pfcco.net Open in urlscan Pro
188.40.194.162 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kid-zmuz.in/wp-user/user.php
Effective URL:
https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32ea...
Submission: On June 03 via manual (June 3rd 2022, 5:19:16 pm UTC) from CA — Scanned from CA

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 188.40.194.162, located in Germany and belongs to HETZNER-AS, DE. The main domain is pfcco.net.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 10th 2021. Valid for: a year.

This is the only time pfcco.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BCE-Bell (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3035::ac43:d65f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	188.40.194.162 188.40.194.162	24940 (HETZNER-AS) (HETZNER-AS)
4	69.164.47.0 69.164.47.0	22822 (LLNW) (LLNW)
16	3

1 2606:4700:3035::ac43:d65f (United States)

ASN13335 (CLOUDFLARENET, US)

kid-zmuz.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 188.40.194.162 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.162.194.40.188.clients.your-server.de

pfcco.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.164.47.0 (United States)

ASN22822 (LLNW, US)
PTR: https-69-164-47-0.jfk.llnw.net

pfobellweb.hs.llnwd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	pfcco.net pfcco.net	237 KB
4	llnwd.net pfobellweb.hs.llnwd.net — Cisco Umbrella Rank: 485633	122 KB
1	kid-zmuz.in kid-zmuz.in	664 B
16	3

	Domain	Requested by
11	pfcco.net	pfcco.net
4	pfobellweb.hs.llnwd.net	pfcco.net
1	kid-zmuz.in
16	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-10-05` - `2022-10-04`	a year	crt.sh
pfcco.net Sectigo RSA Domain Validation Secure Server CA	`2021-10-10` - `2022-10-10`	a year	crt.sh
*.hs.llnwd.net Sectigo RSA Domain Validation Secure Server CA	`2022-03-18` - `2023-04-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Frame ID: 573B669A6D24F4CB272F8B65916EEDAA
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in to MyBell

Page URL History Show full URLs

https://kid-zmuz.in/wp-user/user.php Page URL
https://pfcco.net/wp-util/index.php Page URL
https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

16
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

360 kB
Transfer

1317 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kid-zmuz.in/wp-user/user.php Page URL
https://pfcco.net/wp-util/index.php Page URL
https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 user.php
kid-zmuz.in/wp-user/ 82 B
664 B 1070ms
1015ms Document
text/html 2606:4700:3035::ac43:d65f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://kid-zmuz.in/wp-user/user.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:d65f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.33
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 715a179e2f8c713f-YUL
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 03 Jun 2022 17:19:12 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6bwH5243eCQv2uXxUQa63R6X%2FOibISYZgb%2Bpg8R5gPnaP%2BKRUuyUH0fu3WMMbo9fyHIk5%2BzBc2G1WoZZH72R%2BuNaDrk%2B7Z3WDEWoQssADRP9fGCTBNC0NjuR%2B5PPKU9%2F8UruUiSxSd1CFg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: PHP/7.3.33
x-turbo-charged-by: LiteSpeed

GET
H2 200 index.php Show response
pfcco.net/wp-util/ 628 B
534 B 947ms
206ms Document
text/html 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 8d086dfc88f0e4c702ec20dd41653fbdc62baa424e0f14463f46ffa38ecb6178

Request headers

Referer: https://kid-zmuz.in/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-length: 428
content-type: text/html; charset=UTF-8
date: Fri, 03 Jun 2022 17:19:12 GMT
server: Apache/2
vary: Accept-Encoding,User-Agent

GET
H2 200 Primary Request S211eery1865c9y.php Show response
pfcco.net/wp-util/ 18 KB
6 KB 208ms
207ms Document
text/html 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: cc9bf2b87e3666b228398e4dc4790fa85dea58a2225f196697476047088e9184

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 5588
content-type: text/html; charset=UTF-8
date: Fri, 03 Jun 2022 17:19:13 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache/2
vary: Accept-Encoding,User-Agent

