lakshmipurweb.com Open in urlscan Pro
104.161.77.107 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/?email=alex.lombardi@tollgroup.com
Effective URL:
https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&8...
Submission: On April 23 via manual (April 23rd 2020, 9:19:21 am UTC) from IN

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 104.161.77.107, located in Phoenix, United States and belongs to IOFLOOD, US. The main domain is lakshmipurweb.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on February 25th 2020. Valid for: 3 months.

This is the only time lakshmipurweb.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 13	104.161.77.107 104.161.77.107	53755 (IOFLOOD) (IOFLOOD)
1	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
13	2

13 104.161.77.107 (Phoenix, United States) 1 redirects

ASN53755 (IOFLOOD, US)
PTR: host.whitelabeldnszone.com

lakshmipurweb.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	lakshmipurweb.com 1 redirects lakshmipurweb.com	634 KB
1	google.com www.google.com	1 KB
13	2

	Domain	Requested by
13	lakshmipurweb.com	1 redirects lakshmipurweb.com
1	www.google.com	lakshmipurweb.com
13	2

This site contains no links.

Subject Issuer	Validity	Valid
lakshmipurweb.com cPanel, Inc. Certification Authority	`2020-02-25` - `2020-05-25`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-04-01` - `2020-06-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Frame ID: 887E2EF448AFA36CB7D70C97479B9081
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/?email=alex.lombard... HTTP 302
https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https:/... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

634 kB
Transfer

3829 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/?email=alex.lombardi@tollgroup.com HTTP 302
https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index2.php Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/
Redirect Chain

https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/?email=alex.lombardi@tollgroup.com
https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_ti...

2 KB
820 B

181ms
180ms

Document
text/html

104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 3b840dbb07a8775af88b5ec19b5726664e8292711f3ff20b11be7579ac7c95b3

Request headers

:method: GET
:authority: lakshmipurweb.com
:scheme: https
:path: /wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: PHPSESSID=481ac146d50a01e163510803ddf7da0f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Thu, 23 Apr 2020 09:18:58 GMT

Redirect headers

status: 302
set-cookie: PHPSESSID=481ac146d50a01e163510803ddf7da0f; path=/; secure
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
location: ./index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
content-encoding: gzip
date: Thu, 23 Apr 2020 09:18:58 GMT
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000

GET
H2 200 jquery-3.4.1.min.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 86 KB
29 KB 173ms
173ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/jquery-3.4.1.min.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Origin: https://lakshmipurweb.com

Response headers

date: Thu, 23 Apr 2020 09:18:58 GMT
content-encoding: br
last-modified: Mon, 27 Jan 2020 22:02:14 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 30047
expires: Thu, 30 Apr 2020 09:18:58 GMT

GET
H2 200 alertify.min.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 36 KB
9 KB 314ms
314ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/alertify.min.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: cac708660b650d1f6ae9ea1809199c6a2344e96f345054a7abee8b970bb834b2

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:18:58 GMT
content-encoding: br
last-modified: Mon, 27 Jan 2020 22:02:14 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 9624
expires: Thu, 30 Apr 2020 09:18:58 GMT

GET
H2 200 myscr999749.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 4 MB
582 KB 317ms
316ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr999749.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: cc8ce250923c25c2278ae0fa82a6922cdd1bf4b307de4d9e0deea25fe725d623

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:18:58 GMT
content-encoding: br
last-modified: Mon, 10 Feb 2020 21:12:24 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 595383
expires: Thu, 30 Apr 2020 09:18:58 GMT

GET
H2 200 favicons
www.google.com/s2/ 506 B
1 KB 6144ms
6144ms Image
image/png 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/s2/favicons?domain=//tollgroup.com

Requested by

Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

834ac15cb1221424468ab760e8b4b4a98acaefcbd6ed0b73e01c9122b2fe3b3f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-vSVCP8kLxQrZZ3f6NenbgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-vSVCP8kLxQrZZ3f6NenbgA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:19:06 GMT
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cache-control: private, max-age=86400
content-security-policy: script-src 'report-sample' 'nonce-vSVCP8kLxQrZZ3f6NenbgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-vSVCP8kLxQrZZ3f6NenbgA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
content-type: image/png
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
expires: Thu, 23 Apr 2020 09:19:06 GMT

GET
H2 200 myscr388910.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 1 KB
516 B 423ms
423ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr388910.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: aad3487cbd9935ccee3d46fcb5211c7ed19a6555faa0ab76887163acac58ca13

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:18:58 GMT
content-encoding: br
last-modified: Mon, 10 Feb 2020 21:13:48 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 459
expires: Thu, 30 Apr 2020 09:18:58 GMT

GET
H2 200 myscr910779.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 5 KB
1 KB 219ms
218ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr910779.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 9e473a4a2ba87295738f91a73e3180046737d820f46ce63babe04b44de170edc

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:18:59 GMT
content-encoding: br
last-modified: Mon, 10 Feb 2020 21:15:00 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 1393
expires: Thu, 30 Apr 2020 09:18:59 GMT

