sunshinechildcounseling.com

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 7 HTTP transactions. The main IP is 192.185.168.157, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is sunshinechildcounseling.com.
TLS certificate: Issued by R3 on January 14th 2022. Valid for: 3 months.

This is the only time sunshinechildcounseling.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3030::6815:2251	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	192.185.168.157 192.185.168.157	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	51.210.32.106 51.210.32.106	16276 (OVH) (OVH)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
7	3

1 2606:4700:3030::6815:2251 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

remson.minesod.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.185.168.157 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-168-157.unifiedlayer.com

sunshinechildcounseling.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.210.32.106 (France)

ASN16276 (OVH, FR)
PTR: ns3172579.ip-51-210-32.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	sunshinechildcounseling.com sunshinechildcounseling.com	604 KB
1	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 631	38 KB
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 13303	108 KB
1	workers.dev 1 redirects remson.minesod.workers.dev	558 B
7	4

	Domain	Requested by
5	sunshinechildcounseling.com	sunshinechildcounseling.com
1	ajax.aspnetcdn.com	sunshinechildcounseling.com
1	i.ibb.co	sunshinechildcounseling.com
1	remson.minesod.workers.dev	1 redirects
7	4

This site contains no links.

Subject Issuer	Validity	Valid
www.theresourcefultherapist.net R3	`2022-01-14` - `2022-04-14`	3 months	crt.sh
ibb.co R3	`2022-02-05` - `2022-05-06`	3 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2021-08-06` - `2022-08-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Frame ID: 8FE46A2B14B732AD988B65EB57F5F366
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Excel

Page URL History Show full URLs

https://remson.minesod.workers.dev/ HTTP 301
https://sunshinechildcounseling.com/wp-admin/share/File/Excel/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

751 kB
Transfer

805 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://remson.minesod.workers.dev/ HTTP 301
https://sunshinechildcounseling.com/wp-admin/share/File/Excel/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sunshinechildcounseling.com/wp-admin/share/File/Excel/
Redirect Chain

https://remson.minesod.workers.dev/
https://sunshinechildcounseling.com/wp-admin/share/File/Excel/

13 KB
4 KB

459ms
169ms

Document
text/html

192.185.168.157
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.168.157 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-168-157.unifiedlayer.com
Software: Apache / WP Rocket/3.3.6
Resource Hash: 96137f147e398edfebb4ab53855fb8d59079ed6573737c8641ec71967e6447a5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

vary: Accept-Encoding
accept-ranges: bytes
cache-control: max-age=0, public
expires: Thu, 24 Feb 2022 20:22:13 GMT
content-encoding: gzip
x-powered-by: WP Rocket/3.3.6
content-length: 4340
content-type: text/html; charset=UTF-8
date: Thu, 24 Feb 2022 20:22:13 GMT
server: Apache

Redirect headers

date: Thu, 24 Feb 2022 20:22:13 GMT
content-length: 0
location: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4qsIcqOqrMfNl6eiyutyNE%2FtQS7xt%2FUxfcwo2FLgf4ctLcnFaBCTdG%2FXEl9%2FB7KVz92LKWWWYpQfVxZB%2FTQwm%2Fb7IE7KRC666j089m52F79i2%2BTX%2BxoIjtyfgfNDp7YDaqGsXO%2FU3ogq7r6Jfr66MmdfPcblG9ceHg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 6e2b679dab7190fb-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 ms-logo.svg
sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/ 4 KB
2 KB 432ms
431ms Image
image/svg+xml 192.185.168.157
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/ms-logo.svg
Requested by: Host: sunshinechildcounseling.com
URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.168.157 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-168-157.unifiedlayer.com
Software: Apache /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 20:22:13 GMT
content-encoding: gzip
last-modified: Thu, 24 Feb 2022 15:34:20 GMT
server: Apache
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=2592000, public
accept-ranges: bytes
content-length: 1522
expires: Sat, 26 Mar 2022 20:22:13 GMT