GET
H2 200 bell.css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 808 KB
106 KB 414ms
413ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell.css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: e27750bd8f7add80437b9f5a75626739f8342e30fd35dd6ff302d96330b59964

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "ca133-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes

GET
H2 200 bell(1).css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 4 KB
1 KB 110ms
109ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell(1).css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: b00754524869bd430ae18a373883452a633e41736b58188d3109fc6b5f36238f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "1118-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 983

GET
H2 200 registrationFlow-login.css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 32 KB
7 KB 111ms
109ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/registrationFlow-login.css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 721a7bb35cd1aa6b81bbb4e1d197e84003142a72abf045dfe47b29948edc1a79

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "80ab-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 6580

GET
H2 200 login-tracker-icon.min.css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 1 KB
484 B 110ms
109ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/login-tracker-icon.min.css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 55b8eb223e37f7bfab42aa9d5144ee52a14df40dd279260bcf7d5b0a68d140a2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "516-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 430

GET
H2 200 login-tracker.min.css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 12 KB
3 KB 114ms
112ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/login-tracker.min.css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 41d5494dc24c7bf70ec0a23e9e96a3cbeb166d4f842c674d93605178ef05acef

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "2e93-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 2946

GET
H2 200 bell(2).css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 244 KB
37 KB 116ms
115ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell(2).css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 7c70a0312594726ce839d13a6cca394df912b64b0d1fe1c2fe1858f0597c4245

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "3d195-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 37463

GET
H2 200 fonts.css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 2 KB
552 B 110ms
109ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/fonts.css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 053bfcc5e83a414860621f457b4af3dc94a85dc56b7514d7188be47cfa8eca36

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "93c-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 498

GET
H2 200 bell_custom_deprecatedbrowser_new.css
pfcco.net/wp-util/Uyfi9a99a9ui88/ 1 KB
537 B 110ms
109ms Stylesheet
text/css 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell_custom_deprecatedbrowser_new.css
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 5dd4f75a33a397e43c440b1d6ffcfda71f004d0a31cc0894b665ac2f0ff2ad6d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
last-modified: Mon, 02 Nov 2020 20:41:26 GMT
server: Apache/2
etag: "4be-5b325c5212980-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 483

GET
H/1.1 200
OK bellslim_regular-webfont.woff2
pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/ 19 KB
20 KB 75ms
23ms Font
application/octet-stream 69.164.47.0
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/bellslim_regular-webfont.woff2?ver=00000000

Requested by

Host: pfcco.net
URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

69.164.47.0 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-69-164-47-0.jfk.llnw.net

Software

Resource Hash

3e4d8f00673f6a80b26a8565f9931374e1e9171553b078261a67772af7511629

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors oneview.bell.ca bell.ca .bell.ca .bellmts.ca .virginmobile.ca .vm.ca .vmobile.ca .vmcanada.com *.thesource.ca
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://pfcco.net/
Origin: https://pfcco.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 03 Jun 2022 17:19:13 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Age: 26695
Connection: keep-alive
Content-Length: 19412
X-XSS-Protection: 1
Last-Modified: Sun, 19 Jan 2020 06:54:19 GMT
X-Generated-By: O-9X-T06
X-Frame-Options: SAMEORIGIN
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Content-Security-Policy: frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca
Accept-Ranges: bytes
X-LLID: 54fda85b0cec9f668e7cce1ad9f51582
Expires: Sat, 04 Jun 2022 09:54:18 GMT

GET
H/1.1 200
OK bellslim_medium-webfont.woff2
pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/ 19 KB
21 KB 76ms
24ms Font
application/octet-stream 69.164.47.0
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/bellslim_medium-webfont.woff2?ver=00000000

Requested by

Host: pfcco.net
URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

69.164.47.0 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-69-164-47-0.jfk.llnw.net

