook.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

193.109.246.80 Moscow, Russian Federation, ASN204343 (COMPUBYTE-AS, RU),

Reverse DNS

dev.ucoz.net

Software

nginx /

Resource Hash

da1b956745c914b0cc4fb2a6cdeab789e4f496187c7300d6e19618a8ed33de0b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: wa.ucoz.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Fri, 15 May 2020 06:49:02 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Expires: Thu, 04 Jun 2020 06:49:02 GMT
Cache-Control: max-age=1728000
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip

GET
H/1.1 200
OK logon.css
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 2 KB
2 KB 858ms
35ms Stylesheet
text/css 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/logon.css
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:02 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 1037

GET
H/1.1 200
OK owafont.css
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 5 KB
2 KB 859ms
35ms Stylesheet
text/css 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/owafont.css
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:02 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 1773

GET
H/1.1 200
OK flogon.js Show response
mail.gstt.nhs.uk/owa/14.3.435.0/scripts/premium/ 4 KB
2 KB 874ms
50ms Script
application/x-javascript 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/scripts/premium/flogon.js
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:03 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Apr 2014 21:19:56 GMT
X-Powered-By: ASP.NET
ETag: "0269cf0260cf1:0"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 1934

GET
H/1.1 200
OK lgntopl.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 4 KB
5 KB 30ms
30ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgntopl.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:02 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 4455

GET
H/1.1 200
OK lgntopr.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 581 B
984 B 47ms
47ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgntopr.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:03 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 581

GET
H/1.1 200
OK lgnexlogo.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 61 B
463 B 45ms
44ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgnexlogo.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:03 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 61

GET
H/1.1 200
OK lgnbotl.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 9 KB
9 KB 49ms
35ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgnbotl.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:03 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 9311

GET
H/1.1 200
OK lgnbotr.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 2 KB
3 KB 77ms
28ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgnbotr.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:03 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 2392

GET
H2 200 footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ 2 KB
2 KB 45ms
25ms Image
image/webp 2606:4700:10::6814:432e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png

Requested by

Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:432e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 06:49:03 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1712
cf-polished: origFmt=png, origSize=2046
status: 200
content-disposition: inline; filename="footer-powered-by-000webhost-white2.webp"
x-hostinger-datacenter: srv
vary: Accept
content-length: 1696
x-xss-protection: 1; mode=block
last-modified: Wed, 13 May 2020 13:58:21 GMT
server: cloudflare
x-frame-options: sameorigin
etag: "5ebbfcfd-7fe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
content-type: image/webp
expires: Fri, 15 May 2020 10:49:03 GMT
cache-control: public, max-age=14400
x-hostinger-node: nl-srv-cdn1
cf-request-id: 02b8b1037500009814959f0200000001
accept-ranges: bytes
cf-ray: 593aeab25b7e9814-FRA
cf-bgj: imgq:100,h2pri

GET
H2 200 api.min.js Show response
a.opmnstr.com/app/js/ 199 KB
60 KB 57ms
17ms Script
application/javascript 23.111.11.182
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://a.opmnstr.com/app/js/api.min.js
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d89cae12ff7c825b58aba2212ed0fee615f93936397cdafca26d2cba1e13a942

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 15 May 2020 06:49:03 GMT
content-encoding: gzip
last-modified: Fri, 15 May 2020 01:30:00 GMT
server: NetDNA-cache/2.2
x-amz-request-id: A2C515CAB9D6844F
etag: W/"ac150f6e5014fa4aa12d5af1fdc66f17"
x-cache: HIT
content-type: application/javascript
status: 200
cache-control: max-age=31104000
access-control-allow-origin: *
x-amz-id-2: U6skaLw06gmx1j8wMD0jArOjsadmIuxK2wx/YbtifGgBh3UbzElc/MpWV1L74RG+0VyxL6CSS+M=
expires: Mon, 10 May 2021 06:49:03 GMT

GET
H/1.1 200
OK lgntopm.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 58 B
460 B 78ms
27ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgntopm.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6

Request headers

Referer: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:03 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 58

GET
H/1.1 200
OK lgnleft.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 290 B
693 B 67ms
28ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgnleft.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185