GET
H2 200 art.png
i.ibb.co/vHHpzFg/ 108 KB
108 KB 81ms
31ms Image
image/png 51.210.32.106
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/vHHpzFg/art.png
Requested by: Host: sunshinechildcounseling.com
URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.210.32.106 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3172579.ip-51-210-32.eu
Software: nginx /
Resource Hash: 18113eab97d07cc5b551929d4686581f9d2486bafb312aa1d4d822926162babf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sunshinechildcounseling.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 20:22:13 GMT
last-modified: Wed, 01 Dec 2021 18:08:05 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 110619
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-3.3.1.min.js Show response
ajax.aspnetcdn.com/ajax/jQuery/ 85 KB
38 KB 63ms
16ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js

Requested by

Host: sunshinechildcounseling.com
URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/8E87) /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sunshinechildcounseling.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 20:22:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13115285
x-cache: HIT
content-length: 38892
x-xss-protection: 1; mode=block
last-modified: Mon, 22 Jan 2018 19:27:49 GMT
server: ECAcc (frc/8E87)
etag: "af301a17b793d31:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bg-official.png
sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/ 285 KB
287 KB 150ms
150ms Image
image/png 192.185.168.157
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/bg-official.png
Requested by: Host: sunshinechildcounseling.com
URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.168.157 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-168-157.unifiedlayer.com
Software: Apache /
Resource Hash: f5bd22cc71a14a977c07f4dde3f0ed6c8c13142a14e7df09ca1db6923960609a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 20:22:13 GMT
last-modified: Thu, 24 Feb 2022 15:34:20 GMT
server: Apache
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=10368000, public
accept-ranges: bytes
content-length: 291650
expires: Fri, 24 Jun 2022 20:22:13 GMT

GET
H2 200 SegoeUI-SemiBold.woff2
sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/ 137 KB
138 KB 429ms
429ms Font
font/woff2 192.185.168.157
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/SegoeUI-SemiBold.woff2
Requested by: Host: sunshinechildcounseling.com
URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.168.157 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-168-157.unifiedlayer.com
Software: Apache /
Resource Hash: 52f74604f9a94d72e33bcbfbfbc4691f285218f78121fcd4992d3af113cbc969

Request headers

Referer: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Origin: https://sunshinechildcounseling.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 20:22:13 GMT
content-encoding: gzip
last-modified: Thu, 24 Feb 2022 15:34:20 GMT
server: Apache
vary: Accept-Encoding
content-type: font/woff2
cache-control: max-age=10368000
accept-ranges: bytes
expires: Fri, 24 Jun 2022 20:22:13 GMT

GET
H2 200 SegoeUI.woff2
sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/ 173 KB
174 KB 428ms
428ms Font
font/woff2 192.185.168.157
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/assets/SegoeUI.woff2
Requested by: Host: sunshinechildcounseling.com
URL: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.185.168.157 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-168-157.unifiedlayer.com
Software: Apache /
Resource Hash: d12f59f9c22c26c2a5f9f6addff1706c17df1fc920917356af04726913a66d23

Request headers

Referer: https://sunshinechildcounseling.com/wp-admin/share/File/Excel/
Origin: https://sunshinechildcounseling.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 24 Feb 2022 20:22:13 GMT
content-encoding: gzip
last-modified: Thu, 24 Feb 2022 15:34:20 GMT
server: Apache
vary: Accept-Encoding
content-type: font/woff2
cache-control: max-age=10368000
accept-ranges: bytes
expires: Fri, 24 Jun 2022 20:22:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
i.ibb.co
remson.minesod.workers.dev
sunshinechildcounseling.com
152.199.19.160
192.185.168.157
2606:4700:3030::6815:2251
51.210.32.106
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
18113eab97d07cc5b551929d4686581f9d2486bafb312aa1d4d822926162babf
52f74604f9a94d72e33bcbfbfbc4691f285218f78121fcd4992d3af113cbc969
96137f147e398edfebb4ab53855fb8d59079ed6573737c8641ec71967e6447a5
d12f59f9c22c26c2a5f9f6addff1706c17df1fc920917356af04726913a66d23
f5bd22cc71a14a977c07f4dde3f0ed6c8c13142a14e7df09ca1db6923960609a

sunshinechildcounseling.com Open in urlscan Pro 192.185.168.157 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

751 kBTransfer

805 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

sunshinechildcounseling.com Open in urlscan Pro
192.185.168.157 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

751 kB
Transfer

805 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!