stop-report9.usa.cc Open in urlscan Pro
80.211.241.27 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Submission: On August 31 via automatic, source phishtank (August 31st 2018, 8:32:46 am UTC)

Summary HTTP 14 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 14 HTTP transactions. The main IP is 80.211.241.27, located in Arezzo, Italy and belongs to ARUBA, PL. The main domain is stop-report9.usa.cc.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 28th 2018. Valid for: 3 months.

This is the only time stop-report9.usa.cc was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
3	80.211.241.27 80.211.241.27	205727 (ARUBA) (ARUBA)
7	178.128.202.129 178.128.202.129	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1	104.20.209.21 104.20.209.21	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2a01:c9c0:b3:... 2a01:c9c0:b3:3000::10	24600 (WANADOOPO...) (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique)
14	5

3 80.211.241.27 (Arezzo, Italy)

ASN205727 (ARUBA, PL)
PTR: host27-241-211-80.static.arubacloud.pl

stop-report9.usa.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 178.128.202.129 (Greece)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

brand-orange-msdn.netlify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.20.209.21 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

pastebin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a01:c9c0:b3:3000::10 (France)

ASN24600 (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique, FR)

c.woopic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	netlify.com brand-orange-msdn.netlify.com	102 KB
3	woopic.com c.woopic.com	100 KB
3	usa.cc stop-report9.usa.cc	27 KB
1	pastebin.com pastebin.com	8 KB
14	4

	Domain	Requested by
7	brand-orange-msdn.netlify.com	stop-report9.usa.cc
3	c.woopic.com	stop-report9.usa.cc
3	stop-report9.usa.cc	stop-report9.usa.cc
1	pastebin.com	stop-report9.usa.cc
14	4

This site contains links to these domains. Also see Links.

Domain
boutique.orange.fr

Subject Issuer	Validity	Valid
stop-report9.usa.cc cPanel, Inc. Certification Authority	`2018-08-28` - `2018-11-26`	3 months	crt.sh
*.netlify.com AlphaSSL CA - SHA256 - G2	`2016-11-23` - `2018-11-24`	2 years	crt.sh
ssl509085.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-04-27` - `2018-11-03`	6 months	crt.sh
images.orangepublicite.fr DigiCert SHA2 Secure Server CA	`2018-05-23` - `2019-07-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Frame ID: D23748BDB8597E2C3C18D656F39E562C
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

14
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

236 kB
Transfer

548 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://boutique.orange.fr/
Title: Boutique en ligne

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set auth_user.php Show response
stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/ 19 KB
19 KB 239ms
183ms Document
text/html 80.211.241.27
ARUBA

General

Check archive.org

Show headers Download Go to

Full URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.211.241.27 Arezzo, Italy, ASN205727 (ARUBA, PL),
Reverse DNS: host27-241-211-80.static.arubacloud.pl
Software: Apache /
Resource Hash: 153c96071783fa64a2b410582534f669a8d57ea6df152542111b60758c4e3987

Request headers

Host: stop-report9.usa.cc
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: D23748BDB8597E2C3C18D656F39E562C

Response headers

Date: Fri, 31 Aug 2018 08:32:34 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=qoi0da1v0429hj38rqbum85n60; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
S 200 bundle.min.css
brand-orange-msdn.netlify.com/css/ 190 KB
25 KB 71ms
9ms Stylesheet
text/css 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://brand-orange-msdn.netlify.com/css/bundle.min.css

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

8b47a3fc914bdd1c5977ebfaa87b9c81338013dabbbb40064a63c8ff7d9ce595

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246674
date: Fri, 24 Aug 2018 18:39:30 GMT
content-encoding: gzip
server: Netlify
age: 568386
etag: "f77e32912c6a478526b75c653039e5a2-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 25916

GET
H/1.1 200
OK common.css
stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/ 5 KB
5 KB 46ms
25ms Stylesheet
text/css 80.211.241.27
ARUBA