Request headers

Referer: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:02 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 290

GET
H/1.1 200
OK lgnright.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 306 B
709 B 43ms
28ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgnright.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775

Request headers

Referer: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:02 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 306

GET
H/1.1 200
OK lgnbotm.gif
mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/ 276 B
679 B 44ms
29ms Image
image/gif 161.17.0.44
COLT Technology S...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/lgnbotm.gif
Requested by: Host: wa.ucoz.net
URL: https://wa.ucoz.net/Outlook.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 161.17.0.44 , United Kingdom, ASN15404 (COLT Technology Services Group, SE),
Reverse DNS
Software: / ASP.NET
Resource Hash: 6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a

Request headers

Referer: https://mail.gstt.nhs.uk/owa/14.3.435.0/themes/resources/logon.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 15 May 2020 06:49:02 GMT
Last-Modified: Tue, 05 Feb 2013 22:00:46 GMT
X-Powered-By: ASP.NET
ETag: "03bed3fec3ce1:0"
Content-Type: image/gif
Cache-Control: public,max-age=2592000
Accept-Ranges: bytes
Content-Length: 276

GET
H2 410 f6brbmuxflyqoriatchv Show response
api.omappapi.com/v2/embed/71036/ 126 B
506 B 232ms
180ms XHR
application/json 54.230.183.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/71036/f6brbmuxflyqoriatchv
Requested by: Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.230.183.72 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-183-72.ham50.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: fcb673f7da578b0230aa24d90df47b3e751de9e9f19c2a1a9972394c20358285

Request headers

Referer: https://wa.ucoz.net/Outlook.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-user-agent: standard
via: 1.1 7f3d82c6ba482f74d3d5c3921ce57cbe.cloudfront.net (CloudFront)
x-cache-config: 0 0
server: Pagely Gateway/1.5.1
x-amz-cf-pop: HAM50-C3
status: 410
date: Fri, 15 May 2020 06:49:03 GMT
vary: Accept-Encoding, User-Agent
x-cache: Error from cloudfront
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: X-CSRF-Token
content-length: 126
x-amz-cf-id: vHjMY2ay7zsErmWWXoWhHdqo2iXSqYqpJd5bjUpG0t0h49QCVNDgMw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

53 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
wa.ucoz.net/	1969-12-31 23:59:59	Name: cookieTest Value: 1
wa.ucoz.net/	1970-01-19 09:32:05	Name: _omappvs Value: 1589525343180
wa.ucoz.net/	1970-01-23 09:30:38	Name: _omappvp Value: xiy4i8ZogZokEhdIfytRyvHa0BNM9jJVyiNjXDyNH3aFgFweWitX2VAWaxqGlunvzkxra66GC4QZKj0DUSbcXzo4SssNrZ1U

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://a.opmnstr.com/app/js/api.min.js(Line 2) Message: [OptinMonster] The campaign could not be found. Check to make sure it is active.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.opmnstr.com
api.omappapi.com
cdn.000webhost.com
mail.gstt.nhs.uk
wa.ucoz.net
161.17.0.44
193.109.246.80
23.111.11.182
2606:4700:10::6814:432e
54.230.183.72
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
215d250a6028db2afb14ba5028f23493f042cee6fdd59f59e4deb10fd63b1060
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
b478b93f8f9a262321211d8ce812cdd6accdfb4ede6e0230ccf44e77ad161f97
d89cae12ff7c825b58aba2212ed0fee615f93936397cdafca26d2cba1e13a942
da1b956745c914b0cc4fb2a6cdeab789e4f496187c7300d6e19618a8ed33de0b
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834
f27d451896ac6a8b768361e3f07c2adf1ee7ae6bcb92ac6d0bda7fb5cf915301
fcb673f7da578b0230aa24d90df47b3e751de9e9f19c2a1a9972394c20358285

wa.ucoz.net Open in urlscan Pro 193.109.246.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

20 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

95 kBTransfer

245 kBSize

3 Cookies

2 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

53 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

wa.ucoz.net Open in urlscan Pro
193.109.246.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

95 kB
Transfer

245 kB
Size

3
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!