urlscan.io logo urlscan.io
SecurityTrails logo

lfs.edu.pk Open in urlscan Pro
162.219.248.153  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Submission: On August 22 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 162.219.248.153, located in Los Angeles, United States and belongs to IHNET - IHNetworks, LLC, US. The main domain is lfs.edu.pk.
This is the only time lfs.edu.pk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
5 162.219.248.153 33494 (IHNET)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
7 2
Apex Domain
Subdomains		 Transfer
5 lfs.edu.pk
lfs.edu.pk
101 KB
2 gfx.ms
auth.gfx.ms
416 B
7 2
Domain Requested by
5 lfs.edu.pk lfs.edu.pk
2 auth.gfx.ms lfs.edu.pk
7 2

This site contains links to these domains. Also see Links.

Domain
account.live.com
login.live.com
Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh
msagfx.live.com
Microsoft IT TLS CA 2		 2019-06-13 -
2021-06-13		 2 years crt.sh

This page contains 2 frames:

Primary Page: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Frame ID: 32ED33D5287CA2FF7BA127D3A06CBF72
Requests: 6 HTTP requests in this frame

Frame: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/prefetch.html
Frame ID: 508CB3C9C6125A69425D023830843DE1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

29 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

101 kB
Transfer

99 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set verification.php
lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/ 		10 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Server
162.219.248.153 Los Angeles, United States, ASN33494 (IHNET - IHNetworks, LLC, US),
Reverse DNS
mail153.brewers.unisonplatform.com
Software
Apache /
Resource Hash
2558ad9f798025d5031e64884415493d46f29d5ffaafac8db7b77fb6ce53dc8b
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;

Request headers

Host
lfs.edu.pk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 22 Aug 2019 09:40:04 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=9lab1lo43cvf4i853rqv6rgmr3; path=/
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Keep-Alive
timeout=5, max=10000
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Converged1033.css
lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/ 		85 KB
85 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/Converged1033.css
Requested by
Host: lfs.edu.pk
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Security
, ,
Server
162.219.248.153 Los Angeles, United States, ASN33494 (IHNET - IHNetworks, LLC, US),
Reverse DNS
mail153.brewers.unisonplatform.com
Software
Apache /
Resource Hash
0df34b37d2d23a2a5056ac368248444c36789c9f71b7e15c13e056b722f335ff
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;

Request headers

Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 22 Aug 2019 09:40:04 GMT
Last-Modified
Tue, 29 Aug 2017 14:33:54 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=9999
Content-Length
86974
microsoft_logo.svg
lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/microsoft_logo.svg
Requested by
Host: lfs.edu.pk
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Security
, ,
Server
162.219.248.153 Los Angeles, United States, ASN33494 (IHNET - IHNetworks, LLC, US),
Reverse DNS
mail153.brewers.unisonplatform.com
Software
Apache /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;

Request headers

Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 22 Aug 2019 09:40:04 GMT
Last-Modified
Tue, 29 Aug 2017 14:33:54 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=10000
Content-Length
3651
picker_account_msa.svg
lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/ 		379 B
692 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/picker_account_msa.svg
Requested by
Host: lfs.edu.pk
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Security
, ,
Server
162.219.248.153 Los Angeles, United States, ASN33494 (IHNET - IHNetworks, LLC, US),
Reverse DNS
mail153.brewers.unisonplatform.com
Software
Apache /
Resource Hash
34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;

Request headers

Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Thu, 22 Aug 2019 09:40:04 GMT
Last-Modified
Tue, 29 Aug 2017 14:33:54 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=10000
Content-Length
379
prefetch.html
lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/ Frame 508C 		315 B
582 B 		Document
General
Check archive.org
Download Go to
Full URL
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/files/prefetch.html
Requested by
Host: lfs.edu.pk
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Server
162.219.248.153 Los Angeles, United States, ASN33494 (IHNET - IHNetworks, LLC, US),
Reverse DNS
mail153.brewers.unisonplatform.com
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;

Request headers

Host
lfs.edu.pk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Accept-Encoding
gzip, deflate
Cookie
PHPSESSID=9lab1lo43cvf4i853rqv6rgmr3
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php

Response headers

Date
Thu, 22 Aug 2019 09:40:05 GMT
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Length
315
Keep-Alive
timeout=5, max=9998
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
0-small.jpg
auth.gfx.ms/16.000.27457.4/images/Backgrounds/ 		0
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auth.gfx.ms/16.000.27457.4/images/Backgrounds/0-small.jpg?x=12f4b8b543125cc986c79cd85320812f
Requested by
Host: lfs.edu.pk
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:29f::34ef , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 22 Aug 2019 09:39:32 GMT
PPServer
PPV: 30 H: BL2IDSPRTS1A001 V: 0
Connection
keep-alive
Content-Length
0
Server
Microsoft-IIS/8.5
0.jpg
auth.gfx.ms/16.000.27457.4/images/Backgrounds/ 		0
208 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://auth.gfx.ms/16.000.27457.4/images/Backgrounds/0.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5
Requested by
Host: lfs.edu.pk
URL: http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:29f::34ef , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
Microsoft-IIS/8.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://lfs.edu.pk/css/wp-includes/wp-config/po-admin/proposal/verification.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 22 Aug 2019 09:39:32 GMT
PPServer
PPV: 30 H: BL2IDSPRTS1A003 V: 0
Connection
keep-alive
Content-Length
0
Server
Microsoft-IIS/8.5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| empty

1 Cookies

Domain/Path Name / Value
lfs.edu.pk/ Name: PHPSESSID
Value: 9lab1lo43cvf4i853rqv6rgmr3

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000; includeSubdomains;