General

Check archive.org

Show headers Download Go to

Full URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/common.css
Requested by: Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.211.241.27 Arezzo, Italy, ASN205727 (ARUBA, PL),
Reverse DNS: host27-241-211-80.static.arubacloud.pl
Software: Apache /
Resource Hash: caae8936ce872be3cfa3970ec119f7e7d174714d18282dde20761c535e8b5956

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: stop-report9.usa.cc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Cookie: PHPSESSID=qoi0da1v0429hj38rqbum85n60
Connection: keep-alive
Cache-Control: no-cache
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 31 Aug 2018 08:32:34 GMT
Last-Modified: Sun, 22 Apr 2018 16:21:18 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 5356

GET
S 200 o_polaris3_responsive.css
brand-orange-msdn.netlify.com/css/ 72 KB
8 KB 73ms
12ms Stylesheet
text/css 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://brand-orange-msdn.netlify.com/css/o_polaris3_responsive.css

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

ca9e0655407a4a1f5fd70937be20b1c0d30dd2d51cb8d7ea3f9237e9f0fcf7d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246676
date: Fri, 24 Aug 2018 18:39:31 GMT
content-encoding: gzip
server: Netlify
age: 568386
etag: "1c0a7aa5f3a8096fbd7b43f69cedea50-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 7810

GET
S 200 o_completion.css
brand-orange-msdn.netlify.com/css/ 19 KB
5 KB 67ms
6ms Stylesheet
text/css 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://brand-orange-msdn.netlify.com/css/o_completion.css

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

1908fecca72c4be06b8e7625338ea58f10c2b4b6287a787eca16c79e9cad4a6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246675
date: Fri, 24 Aug 2018 18:39:31 GMT
content-encoding: gzip
server: Netlify
age: 568386
etag: "472cca7592046877c989f2fb11490d10-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 4849

GET
S 200 logo-orange.png
brand-orange-msdn.netlify.com/img/ 4 KB
4 KB 7ms
6ms Image
image/png 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://brand-orange-msdn.netlify.com/img/logo-orange.png

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

d6fef7e7ca8cc4515aeb82d474c6c4b78265636f8b0d1f39ad93e94775a7945b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246679
date: Fri, 24 Aug 2018 18:39:32 GMT
server: Netlify
age: 568385
etag: "a883f93393cf4367bdc7d3c91cdb159e-ssl"
strict-transport-security: max-age=31536000
content-type: image/png
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 4112

GET
S 200 jquery.min.js Show response
brand-orange-msdn.netlify.com/js/ 85 KB
30 KB 53ms
14ms Script
application/javascript 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://brand-orange-msdn.netlify.com/js/jquery.min.js

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246677
date: Fri, 24 Aug 2018 18:39:30 GMT
content-encoding: gzip
server: Netlify
age: 568386
etag: "40d5f29aaf9987cd6cc2e647a2972a5e-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 30138

GET
S 200 js.cookie.min.js Show response
brand-orange-msdn.netlify.com/js/ 2 KB
1 KB 10ms
10ms Script
application/javascript 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL

https://brand-orange-msdn.netlify.com/js/js.cookie.min.js

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

8b7fe7b684bccdc8719514b506dadf04a16effad37d64845505c0cfba3880e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246678
date: Fri, 24 Aug 2018 18:39:31 GMT
content-encoding: gzip
server: Netlify
age: 568385
etag: "3735dadb6fae63968c9c15c30c754789-ssl-df"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1107

GET
S 200 n4v47Z9C Show response
pastebin.com/raw/ 22 KB
8 KB 33ms
10ms Script
text/plain 104.20.209.21
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://pastebin.com/raw/n4v47Z9C

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7093178f98ddf66d9f25f81ebf04b9e9ebdb18968718b704677231e2ee911a12