Software

Resource Hash

e36f3860d6fe12df58872c55cf1fb78b7a3fe86d9a27591bfda5d8ceb34a31f3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors oneview.bell.ca bell.ca .bell.ca .bellmts.ca .virginmobile.ca .vm.ca .vmobile.ca .vmcanada.com .thesource.ca .luckymobile.ca .virginplus.ca; script-src https://.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://.google-analytics.com https://.postescanada-canadapost.ca https://.digital.nuance.com https://.inq.com https://connect.facebook.net https://static.ads-twitter.com https://.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://.google.com https://.gstatic.com https://.vmobile.ca https://.googleadservices.com https://.stackadapt.com https://.doubleclick.net https://.virginplus.ca https://.bell.ca https://.tiktok.com https://.know-where.com https://.korem.com https://.googleapis.com https://.coveo.com https://siteimproveanalytics.com https://.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://.medallia.ca https://.kampyle.com https://.decibelinsight.net https://.decibelinsight.com https://.bazaarvoice.com https://.bing.com https://.clarity.ms 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://pfcco.net/
Origin: https://pfcco.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 03 Jun 2022 17:19:13 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Age: 26695
Connection: keep-alive
Content-Length: 19880
X-XSS-Protection: 1
Last-Modified: Sun, 19 Jan 2020 06:54:19 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Content-Security-Policy: frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca *.luckymobile.ca *.virginplus.ca; script-src https://*.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://*.google-analytics.com https://*.postescanada-canadapost.ca https://*.digital.nuance.com https://*.inq.com https://connect.facebook.net https://static.ads-twitter.com https://*.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://*.google.com https://*.gstatic.com https://*.vmobile.ca https://*.googleadservices.com https://*.stackadapt.com https://*.doubleclick.net https://*.virginplus.ca https://*.bell.ca https://*.tiktok.com https://*.know-where.com https://*.korem.com https://*.googleapis.com https://*.coveo.com https://siteimproveanalytics.com https://*.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://*.medallia.ca https://*.kampyle.com https://*.decibelinsight.net https://*.decibelinsight.com https://*.bazaarvoice.com https://*.bing.com https://*.clarity.ms 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Accept-Ranges: bytes
X-LLID: 90da5298194cf2ca4cf53c463d083e7a
Expires: Sat, 04 Jun 2022 09:54:18 GMT

GET
H/1.1 200
OK bell-icon.woff
pfobellweb.hs.llnwd.net/Styles/BRF2/Master/core/fonts/ 59 KB
61 KB 76ms
24ms Font
application/octet-stream 69.164.47.0
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://pfobellweb.hs.llnwd.net/Styles/BRF2/Master/core/fonts/bell-icon.woff?ver=201910200707

Requested by

Host: pfcco.net
URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell(2).css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

69.164.47.0 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-69-164-47-0.jfk.llnw.net

Software

Resource Hash

bea03e289208b0ca394d3ed7ddf39f8be8f1570808fbc70055717770b7dab181

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors oneview.bell.ca bell.ca .bell.ca .bellmts.ca .virginmobile.ca .vm.ca .vmobile.ca .vmcanada.com .thesource.ca .luckymobile.ca .virginplus.ca; script-src https://.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://.google-analytics.com https://.postescanada-canadapost.ca https://.digital.nuance.com https://.inq.com https://connect.facebook.net https://static.ads-twitter.com https://.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://.google.com https://.gstatic.com https://.vmobile.ca https://.googleadservices.com https://.stackadapt.com https://.doubleclick.net https://.virginplus.ca https://.bell.ca https://.tiktok.com https://.know-where.com https://.korem.com https://.googleapis.com https://.coveo.com https://siteimproveanalytics.com https://.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://.medallia.ca https://.kampyle.com https://.decibelinsight.net https://*.decibelinsight.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://pfcco.net/
Origin: https://pfcco.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 03 Jun 2022 17:19:13 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Age: 17781
Connection: keep-alive
Content-Length: 60340
X-XSS-Protection: 1
Last-Modified: Wed, 23 Feb 2022 01:49:45 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Content-Security-Policy: frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca *.luckymobile.ca *.virginplus.ca; script-src https://*.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://*.google-analytics.com https://*.postescanada-canadapost.ca https://*.digital.nuance.com https://*.inq.com https://connect.facebook.net https://static.ads-twitter.com https://*.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://*.google.com https://*.gstatic.com https://*.vmobile.ca https://*.googleadservices.com https://*.stackadapt.com https://*.doubleclick.net https://*.virginplus.ca https://*.bell.ca https://*.tiktok.com https://*.know-where.com https://*.korem.com https://*.googleapis.com https://*.coveo.com https://siteimproveanalytics.com https://*.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://*.medallia.ca https://*.kampyle.com https://*.decibelinsight.net https://*.decibelinsight.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Accept-Ranges: bytes
X-LLID: d1040c0973da5ca349e1c1da1b8b1eed
Expires: Sat, 04 Jun 2022 12:22:52 GMT

