zcs.ccw.mybluehost.me
Open in
urlscan Pro
162.241.24.233
Malicious Activity!
Public Scan
Effective URL: https://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/load1.html?id=4932YR-329TR23R
Submission: On May 10 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 19th 2024. Valid for: 3 months.
This is the only time zcs.ccw.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Telenor (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 162.241.24.233 162.241.24.233 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 2a02:a90:c400... 2a02:a90:c400:5001::e | 3303 (SWISSCOM ...) (SWISSCOM Swisscom Switzerland Ltd) | |
7 | 2 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5907.bluehost.com
zcs.ccw.mybluehost.me |
ASN3303 (SWISSCOM Swisscom Switzerland Ltd, CH)
rcp.scsstatic.ch |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
mybluehost.me
1 redirects
zcs.ccw.mybluehost.me |
6 KB |
1 |
scsstatic.ch
rcp.scsstatic.ch — Cisco Umbrella Rank: 511969 |
5 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
7 | zcs.ccw.mybluehost.me |
1 redirects
zcs.ccw.mybluehost.me
|
1 | rcp.scsstatic.ch | |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
mail.zcs.ccw.mybluehost.me R3 |
2024-03-19 - 2024-06-17 |
3 months | crt.sh |
rcp.production.scsstatic.ch SwissSign RSA TLS OV ICA 2021 - 1 |
2023-08-03 - 2024-08-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/load1.html?id=4932YR-329TR23R
Frame ID: E85707D06A9AC3AF923D52C44DF07019
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
SwisscomPage URL History Show full URLs
-
http://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/send2.php
HTTP 307
https://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/send2.php HTTP 302
https://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/load1.html?id=4932YR-329TR23R Page URL
Detected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- /etc/designs/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/send2.php
HTTP 307
https://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/send2.php HTTP 302
https://zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/load1.html?id=4932YR-329TR23R Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
load1.html
zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/ Redirect Chain
|
1 KB 702 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scamti.css
zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/ |
2 KB 367 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MOBILE.css
zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load.gif
zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg-menu.svg
zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/ |
315 B 315 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
rcp.scsstatic.ch/etc/designs/portal/resources/ |
4 KB 5 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
zcs.ccw.mybluehost.me/yarui/chebkhald/219eaeb8bdefd4d70c9224656c828334/ |
315 B 343 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Telenor (Telecommunication)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
rcp.scsstatic.ch
zcs.ccw.mybluehost.me
162.241.24.233
2a02:a90:c400:5001::e
2d6ca118b8e414f4700a7329489f8ae42c8cd13c0471bcc1f3eb9dce1452722e
33378d64ea729ba7e9b88800b05742916fd577806182fc87f01a4177069cce78
b316d2ebc4a9e077b8ed495dbbb39411c7b6fd223f9bfb2d25e65cb3632fcd52
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
f50d24d39d62e5de48d2cb97baf9ea54673eba5990b83ef31efa957e51710546
f6673fc8600b6010bce69e0fc3252db4a218ea6952663d34f679fe6b7d6a8c09