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 31 Aug 2018 08:32:36 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: public, max-age=1801
cf-ray: 452e25c2c9c22684-FRA
x-xss-protection: 1; mode=block
expires: Fri, 31 Aug 2018 09:02:37 GMT

GET
S 200 om_desktop.png
brand-orange-msdn.netlify.com/img/ 29 KB
29 KB 7ms
7ms Image
image/png 178.128.202.129
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://brand-orange-msdn.netlify.com/img/om_desktop.png

Requested by

Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.128.202.129 , Greece, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),

Reverse DNS

Software

Netlify /

Resource Hash

8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://brand-orange-msdn.netlify.com/css/bundle.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-nf-request-id: cb530afc-71a6-4805-ad3a-f5796232bd12-19246681
date: Fri, 24 Aug 2018 18:39:31 GMT
server: Netlify
age: 568385
etag: "a94e880eb5afd0fd0aec3bfbea2a992a-ssl"
strict-transport-security: max-age=31536000
content-type: image/png
status: 200
cache-control: public, max-age=0, must-revalidate
accept-ranges: bytes
content-length: 29367

GET
DATA 200
OK truncated
/ 827 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b387921b67f963606c15fb9ebe72a0a1990d6fb4597249d93b703931098fb4d

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 365 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 456032d05c388ac512b6fd8f4a752655a0e12f565767716dcbe2a5ad80a01221

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/svg+xml

GET
H/1.1 200
OK o-icomoon.woff
c.woopic.com/Magic/ 25 KB
25 KB 142ms
31ms Font
application/font-woff 2a01:c9c0:b3:3000::10
WANADOOPORTAILS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.woopic.com/Magic/o-icomoon.woff?1xeygc
Requested by: Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a01:c9c0:b3:3000::10 , France, ASN24600 (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique, FR),
Reverse DNS
Software: nginx /
Resource Hash: f5cb447500abc035bbbf95e6e1625adebee42409b0533ba80e12ca83f8d3dcbe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/common.css
Origin: https://stop-report9.usa.cc

Response headers

Date: Fri, 31 Aug 2018 08:32:36 GMT
X-Mid: pr004b
Last-Modified: Thu, 09 Nov 2017 09:25:11 GMT
Server: nginx
Age: 43
X-Cache: HIT
Content-Type: application/font-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25164

GET
H/1.1 200
OK HelvNeue75_W1G.woff2
c.woopic.com/fonts/ 37 KB
37 KB 152ms
36ms Font
application/octet-stream 2a01:c9c0:b3:3000::10
WANADOOPORTAILS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.woopic.com/fonts/HelvNeue75_W1G.woff2
Requested by: Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a01:c9c0:b3:3000::10 , France, ASN24600 (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique, FR),
Reverse DNS
Software: nginx /
Resource Hash: db8adbb2540762202edc492ec31b16e6849fc6d8b9f1656fd4b09d813e43f038

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/common.css
Origin: https://stop-report9.usa.cc

Response headers

Date: Fri, 31 Aug 2018 08:32:36 GMT
X-Mid: pr001b
Last-Modified: Thu, 19 Nov 2015 10:56:28 GMT
Server: nginx
Age: 2
X-Cache: HIT
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37996

GET
H/1.1 200
OK boosted.ttf
stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/fonts/ 2 KB
2 KB 25ms
25ms Font
font/ttf 80.211.241.27
ARUBA

General

Check archive.org

Show headers Download Go to

Full URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/fonts/boosted.ttf
Requested by: Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.211.241.27 Arezzo, Italy, ASN205727 (ARUBA, PL),
Reverse DNS: host27-241-211-80.static.arubacloud.pl
Software: Apache /
Resource Hash: 59dad4513edf661a2d7873cc43e4c1753a2d769f7e87b076f5bc2f5299a56963

Request headers

Pragma: no-cache
Origin: https://stop-report9.usa.cc
Accept-Encoding: gzip, deflate
Host: stop-report9.usa.cc
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/common.css
Cookie: PHPSESSID=qoi0da1v0429hj38rqbum85n60
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/common.css
Origin: https://stop-report9.usa.cc

