secrueclousso.drplspec.com
Open in
urlscan Pro
111.90.144.64
Malicious Activity!
Public Scan
Submitted URL: https://storage.googleapis.com/spfss/prafs.html
Effective URL: https://secrueclousso.drplspec.com/
Submission: On April 18 via manual from US
Effective URL: https://secrueclousso.drplspec.com/
Submission: On April 18 via manual from US
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 10 HTTP transactions.
The main IP is 111.90.144.64, located in
Malaysia and
belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY.
The main domain is secrueclousso.drplspec.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 17th 2019. Valid for: 3 months.
This is the only time secrueclousso.drplspec.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on April 17th 2019. Valid for: 3 months.
This is the only time secrueclousso.drplspec.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Spectrum (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2a00:1450:400... 2a00:1450:4001:808::2010 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 111.90.144.64 111.90.144.64 | 45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd) | |
| 6 | 18.205.112.73 18.205.112.73 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
| 2 | 143.204.98.218 143.204.98.218 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 10 | 4 |
1
111.90.144.64
(Malaysia)
ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: shark5.ipchina163.com
ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: shark5.ipchina163.com
| secrueclousso.drplspec.com |
6
18.205.112.73
(Cambridge, United States)
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-205-112-73.compute-1.amazonaws.com
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-18-205-112-73.compute-1.amazonaws.com
| webmail.spectrum.net |
2
143.204.98.218
(Wilmington, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-98-218.fra50.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-98-218.fra50.r.cloudfront.net
| d1ff979u6gd5fc.cloudfront.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
spectrum.net
webmail.spectrum.net |
239 KB |
| 2 |
cloudfront.net
d1ff979u6gd5fc.cloudfront.net |
73 KB |
| 1 |
drplspec.com
secrueclousso.drplspec.com |
6 KB |
| 1 |
googleapis.com
storage.googleapis.com |
823 B |
| 10 | 4 |
| Domain | Requested by | |
|---|---|---|
| 6 | webmail.spectrum.net |
secrueclousso.drplspec.com
|
| 2 | d1ff979u6gd5fc.cloudfront.net |
webmail.spectrum.net
|
| 1 | secrueclousso.drplspec.com | |
| 1 | storage.googleapis.com | |
| 10 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.spectrum.com |
| business.spectrum.com |
| myservices.timewarnercable.com |
| www.timewarnercable.com |
| watch.spectrum.net |
| urt.rr.com |
| pt.rr.com |
| www.twcmedia.com |
| help.twcable.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.storage.googleapis.com Google Internet Authority G3 |
2019-03-26 - 2019-06-18 |
3 months | crt.sh |
| secrueclousso.drplspec.com Let's Encrypt Authority X3 |
2019-04-17 - 2019-07-16 |
3 months | crt.sh |
| *.spectrum.net Amazon |
2018-08-30 - 2019-09-30 |
a year | crt.sh |
| *.cloudfront.net DigiCert Global CA G2 |
2018-10-08 - 2019-10-09 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://secrueclousso.drplspec.com/
Frame ID: 007EC7754DA4C2D85D6BB6ABF4D2E6B2
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://storage.googleapis.com/spfss/prafs.html Page URL
- https://secrueclousso.drplspec.com/ Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
URL: http://www.spectrum.com/
Title: Home
Title: Home
Search URL Search Domain Scan URL
URL: http://business.spectrum.com/
Title: Business
Title: Business
Search URL Search Domain Scan URL
URL: https://myservices.timewarnercable.com/login
Title: My Account
Title: My Account
Search URL Search Domain Scan URL
URL: https://www.timewarnercable.com/en/support/overview.html?cid=aff:twccsupport
Title: Support
Title: Support
Search URL Search Domain Scan URL
URL: http://watch.spectrum.net/
Title: Watch TV
Title: Watch TV
Search URL Search Domain Scan URL
URL: https://www.timewarnercable.com/en/support/internet/topics/internet-security.html
Title: Security
Title: Security
Search URL Search Domain Scan URL
URL: https://www.spectrum.com/about.html
Title: About Us
Title: About Us
Search URL Search Domain Scan URL
URL: https://www.timewarnercable.com/en/support/internet/step-by-step/twc-mail.html
Title: Spectrum Support
Title: Spectrum Support
Search URL Search Domain Scan URL
URL: https://urt.rr.com/
Title: Forgot Email Address?
