www.h-ga.co
Open in
urlscan Pro
160.153.208.4
Malicious Activity!
Public Scan
Effective URL: https://www.h-ga.co/hga/l_/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=3e7fc130b3297f1317cd59c3b05d159e73cfcd1193f...
Submission: On November 19 via manual from US
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 19th 2019. Valid for: 2 years.
This is the only time www.h-ga.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.123.16 167.89.123.16 | 11377 (SENDGRID) (SENDGRID - SendGrid) | |
1 | 13.89.172.2 13.89.172.2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
2 3 | 160.153.208.4 160.153.208.4 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 | 2606:4700::68... 2606:4700::6811:4004 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
4 | 5 |
ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789123x16.outbound-mail.sendgrid.net
u13045231.ct.sendgrid.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
hga.azurewebsites.net |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-208-4.ip.secureserver.net
www.h-ga.co |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
h-ga.co
2 redirects
www.h-ga.co |
202 KB |
1 |
jsonip.com
jsonip.com |
487 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
73 KB |
1 |
azurewebsites.net
hga.azurewebsites.net |
573 B |
1 |
sendgrid.net
1 redirects
u13045231.ct.sendgrid.net |
280 B |
4 | 5 |
Domain | Requested by | |
---|---|---|
3 | www.h-ga.co | 2 redirects |
1 | jsonip.com |
cdnjs.cloudflare.com
|
1 | cdnjs.cloudflare.com |
www.h-ga.co
|
1 | hga.azurewebsites.net | |
1 | u13045231.ct.sendgrid.net | 1 redirects |
4 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.azurewebsites.net Microsoft IT TLS CA 5 |
2019-09-24 - 2021-09-24 |
2 years | crt.sh |
h-ga.co Go Daddy Secure Certificate Authority - G2 |
2019-11-19 - 2021-11-19 |
2 years | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-10 - 2020-02-16 |
6 months | crt.sh |
jsonip.com Let's Encrypt Authority X3 |
2019-10-22 - 2020-01-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.h-ga.co/hga/l_/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=3e7fc130b3297f1317cd59c3b05d159e73cfcd1193fd18a754a1dcb0932dfa7f9d583412
Frame ID: AD30B203A503D67516CE6052BDC3B912
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://u13045231.ct.sendgrid.net/wf/click?upn=GHZQkgWAH9OeeCLz78hDKQvKcTk8m6YHlaXlD1BtnzstbIl6RYZSkrYeq6TgFQt...
HTTP 302
https://hga.azurewebsites.net/hga.php/?email=ian.sleeper@terracon.com Page URL
-
https://www.h-ga.co/hga?email=ian.sleeper@terracon.com
HTTP 301
https://www.h-ga.co/hga/?email=ian.sleeper@terracon.com HTTP 303
https://www.h-ga.co/hga/l_/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=3e7fc130b3297f1317cd59c... Page URL
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://u13045231.ct.sendgrid.net/wf/click?upn=GHZQkgWAH9OeeCLz78hDKQvKcTk8m6YHlaXlD1BtnzstbIl6RYZSkrYeq6TgFQtoZQPTjPxeaizBVKiy7F7rOuJGvtthyihS-2B4L4NKJ97UI-3D_sKdCrhV1CYFErsxLMpiCh2Ytd1jDcnZtJqXe8oCGFg-2Bioe8tF4XSJLKPJurfcd4gAou9r9lw7wxg-2FaWA5DOo0y2zsZHwDLNnB4hnfeFhs5pNlSRiM-2B3bkIyFIHiaMpz3zsP4fK45AwXLQOHyebPTQjZ7cL7Apcc2FyMkXq-2FmjuNs9XLeOBvg4vjqH0UnO6voCyMjirSAV2I3Hy911dq5fWuwXqRNJ-2FAfcSjJRdCgojM-3D
HTTP 302
https://hga.azurewebsites.net/hga.php/?email=ian.sleeper@terracon.com Page URL
-
https://www.h-ga.co/hga?email=ian.sleeper@terracon.com
HTTP 301
https://www.h-ga.co/hga/?email=ian.sleeper@terracon.com HTTP 303
https://www.h-ga.co/hga/l_/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=3e7fc130b3297f1317cd59c3b05d159e73cfcd1193fd18a754a1dcb0932dfa7f9d583412 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://u13045231.ct.sendgrid.net/wf/click?upn=GHZQkgWAH9OeeCLz78hDKQvKcTk8m6YHlaXlD1BtnzstbIl6RYZSkrYeq6TgFQtoZQPTjPxeaizBVKiy7F7rOuJGvtthyihS-2B4L4NKJ97UI-3D_sKdCrhV1CYFErsxLMpiCh2Ytd1jDcnZtJqXe8oCGFg-2Bioe8tF4XSJLKPJurfcd4gAou9r9lw7wxg-2FaWA5DOo0y2zsZHwDLNnB4hnfeFhs5pNlSRiM-2B3bkIyFIHiaMpz3zsP4fK45AwXLQOHyebPTQjZ7cL7Apcc2FyMkXq-2FmjuNs9XLeOBvg4vjqH0UnO6voCyMjirSAV2I3Hy911dq5fWuwXqRNJ-2FAfcSjJRdCgojM-3D HTTP 302
- https://hga.azurewebsites.net/hga.php/?email=ian.sleeper@terracon.com
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
/
hga.azurewebsites.net/hga.php/ Redirect Chain
|
3 B 573 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.h-ga.co/hga/l_/ Redirect Chain
|
277 KB 202 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ |
257 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
182 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
jsonip.com/ |
186 B 487 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
11 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| getIPAddress string| x2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.h-ga.co/ | Name: PHPSESSID Value: 5989cda7ed6c9a46cc5aef8c5799e04f |
|
www.h-ga.co/hga/l_ | Name: ip11 Value: 2a01:4f8:192:5414::2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
hga.azurewebsites.net
jsonip.com
u13045231.ct.sendgrid.net
www.h-ga.co
13.89.172.2
160.153.208.4
167.89.123.16
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6811:4004
255bd88d21d5efee79c0a949437fa6a5f0c710437179693568227267d656062a
256b74b07cc915464bfba81546e43c839763b5788ca640f609c12a6b5bfbc3da
2da6805ba3fd0f995c3bbb0a7606116cddd0159e9fd50b1ded56d04feb80829c
8a1f096922b323cf6a828553ded12f22340f8c1173cd4b68220c14b0c185efc6
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
9b1efbf979c2e196f35cafda86878797b61d7856f38b1f25d64e48bb68b8fdda
b3934751383895e115fea3f9949b65ec669fd20fad872eaa99f05d878c3d4c8e
c1ec925975fb9229da035db7079b0799a1682067e8cce42fb31128d1476d2912