![](/screenshots/4246c8a3-35da-4624-81fe-ac729b5d26fa.png)
dragonforwardknife.com
Open in
urlscan Pro
178.128.241.54
Malicious Activity!
Public Scan
Effective URL: https://dragonforwardknife.com/?p=hezdsyjyhe5gi3bpgmztini&sub1=Povey&sub2=bd.v1
Submission: On May 23 via automatic, source openphish
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on May 11th 2020. Valid for: 3 months.
This is the only time dragonforwardknife.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 216.10.250.207 216.10.250.207 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
3 | 162.241.87.103 162.241.87.103 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 162.241.65.79 162.241.65.79 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 178.128.241.54 178.128.241.54 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
14 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-87-103.unifiedlayer.com
stat.trackstatisticsss.com | |
fox.trackstatisticsss.com |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-65-79.unifiedlayer.com
tap.digestcolect.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
trackstatisticsss.com
stat.trackstatisticsss.com fox.trackstatisticsss.com Failed |
2 KB |
3 |
moderncomputersbhopal.com
1 redirects
www.moderncomputersbhopal.com |
21 KB |
2 |
digestcolect.com
tap.digestcolect.com Failed |
1 KB |
1 |
dragonforwardknife.com
dragonforwardknife.com |
25 KB |
14 | 4 |
Domain | Requested by | |
---|---|---|
3 | www.moderncomputersbhopal.com |
1 redirects
www.moderncomputersbhopal.com
|
2 | tap.digestcolect.com |
fox.trackstatisticsss.com
tap.digestcolect.com |
2 | fox.trackstatisticsss.com |
stat.trackstatisticsss.com
fox.trackstatisticsss.com |
1 | dragonforwardknife.com |
tap.digestcolect.com
|
1 | stat.trackstatisticsss.com |
www.moderncomputersbhopal.com
|
14 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
stat.trackstatisticsss.com Let's Encrypt Authority X3 |
2020-04-24 - 2020-07-23 |
3 months | crt.sh |
fox.trackstatisticsss.com Let's Encrypt Authority X3 |
2020-05-05 - 2020-08-03 |
3 months | crt.sh |
tap.digestcolect.com Let's Encrypt Authority X3 |
2020-05-11 - 2020-08-09 |
3 months | crt.sh |
dragonforwardknife.com Let's Encrypt Authority X3 |
2020-05-11 - 2020-08-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://dragonforwardknife.com/?p=hezdsyjyhe5gi3bpgmztini&sub1=Povey&sub2=bd.v1
Frame ID: 518C71ACE99D9BE1D6BAACBB951BE1BC
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/4246c8a3-35da-4624-81fe-ac729b5d26fa.png)
Page URL History Show full URLs
-
http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin?amp;local...
HTTP 301
http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin/?amp;loca... Page URL
- https://fox.trackstatisticsss.com/?id=3456679323 Page URL
- https://fox.trackstatisticsss.com/go.html?id=476876214&pid=54645747&did=tu473465 Page URL
- https://tap.digestcolect.com/r.php?id=0 Page URL
- https://tap.digestcolect.com/r.php?id=sggfjer&f=sggfjer Page URL
- https://dragonforwardknife.com/?p=hezdsyjyhe5gi3bpgmztini&sub1=Povey&sub2=bd.v1 Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin?amp;locale.x=en_AT&country.x=AT
HTTP 301
http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin/?amp;locale.x=en_AT&country.x=AT Page URL
- https://fox.trackstatisticsss.com/?id=3456679323 Page URL
- https://fox.trackstatisticsss.com/go.html?id=476876214&pid=54645747&did=tu473465 Page URL
- https://tap.digestcolect.com/r.php?id=0 Page URL
- https://tap.digestcolect.com/r.php?id=sggfjer&f=sggfjer Page URL
- https://dragonforwardknife.com/?p=hezdsyjyhe5gi3bpgmztini&sub1=Povey&sub2=bd.v1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin?amp;locale.x=en_AT&country.x=AT HTTP 301
- http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin/?amp;locale.x=en_AT&country.x=AT
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/myaccount/signin/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
k.js
stat.trackstatisticsss.com/ |
267 B 503 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
L-Z118.css
www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/lib/css/ |
13 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.js
www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/lib/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
fox.trackstatisticsss.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
fox.trackstatisticsss.com/ |
1 KB 800 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
go.html
fox.trackstatisticsss.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
go.html
fox.trackstatisticsss.com/ |
973 B 811 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
r.php
tap.digestcolect.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
r.php
tap.digestcolect.com/ |
272 B 510 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
r.php
tap.digestcolect.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
r.php
tap.digestcolect.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
r.php
tap.digestcolect.com/ |
684 B 736 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
dragonforwardknife.com/ |
24 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
13 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.moderncomputersbhopal.com
- URL
- http://www.moderncomputersbhopal.com/backup/update/customer_center/customer-IDPP00C837/lib/js/jquery.js
- Domain
- fox.trackstatisticsss.com
- URL
- https://fox.trackstatisticsss.com/?id=3456679323
- Domain
- fox.trackstatisticsss.com
- URL
- https://fox.trackstatisticsss.com/go.html?id=476876214&pid=54645747&did=tu473465
- Domain
- tap.digestcolect.com
- URL
- https://tap.digestcolect.com/r.php?id=0
- Domain
- tap.digestcolect.com
- URL
- https://tap.digestcolect.com/r.php?id=sggfjer&f=sggfjer
- Domain
- tap.digestcolect.com
- URL
- https://tap.digestcolect.com/r.php?id=sggfjer&f=sggfjer
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate boolean| guardEnabled boolean| isChrome object| rootElement boolean| canStart function| text function| textr function| urlB64ToUint8Array function| disableHistory function| disableIncognito function| denied function| getWorkerRegistration function| Subscribe function| CheckS1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.dragonforwardknife.com/ | Name: uuid Value: e00a6f11-45e1-4d32-bd65-21fe10a22e2e |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dragonforwardknife.com
fox.trackstatisticsss.com
stat.trackstatisticsss.com
tap.digestcolect.com
www.moderncomputersbhopal.com
fox.trackstatisticsss.com
tap.digestcolect.com
www.moderncomputersbhopal.com
162.241.65.79
162.241.87.103
178.128.241.54
216.10.250.207
0f94738eccf8e003619ab66b514ac2dc7ff8790038d44714b726aadbdb1bdd26
1179d91e241cbea26748f5c37c22e29e7536e7ebdef99a5e0588f52d224097fb
1bcda772b32139bbd18696ba5a08fc2da9731cecf88d6b904cb953107484f55f
3d730a0eb70ee9c188e63dc4e0dff7c740abecb79541d0555d0802703f1f2b85
5e47409b65d3670ceb3fa0c9e947143fff9ac8cb33253e37315aafe3278b3edc
988cf4b198dbdfafd55110a1a350fe54b28bee908739b25eba0f585626d13211
b90c3b17c005dafd3bc261b1cbe18508fc988ffc941f53884b428c480cd4e05d
ee0fd3c3c838a126e6fb67d2063af3b0918c5c14c37b84f6b2390542fb8a8263