urlscan.io logo urlscan.io
SecurityTrails logo

homesofyuma.com Open in urlscan Pro
162.144.22.105  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mustbenyce.com/sgf/redir/
Effective URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverifi...
Submission: On March 16 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 8 domains to perform 13 HTTP transactions. The main IP is 162.144.22.105, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is homesofyuma.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 26th 2020. Valid for: 3 months.
This is the only time homesofyuma.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rackspace (Online)

Domain & IP information

IP Address AS Autonomous System
1 192.254.140.20 46606 (UNIFIEDLA...)
7 162.144.22.105 46606 (UNIFIEDLA...)
2 2 2a00:1450:400... 15169 (GOOGLE)
2 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 192.229.221.175 15133 (EDGECAST)
1 2001:4802:7a0... 27357 (RACKSPACE)
1 216.58.207.66 15169 (GOOGLE)
13 6
1    192.254.140.20 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: tex.texasas.com
mustbenyce.com
7    162.144.22.105 (Provo, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-144-22-105.unifiedlayer.com
homesofyuma.com
2    2a00:1450:4001:824::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2a00:1450:4001:824::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    192.229.221.175 (United States)

ASN15133 (EDGECAST, US)
static.emailsrvr.com
1    2001:4802:7a01:10::7 (United States)

ASN27357 (RACKSPACE, US)
cp.rackspace.com
1    216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net
www.googleadservices.com
Domain Requested by
7 homesofyuma.com homesofyuma.com
2 www.google.de homesofyuma.com
2 www.google.com 2 redirects
2 googleads.g.doubleclick.net 2 redirects
1 www.googleadservices.com homesofyuma.com
1 cp.rackspace.com homesofyuma.com
1 static.emailsrvr.com homesofyuma.com
1 mustbenyce.com
13 8

This site contains links to these domains. Also see Links.

Domain
www.rackspace.com
cp.rackspace.com
emailhelp.rackspace.com
apps.rackspace.com
Subject Issuer Validity Valid
mustbenyce.com
cPanel, Inc. Certification Authority		 2020-03-16 -
2020-06-14		 3 months crt.sh
homesofyuma.com
Let's Encrypt Authority X3		 2020-02-26 -
2020-05-26		 3 months crt.sh
www.google.de
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh
sa431gl.wpc.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2018-04-17 -
2020-07-20		 2 years crt.sh
cp.rackspace.com
Thawte TLS RSA CA G1		 2018-06-08 -
2020-07-07		 2 years crt.sh
www.googleadservices.com
GTS CA 1O1		 2020-02-25 -
2020-05-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Frame ID: 533A07F1F54F7C138C7FD88268768886
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://mustbenyce.com/sgf/redir/ Page URL
  2. https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspace... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

6
IPs

2
Countries

148 kB
Transfer

243 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mustbenyce.com/sgf/redir/ Page URL
  2. https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=1&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://apps.rackspace.com/index.php&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=v1l6XZWuD7mNmLAPpuygwA0&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=1&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://apps.rackspace.com/index.php&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=683005874&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=1&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://apps.rackspace.com/index.php&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=683005874&resp=GooglemKTybQhCsO&ipr=y
Request Chain 11
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/%3Fe%3D&ref=https://mustbenyce.com/sgf/redir/&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=JNJvXtu8GYeogAfMpaGADg&sscte=1&crd=&gtd= HTTP 302
  • https://www.google.com/pagead/1p-user-list/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/%3Fe%3D&ref=https://mustbenyce.com/sgf/redir/&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2600779652&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/%3Fe%3D&ref=https://mustbenyce.com/sgf/redir/&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2600779652&resp=GooglemKTybQhCsO&ipr=y

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
mustbenyce.com/sgf/redir/ 		1 B
354 B 		Document
General
Check archive.org
Download Go to
Full URL
https://mustbenyce.com/sgf/redir/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.254.140.20 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
tex.texasas.com
Software
Apache /
Resource Hash
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

Host
mustbenyce.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

Date
Mon, 16 Mar 2020 19:23:14 GMT
Server
Apache
refresh
0;url=https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Primary Request /
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/ 		13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
c389f0ae2e5945a0a836faaa0198b5fe5d4bd6ecb8bbf1880e83493ff55ec39d

Request headers

:method
GET
:authority
homesofyuma.com
:scheme
https
:path
/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://mustbenyce.com/sgf/redir/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document
Referer
https://mustbenyce.com/sgf/redir/

Response headers

status
200
server
nginx/1.14.1
date
Mon, 16 Mar 2020 19:23:15 GMT
content-type
text/html; charset=UTF-8
x-server-cache
false
content-encoding
gzip
jquery.js
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/ 		91 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/jquery.js
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
date
Mon, 16 Mar 2020 19:23:15 GMT
content-encoding
gzip
last-modified
Thu, 12 Sep 2019 22:16:40 GMT
server
nginx/1.14.1
x-server-cache
false
content-type
application/javascript
login.js
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/ 		29 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/login.js
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
254954afb10634ad2eead14d873510c39a68c15d3bf54bf958655962cb7e1450

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
date
Mon, 16 Mar 2020 19:23:15 GMT
content-encoding
gzip
last-modified
Thu, 12 Sep 2019 22:16:40 GMT
server
nginx/1.14.1
x-server-cache
false
content-type
application/javascript
a
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/a
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
4d5eccc84d10effc0be83389b864d65b1ab2c137ac51dda69250139d997b0b01

