bestofferpalace.com
Open in
urlscan Pro
162.0.219.209
Malicious Activity!
Public Scan
Submission: On April 14 via manual from US
Summary
TLS certificate: Issued by R3 on April 14th 2021. Valid for: 3 months.
This is the only time bestofferpalace.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: GoDaddy (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.0.219.209 162.0.219.209 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
4 | 2.16.186.248 2.16.186.248 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2.16.186.121 2.16.186.121 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
7 | 3 |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-248.deploy.static.akamaitechnologies.com
img6.wsimg.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-121.deploy.static.akamaitechnologies.com
img6.wsimg.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
wsimg.com
img6.wsimg.com |
144 KB |
1 |
bestofferpalace.com
bestofferpalace.com |
49 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
6 | img6.wsimg.com |
bestofferpalace.com
|
1 | bestofferpalace.com | |
7 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.godaddy.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
bestofferpalace.com R3 |
2021-04-14 - 2021-07-13 |
3 months | crt.sh |
*.wsimg.com Starfield Secure Certificate Authority - G2 |
2021-03-05 - 2022-04-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bestofferpalace.com/user/gd/Sign_In.php
Frame ID: 86C6821A6CECABDF8B14F71B65731744
Requests: 7 HTTP requests in this frame
5 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Phone numbers and hours
Search URL Search Domain Scan URL
Title: Get Help
Search URL Search Domain Scan URL
Title: GoDaddy Logo
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Sign_In.php
bestofferpalace.com/user/gd/ |
48 KB 49 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uxfont.woff2
img6.wsimg.com/ux/fonts/uxfont/2.0/ |
12 KB 12 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gd-sage-bold.woff2
img6.wsimg.com/ux/fonts/gd-sage/1.0/ |
39 KB 39 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gdsherpa-bold.woff2
img6.wsimg.com/ux/fonts/sherpa/1.1/ |
27 KB 28 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gdsherpa-regular.woff2
img6.wsimg.com/ux/fonts/sherpa/1.1/ |
28 KB 28 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
uxcore2.min.css
img6.wsimg.com/wrhs/e8aa971f8cac4807b5896b8447b26991/ |
216 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utilityheader.min.css
img6.wsimg.com/wrhs/62e4ff4de457b3c6bbbe60eeed18b1b4/ |
73 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: GoDaddy (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| togglePassword0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bestofferpalace.com
img6.wsimg.com
162.0.219.209
2.16.186.121
2.16.186.248
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
5a51d246af54d903f67f07f2bd820ce77736f8d08c5f1602db07469d96dbf77f
87c0f2934654d71243acb7e4fe45c610dc93eef0ccf6e1d5de01c1ef7f06daf5
89e3135e8430b71c9470eebafc1bb498233cdde661240a03d3e864fb59a890be
d73fdf294291e1ccc1bca7a65fe7023f63004b1ff5939637cc5b060dd35ce62b
e1141fc74b9905160cd549863e35aed78d8c8143fd4296c99ddec779a851d74e
f94a4afe87f1705d8caf5693dba18b8330688de3895aea700d62ad9dc610d1f0