Response headers

Date: Fri, 31 Aug 2018 08:32:34 GMT
Last-Modified: Tue, 17 Apr 2018 22:03:12 GMT
Server: Apache
Content-Type: font/ttf
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1676

GET
H/1.1 200
OK HelvNeue55_W1G.woff2
c.woopic.com/fonts/ 37 KB
37 KB 157ms
35ms Font
application/octet-stream 2a01:c9c0:b3:3000::10
WANADOOPORTAILS-A...

General

Check archive.org

Show headers Download Go to

Full URL: https://c.woopic.com/fonts/HelvNeue55_W1G.woff2
Requested by: Host: stop-report9.usa.cc
URL: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/auth_user.php?return_url=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a01:c9c0:b3:3000::10 , France, ASN24600 (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique, FR),
Reverse DNS
Software: nginx /
Resource Hash: 39848ebe4a0bdd73f0f2418229fb2a3005d6c6e2ce8efaa4c6dd4d9e7f7afb6f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://stop-report9.usa.cc/service/facture.orange.fr/espace-clients/auth_user/bin/app/views/assets/css/common.css
Origin: https://stop-report9.usa.cc

Response headers

Date: Fri, 31 Aug 2018 08:32:36 GMT
X-Mid: pr002b
Last-Modified: Thu, 19 Nov 2015 10:56:29 GMT
Server: nginx
Age: 7
X-Cache: HIT
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 38000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			stop-report9.usa.cc/	1969-12-31 23:59:59	Name: PHPSESSID Value: qoi0da1v0429hj38rqbum85n60

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

brand-orange-msdn.netlify.com
c.woopic.com
pastebin.com
stop-report9.usa.cc
104.20.209.21
178.128.202.129
2a01:c9c0:b3:3000::10
80.211.241.27
153c96071783fa64a2b410582534f669a8d57ea6df152542111b60758c4e3987
1908fecca72c4be06b8e7625338ea58f10c2b4b6287a787eca16c79e9cad4a6f
39848ebe4a0bdd73f0f2418229fb2a3005d6c6e2ce8efaa4c6dd4d9e7f7afb6f
456032d05c388ac512b6fd8f4a752655a0e12f565767716dcbe2a5ad80a01221
59dad4513edf661a2d7873cc43e4c1753a2d769f7e87b076f5bc2f5299a56963
7093178f98ddf66d9f25f81ebf04b9e9ebdb18968718b704677231e2ee911a12
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8b47a3fc914bdd1c5977ebfaa87b9c81338013dabbbb40064a63c8ff7d9ce595
8b7fe7b684bccdc8719514b506dadf04a16effad37d64845505c0cfba3880e81
8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997
9b387921b67f963606c15fb9ebe72a0a1990d6fb4597249d93b703931098fb4d
ca9e0655407a4a1f5fd70937be20b1c0d30dd2d51cb8d7ea3f9237e9f0fcf7d0
caae8936ce872be3cfa3970ec119f7e7d174714d18282dde20761c535e8b5956
d6fef7e7ca8cc4515aeb82d474c6c4b78265636f8b0d1f39ad93e94775a7945b
db8adbb2540762202edc492ec31b16e6849fc6d8b9f1656fd4b09d813e43f038
f5cb447500abc035bbbf95e6e1625adebee42409b0533ba80e12ca83f8d3dcbe

stop-report9.usa.cc Open in urlscan Pro 80.211.241.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

5 IPs

4 Countries

236 kBTransfer

548 kBSize

1 Cookies

1 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

36 JavaScript Global Variables

1 Cookies

Indicators

stop-report9.usa.cc Open in urlscan Pro
80.211.241.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

4
Countries

236 kB
Transfer

548 kB
Size

1
Cookies

14 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!