![](/screenshots/3fd085ea-7931-4adc-af59-0a6fd8f16c31.png)
araucoargentina.net
Open in
urlscan Pro
185.156.173.147
Malicious Activity!
Public Scan
Effective URL: https://araucoargentina.net/netease/redirect/3vjrwaxudpliklfau2ad0dww.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642...
Submission: On June 23 via manual from IN
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 21st 2019. Valid for: 3 months.
This is the only time araucoargentina.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 166.62.10.183 166.62.10.183 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 4 | 185.156.173.147 185.156.173.147 | 9009 (M247) (M247) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 163.166.156.201 163.166.156.201 | 15914 () () | |
1 | 104.111.238.75 104.111.238.75 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
5 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-10-183.ip.secureserver.net
reliancefresh.co |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-238-75.deploy.static.akamaitechnologies.com
www.britishairways.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
araucoargentina.net
1 redirects
araucoargentina.net |
234 KB |
1 |
britishairways.com
www.britishairways.com |
849 B |
1 |
ba.com
1 redirects
ba.com |
526 B |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
reliancefresh.co
1 redirects
reliancefresh.co |
268 B |
5 | 5 |
Domain | Requested by | |
---|---|---|
4 | araucoargentina.net |
1 redirects
araucoargentina.net
|
1 | www.britishairways.com |
araucoargentina.net
|
1 | ba.com | 1 redirects |
1 | ajax.googleapis.com |
araucoargentina.net
|
1 | reliancefresh.co | 1 redirects |
5 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
araucoargentina.net cPanel, Inc. Certification Authority |
2019-06-21 - 2019-09-19 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-06-11 - 2019-09-03 |
3 months | crt.sh |
www.britishairways.com GlobalSign Extended Validation CA - SHA256 - G3 |
2018-07-30 - 2019-09-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://araucoargentina.net/netease/redirect/3vjrwaxudpliklfau2ad0dww.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=%20YmFlQGJhLmNvbQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 4E9DE7381F1979B527B53B25A95DD9B3
Requests: 5 HTTP requests in this frame
Screenshot
![](/screenshots/3fd085ea-7931-4adc-af59-0a6fd8f16c31.png)
Page URL History Show full URLs
-
https://reliancefresh.co/wp-admin/css/?usrid=%20YmFlQGJhLmNvbQ==
HTTP 302
https://araucoargentina.net/netease/redirect/?subemail=&email=%20YmFlQGJhLmNvbQ== HTTP 302
https://araucoargentina.net/netease/redirect/3vjrwaxudpliklfau2ad0dww.php?rand=13InboxLightaspxn.1774256... Page URL
Detected technologies
![](/vendor/wappa/icons/Pure CSS.png)
Detected patterns
- html /<link[^>]+(?:([\d.])+\/)?pure(?:-min)?\.css/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://reliancefresh.co/wp-admin/css/?usrid=%20YmFlQGJhLmNvbQ==
HTTP 302
https://araucoargentina.net/netease/redirect/?subemail=&email=%20YmFlQGJhLmNvbQ== HTTP 302
https://araucoargentina.net/netease/redirect/3vjrwaxudpliklfau2ad0dww.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=%20YmFlQGJhLmNvbQ==&subemail=&radiobtn=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- http://ba.com/favicon.ico HTTP 301
- https://www.britishairways.com/favicon.ico
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
3vjrwaxudpliklfau2ad0dww.php
araucoargentina.net/netease/redirect/ Redirect Chain
|
6 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
grids-responsive-min.css
araucoargentina.net/netease/redirect/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoo-main.css
araucoargentina.net/netease/redirect/css/ |
226 KB 227 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.britishairways.com/ Redirect Chain
|
1 KB 849 B |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| count1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
araucoargentina.net/ | Name: PHPSESSID Value: 2ebi6rhs764hlsfq0n0dpvbks6 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
araucoargentina.net
ba.com
reliancefresh.co
www.britishairways.com
104.111.238.75
163.166.156.201
166.62.10.183
185.156.173.147
2a00:1450:4001:81d::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
41647db72064ad975a25396c8b33f94f864e304bb4d866527462b6292a196e89
ac5798a68b801285b182befab85b032ea7834743e3dbefa36e78912087dd5894
d48434a2020a93155c82f615d93a5af2f4c7bf494dd4353532bf7c158dd25ce5