premierforestry.net
Open in
urlscan Pro
173.254.28.38
Malicious Activity!
Public Scan
Submission Tags: 7505072
Submission: On May 03 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on March 11th 2022. Valid for: 3 months.
This is the only time premierforestry.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 173.254.28.38 173.254.28.38 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
7 | 66.29.132.91 66.29.132.91 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80c::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 2607:f8b0:400... 2607:f8b0:4006:817::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.139.128.11 151.139.128.11 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
15 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: just38.justhost.com
premierforestry.net |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium201-1.web-hosting.com
theautodiary.com |
ASN15169 (GOOGLE, US)
fonts.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
theautodiary.com
theautodiary.com |
135 KB |
5 |
gstatic.com
fonts.gstatic.com |
78 KB |
1 |
imageshack.com
imagizer.imageshack.com — Cisco Umbrella Rank: 53067 |
128 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 39 |
1 KB |
1 |
premierforestry.net
premierforestry.net |
425 B |
15 | 5 |
Domain | Requested by | |
---|---|---|
7 | theautodiary.com |
premierforestry.net
theautodiary.com |
5 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | imagizer.imageshack.com | |
1 | fonts.googleapis.com |
theautodiary.com
|
1 | premierforestry.net | |
15 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cpcontacts.premierforestry.net R3 |
2022-03-11 - 2022-06-09 |
3 months | crt.sh |
theautodiary.com Sectigo RSA Domain Validation Secure Server CA |
2022-01-11 - 2023-01-11 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
*.imageshack.com Go Daddy Secure Certificate Authority - G2 |
2022-02-05 - 2023-03-09 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://premierforestry.net/MnkzdzRxNG4wRjh6OGI=
Frame ID: 027060F04530EDC1684F09C3B6A04090
Requests: 1 HTTP requests in this frame
Frame:
https://theautodiary.com/wp-template/2y3w4q4n0F8z8b
Frame ID: F30D926F0C6C1C496E5CD73FFF25290E
Requests: 14 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
MnkzdzRxNG4wRjh6OGI=
premierforestry.net/ |
509 B 425 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2y3w4q4n0F8z8b
theautodiary.com/wp-template/ Frame F30D |
618 B 404 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.af14985d.js
theautodiary.com/wp-template/assets/ Frame F30D |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.c38bb308.js
theautodiary.com/wp-template/assets/ Frame F30D |
169 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor.f8222683.css
theautodiary.com/wp-template/assets/ Frame F30D |
50 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.1cf364e2.css
theautodiary.com/wp-template/assets/ Frame F30D |
487 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfontloader.cd097671.js
theautodiary.com/wp-template/assets/ Frame F30D |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
config.php
theautodiary.com/wp-template/ Frame F30D |
221 B 350 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame F30D |
13 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F30D |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F30D |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F30D |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F30D |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame F30D |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vMdZIr.png
imagizer.imageshack.com/img924/8093/ Frame F30D |
127 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
imagizer.imageshack.com
premierforestry.net
theautodiary.com
151.139.128.11
173.254.28.38
2607:f8b0:4006:80c::200a
2607:f8b0:4006:817::2003
66.29.132.91
02b8aea61f1a21b32049f62c6c5c9f6d9c6947417d9db23417362ba62854885d
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
16ece016c3944690d833f3cfc8b000bb025d27c1dc6ee5944b7a001c6a4f8573
22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
49429fd2ababdecb02baf0718448a83dd6a18993781489def1bbcc4192d13460
6f0edf73fe0251f54b90c42316016a085e4bac32a40c30ed4dc24f3997bd4698
93be2861d02e3f2021a77203bd5c853de8db2f97602f6f5f830d15088c21440b
9e14734d8de60b0274ec30a7f72eb1a5353cb4f93e2db8db8b7b3a0d1a954bdd
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
c8029e21281badd67f73344314230840445854ee5cbd90a05857d9bea4932d56
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d571e599b4bfb07708c9c2fdc1a352978a4944dfc0b1e9d47b6f9d325fe3fb9f
de81c770c4c7d45f03a4a6515c523d7b214ce29695d810c06fb641fce4a16f99
ff420b26b8a33e1bcae39c4d165c2cc259681bbb7b32565dbd7644c1d84cbfa8