GET
H/1.1 200
OK bellslim_semibold-webfont.woff2
pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/ 19 KB
21 KB 75ms
23ms Font
application/octet-stream 69.164.47.0
LLNW

General

Check archive.org

Show headers Download Go to

Full URL

https://pfobellweb.hs.llnwd.net/styles/RSX/framework/css/fonts/bellslim_semibold-webfont.woff2?ver=00000000

Requested by

Host: pfcco.net
URL: https://pfcco.net/wp-util/Uyfi9a99a9ui88/bell.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

69.164.47.0 , United States, ASN22822 (LLNW, US),

Reverse DNS

https-69-164-47-0.jfk.llnw.net

Software

Resource Hash

41407c31a0d44bb952744a390decccd0a4ba5918e4ff89c860f2495d5ee7a7fe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors oneview.bell.ca bell.ca .bell.ca .bellmts.ca .virginmobile.ca .vm.ca .vmobile.ca .vmcanada.com .thesource.ca .luckymobile.ca .virginplus.ca; script-src https://.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://.google-analytics.com https://.postescanada-canadapost.ca https://.digital.nuance.com https://.inq.com https://connect.facebook.net https://static.ads-twitter.com https://.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://.google.com https://.gstatic.com https://.vmobile.ca https://.googleadservices.com https://.stackadapt.com https://.doubleclick.net https://.virginplus.ca https://.bell.ca https://.tiktok.com https://.know-where.com https://.korem.com https://.googleapis.com https://.coveo.com https://siteimproveanalytics.com https://.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://.medallia.ca https://.kampyle.com https://.decibelinsight.net https://*.decibelinsight.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Strict-Transport-Security	max-age=16070400
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://pfcco.net/
Origin: https://pfcco.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date: Fri, 03 Jun 2022 17:19:13 GMT
Strict-Transport-Security: max-age=16070400
X-Content-Type-Options: nosniff
Age: 26695
Connection: keep-alive
Content-Length: 19348
X-XSS-Protection: 1
Last-Modified: Sun, 19 Jan 2020 06:54:19 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Content-Security-Policy: frame-ancestors oneview.bell.ca bell.ca *.bell.ca *.bellmts.ca *.virginmobile.ca *.vm.ca *.vmobile.ca *.vmcanada.com *.thesource.ca *.luckymobile.ca *.virginplus.ca; script-src https://*.luckymobile.ca https://www.googletagmanager.com https://sc-static.net https://assets.adobedtm.com https://*.google-analytics.com https://*.postescanada-canadapost.ca https://*.digital.nuance.com https://*.inq.com https://connect.facebook.net https://static.ads-twitter.com https://*.twitter.com https://ssl.geoplugin.net https://s.pinimg.com https://*.google.com https://*.gstatic.com https://*.vmobile.ca https://*.googleadservices.com https://*.stackadapt.com https://*.doubleclick.net https://*.virginplus.ca https://*.bell.ca https://*.tiktok.com https://*.know-where.com https://*.korem.com https://*.googleapis.com https://*.coveo.com https://siteimproveanalytics.com https://*.licdn.com https://vldbellsup.hs.llnwd.net https://vfobellsup.hs.llnwd.net https://prdbellsup.hs.llnwd.net https://pfobellsup.hs.llnwd.net https://cdnjs.cloudflare.com https://vldbellweb.hs.llnwd.net https://vfobellweb.hs.llnwd.net https://prdbellweb.hs.llnwd.net https://pfobellweb.hs.llnwd.net https://*.medallia.ca https://*.kampyle.com https://*.decibelinsight.net https://*.decibelinsight.com 'unsafe-inline' 'unsafe-eval'; object-src 'none'
Accept-Ranges: bytes
X-LLID: d1159e4cbe47f28c67f995cbaaadd68d
Expires: Sat, 04 Jun 2022 09:54:18 GMT