GET
H2 200 myscr860171.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 4 KB
1 KB 178ms
178ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr860171.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 38e090e72fca127c1d87439a7e5b44fb56f80efc6668653af7281201818019c7

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:18:59 GMT
content-encoding: br
last-modified: Mon, 10 Feb 2020 21:16:08 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 1024
expires: Thu, 30 Apr 2020 09:18:59 GMT

GET
H2 200 alertify.min.css
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 20 KB
4 KB 239ms
238ms Stylesheet
text/css 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/alertify.min.css
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr999749.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 9e1b2d8030ae64641193ec2fc176483eddbbf1aac7b6e64a275610d2bad788be

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:19:00 GMT
content-encoding: br
last-modified: Mon, 27 Jan 2020 22:02:16 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 3490
expires: Thu, 30 Apr 2020 09:19:00 GMT

GET
H2 200 default.min.css
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 2 KB
648 B 244ms
244ms Stylesheet
text/css 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/default.min.css
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr999749.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 77e5ad291208eaac2cf688eef1d728ff72ba712457ecd0408d2b86d89a2434f3

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:19:00 GMT
content-encoding: br
last-modified: Mon, 27 Jan 2020 22:02:16 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 539
expires: Thu, 30 Apr 2020 09:19:00 GMT

GET
H2 200 email-client-app-logo.png
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/ 3 KB
3 KB 244ms
244ms Image
image/png 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/email-client-app-logo.png
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 6e2c64daf7488c12a49db84794fd237fbeef39a17c7ef1536a291b72f92676c6

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:19:00 GMT
last-modified: Mon, 27 Jan 2020 22:02:16 GMT
content-type: image/png
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 3148
expires: Thu, 30 Apr 2020 09:19:00 GMT

GET
H2 200 login.js Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Resources/ 6 KB
1 KB 175ms
175ms Script
application/javascript 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Resources/login.js
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/myscr860171.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 2d8030e900978ea4b9b0fdc161132918ed75383c7d47e01b2fa057fe54797dbe

Request headers

Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 23 Apr 2020 09:19:00 GMT
content-encoding: br
last-modified: Mon, 10 Feb 2020 21:17:50 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=604800
accept-ranges: bytes
content-length: 1260
expires: Thu, 30 Apr 2020 09:19:00 GMT

POST
H2 200 screen_resolution.php Show response
lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Resources/ 21 B
123 B 178ms
178ms XHR
text/html 104.161.77.107
IOFLOOD

General

Check archive.org

Show headers Download Go to

Full URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Resources/screen_resolution.php
Requested by: Host: lakshmipurweb.com
URL: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/Files/jquery-3.4.1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.161.77.107 Phoenix, United States, ASN53755 (IOFLOOD, US),
Reverse DNS: host.whitelabeldnszone.com
Software: /
Resource Hash: 3863ee0a9a320461c866f2b3b4b746e6acf6251770f062fec4136d31ff1c0f99

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://lakshmipurweb.com/wp-includez/myQsnl/PrivaBluemailasppCstr/PrivatEmAppCstr/index2.php?=https://www.tollgroup.com&88a4a6073275046b49a7ffc54483e4e3&&https://www.tollgroup.com/login/session_timed_outk&token=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL=78347858595&https://www.tollgroup.com/login/session_timed_outtoken=q3c3QhbOHZ3pYngmlbR2sA6nyaAn1ckL&email=alex.lombardi@tollgroup.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 23 Apr 2020 09:19:00 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 200
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lakshmipurweb.com
www.google.com
104.161.77.107
2a00:1450:4001:809::2004
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
2d8030e900978ea4b9b0fdc161132918ed75383c7d47e01b2fa057fe54797dbe
3863ee0a9a320461c866f2b3b4b746e6acf6251770f062fec4136d31ff1c0f99
38e090e72fca127c1d87439a7e5b44fb56f80efc6668653af7281201818019c7
3b840dbb07a8775af88b5ec19b5726664e8292711f3ff20b11be7579ac7c95b3
6e2c64daf7488c12a49db84794fd237fbeef39a17c7ef1536a291b72f92676c6
77e5ad291208eaac2cf688eef1d728ff72ba712457ecd0408d2b86d89a2434f3
834ac15cb1221424468ab760e8b4b4a98acaefcbd6ed0b73e01c9122b2fe3b3f
9e1b2d8030ae64641193ec2fc176483eddbbf1aac7b6e64a275610d2bad788be
9e473a4a2ba87295738f91a73e3180046737d820f46ce63babe04b44de170edc
aad3487cbd9935ccee3d46fcb5211c7ed19a6555faa0ab76887163acac58ca13
cac708660b650d1f6ae9ea1809199c6a2344e96f345054a7abee8b970bb834b2
cc8ce250923c25c2278ae0fa82a6922cdd1bf4b307de4d9e0deea25fe725d623

lakshmipurweb.com Open in urlscan Pro 104.161.77.107 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

634 kBTransfer

3829 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

lakshmipurweb.com Open in urlscan Pro
104.161.77.107 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

634 kB
Transfer

3829 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!