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
date
Mon, 16 Mar 2020 19:23:15 GMT
last-modified
Thu, 12 Sep 2019 22:16:40 GMT
server
nginx/1.14.1
accept-ranges
bytes
content-length
1683
x-server-cache
false
Rackspace_Wordmark_White.png
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/Rackspace_Wordmark_White.png
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
48d72acff1e0c5ac844b84c52fcf052943cae684c3e6cd8df57e3da6e4de54ae

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 19:23:15 GMT
last-modified
Thu, 12 Sep 2019 22:16:40 GMT
server
nginx/1.14.1
x-server-cache
false
content-type
image/png
status
200
accept-ranges
bytes
content-length
24192
blank.gif
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/ 		27 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/blank.gif
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
98408f972e5fec471006936d14908dcd0cf156e193954af65e0a1d38504a9ff1

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 19:23:15 GMT
last-modified
Thu, 12 Sep 2019 22:39:10 GMT
server
nginx/1.14.1
x-server-cache
false
content-type
image/gif
status
200
accept-ranges
bytes
content-length
27536
conversion.js
homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/ 		24 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/conversion.js
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
162.144.22.105 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
162-144-22-105.unifiedlayer.com
Software
nginx/1.14.1 /
Resource Hash
b1992698fd7ad91eaa3d8369020f536c59f5bdc453034edca990222e2997a05c

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
200
date
Mon, 16 Mar 2020 19:23:16 GMT
content-encoding
gzip
last-modified
Thu, 12 Sep 2019 22:16:40 GMT
server
nginx/1.14.1
x-server-cache
false
content-type
application/javascript
/
www.google.de/pagead/1p-user-list/1040066332/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=76...
  • https://www.google.com/pagead/1p-user-list/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=...
  • https://www.google.de/pagead/1p-user-list/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=1...
42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=1&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://apps.rackspace.com/index.php&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=683005874&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 19:23:16 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 19:23:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/1040066332/?random=473559115&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=768&u_w=1366&u_ah=738&u_aw=1366&u_cd=24&u_his=1&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://apps.rackspace.com/index.php&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=683005874&resp=GooglemKTybQhCsO&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Suspicious-Email-Banner.jpg
static.emailsrvr.com/apps_rackspace_com/images/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://static.emailsrvr.com/apps_rackspace_com/images/Suspicious-Email-Banner.jpg
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.175 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/8A90) / ASP.NET
Resource Hash
ee608b4a41a47f8df45dd1d505afb39cb7293e7a33c094b756764a85d67fca47

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Mon, 16 Mar 2020 19:23:17 GMT
last-modified
Fri, 28 Sep 2018 18:18:39 GMT
server
ECAcc (ama/8A90)
age
3583
x-powered-by
ASP.NET
etag
"5b1d4cae5757d41:0"
x-cache
HIT
content-type
image/jpeg
status
200
cache-control
max-age=300
accept-ranges
bytes
content-length
31715
expires
Mon, 16 Mar 2020 19:28:17 GMT
ssllogo.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ 		1023 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
bdad796e4ae503ca04d1227dbdc8e4934802aa9f828b0c81ca7f1588b7b04ade

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Date
Mon, 16 Mar 2020 19:23:15 GMT
ETag
"0ee3cf896d7cb1:0"
Last-Modified
Mon, 28 Feb 2011 22:29:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
no-cache
Accept-Ranges
bytes
Content-Length
1023
/
www.googleadservices.com/pagead/conversion/1040066332/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/1040066332/?random=1584386596309&cv=9&fst=1584386596309&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fhomesofyuma.com%2Frackspaceservershutdownverification%2Fservernotificationloginmessage%2Frackspaceservershutdownverification%2F%3Fe%3D&ref=https%3A%2F%2Fmustbenyce.com%2Fsgf%2Fredir%2F&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&rfmt=3&fmt=4
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/index_files/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s25-in-f2.1e100.net
Software
cafe /
Resource Hash
606567b26cd456477d714e77c3701c1e267876dcd2481339c6cea985b49fd1a8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 19:23:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
1158
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1040066332/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1...
  • https://www.google.com/pagead/1p-user-list/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_h...
  • https://www.google.de/pagead/1p-user-list/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_hi...
42 B
110 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/%3Fe%3D&ref=https://mustbenyce.com/sgf/redir/&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2600779652&resp=GooglemKTybQhCsO&ipr=y
Requested by
Host: homesofyuma.com
URL: https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/?e=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 16 Mar 2020 19:23:16 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 16 Mar 2020 19:23:16 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/1040066332/?random=1437446052&cv=9&fst=*&num=1&value=0&label=gyhyCL7-6AEQnM747wM&bg=666666&hl=en&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https://homesofyuma.com/rackspaceservershutdownverification/servernotificationloginmessage/rackspaceservershutdownverification/%3Fe%3D&ref=https://mustbenyce.com/sgf/redir/&tiba=Rackspace%20Webmail%3A%20Hosted%20Email%20for%20Business&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2600779652&resp=GooglemKTybQhCsO&ipr=y
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rackspace (Online)

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery boolean| _wm_redirect function| onFormSubmit object| Webmail object| $Login object| $TEAEncrypt object| google_conversion_id object| google_conversion_language object| google_conversion_format object| google_conversion_color object| google_conversion_label object| google_conversion_value function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_enable_display_cookie_match object| google_conversion_type object| google_conversion_order_id object| google_conversion_evaluemrc object| google_conversion_currency object| google_conversion_domain object| google_disable_viewthrough object| google_gtag_event_data object| google_remarketing_only object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| google_custom_params object| onload_callback object| opt_image_generator object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_disable_merchant_reported_conversions object| google_additional_conversion_params

0 Cookies