GET
H2 404 upds.jpg
pfcco.net/Styles/images/ 77 KB
77 KB 2468ms
2468ms Image
text/html 188.40.194.162
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pfcco.net/Styles/images/upds.jpg
Requested by: Host: pfcco.net
URL: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.194.162 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.162.194.40.188.clients.your-server.de
Software: Apache/2 /
Resource Hash: 03f0454046ff0443f2bd1b1fcdd016cf96103143c9e88827d95d71c8841a0850

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://pfcco.net/wp-util/S211eery1865c9y.php?byx=&7e066dae7819a5cb9e1d946798103550626f109aacf4725a54d1587f3ac32eabc87dcb28a13f44ede2e305d25ab5374fd3823b861bc9e2a939b40a52c9749f4f20846efa6f12b7bde89003cc576cd1b88b10c2df54f073ec46b1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Fri, 03 Jun 2022 17:19:13 GMT
content-encoding: gzip
server: Apache/2
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate, max-age=0
link: <https://pfcco.net/wp-json/>; rel="https://api.w.org/"
content-length: 19638
expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BCE-Bell (Telecommunication)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pfcco.net/wp-util	1969-12-31 23:59:59	Name: drake Value: dexter
			pfcco.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: lrob5c1a1rjnrlp5tjb0l1vblo

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pfcco.net/Styles/images/upds.jpg Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kid-zmuz.in
pfcco.net
pfobellweb.hs.llnwd.net
188.40.194.162
2606:4700:3035::ac43:d65f
69.164.47.0
03f0454046ff0443f2bd1b1fcdd016cf96103143c9e88827d95d71c8841a0850
053bfcc5e83a414860621f457b4af3dc94a85dc56b7514d7188be47cfa8eca36
3e4d8f00673f6a80b26a8565f9931374e1e9171553b078261a67772af7511629
41407c31a0d44bb952744a390decccd0a4ba5918e4ff89c860f2495d5ee7a7fe
41d5494dc24c7bf70ec0a23e9e96a3cbeb166d4f842c674d93605178ef05acef
55b8eb223e37f7bfab42aa9d5144ee52a14df40dd279260bcf7d5b0a68d140a2
5dd4f75a33a397e43c440b1d6ffcfda71f004d0a31cc0894b665ac2f0ff2ad6d
721a7bb35cd1aa6b81bbb4e1d197e84003142a72abf045dfe47b29948edc1a79
7c70a0312594726ce839d13a6cca394df912b64b0d1fe1c2fe1858f0597c4245
8d086dfc88f0e4c702ec20dd41653fbdc62baa424e0f14463f46ffa38ecb6178
b00754524869bd430ae18a373883452a633e41736b58188d3109fc6b5f36238f
bea03e289208b0ca394d3ed7ddf39f8be8f1570808fbc70055717770b7dab181
cc9bf2b87e3666b228398e4dc4790fa85dea58a2225f196697476047088e9184
e27750bd8f7add80437b9f5a75626739f8342e30fd35dd6ff302d96330b59964
e36f3860d6fe12df58872c55cf1fb78b7a3fe86d9a27591bfda5d8ceb34a31f3

pfcco.net Open in urlscan Pro 188.40.194.162 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

360 kBTransfer

1317 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

pfcco.net Open in urlscan Pro
188.40.194.162 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

360 kB
Transfer

1317 kB
Size

2
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!