Title: Forgot Email Address?
Search URL Search Domain Scan URL
URL: https://pt.rr.com/
Title: Forgot Email Password?
Title: Forgot Email Password?
Search URL Search Domain Scan URL
URL: http://www.twcmedia.com/default.aspx?cid=aff:twccmediasales
Title: Advertise with Us
Title: Advertise with Us
Search URL Search Domain Scan URL
URL: https://www.spectrum.com/policies/your-privacy-rights.html
Title: Terms of Use
Title: Terms of Use
Search URL Search Domain Scan URL
URL: https://www.spectrum.com/policies/website-privacy-policy.html
Title: Web Privacy Policy
Title: Web Privacy Policy
Search URL Search Domain Scan URL
URL: https://www.spectrum.com/policies/ca-privacy-rights.html
Title: Your California Privacy Rights
Title: Your California Privacy Rights
Search URL Search Domain Scan URL
URL: http://help.twcable.com/policies.html?cid=aff:twccwmsubscriberpoli
Title: TWC Subscriber Policies
Title: TWC Subscriber Policies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://storage.googleapis.com/spfss/prafs.html Page URL
- https://secrueclousso.drplspec.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
prafs.html
storage.googleapis.com/spfss/ |
326 B 823 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
secrueclousso.drplspec.com/ |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-1.9.1.min.js
webmail.spectrum.net/application/modules/mail/views/scripts/mail/js/ |
90 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.js
webmail.spectrum.net/application/modules/mail/views/scripts/auth/js/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
spectrum.css
webmail.spectrum.net/application/modules/mail/views/scripts/mail/css/ |
126 KB 126 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.css
webmail.spectrum.net/application/modules/mail/views/scripts/auth/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
rutledge.css
webmail.spectrum.net/application/modules/mail/views/scripts/mail/css/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
spectrum-logo.svg
webmail.spectrum.net/application/modules/mail/views/scripts/mail/images/logos/ |
10 KB 10 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rutledge-medium.woff
d1ff979u6gd5fc.cloudfront.net/api/static-assets/assets/3.52.0/22/assets/fonts/rutledge/medium/ |
33 KB 34 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
rutledge-light.woff
d1ff979u6gd5fc.cloudfront.net/api/static-assets/assets/3.52.0/22/assets/fonts/rutledge/light/ |
37 KB 38 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Spectrum (Telecommunication)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| LoginForm object| loginForm1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| secrueclousso.drplspec.com/ | Name: PHPSESSID Value: b0tb8qqmvqqu9qbcbqra8incn7 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d1ff979u6gd5fc.cloudfront.net
secrueclousso.drplspec.com
storage.googleapis.com
webmail.spectrum.net
111.90.144.64
143.204.98.218
18.205.112.73
2a00:1450:4001:808::2010
059197cdfcc9b8f79681f308720087c5e803bd1ac207fe501f99ed3fd1778088
4c08b9b334a2e008b19800c1cd11fd0d792106add59670a61765f32746073d79
89f5574d52ca5311cbcc0e5bae7a87a26da40a4ca917c16c69e569faf77b68a2
933b4a302d1b7d78a35cdb7a58601307f0ee44382f91707f9104b647123f48e6
a714eed976732301c50821142b879f3af3f91e328d2931e95686338b9c43a2e6
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
d0ccab8c62e3914173619ccb183a8bbe6df396a5e7bc788c8c28c1f7b2182d66
ef80b9376c1979b5bd7029c5f11273be192ffc8d05fdc22fdcf486a9e146e9ba
fc117f32c802c3b99cdc01cc17a2ad417199e3ed252b99e9fe40f9b3d1b349b1