urlscan.io logo urlscan.io
SecurityTrails logo

shujaroyallimo.com Open in urlscan Pro
67.211.213.120  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://stalew330.000webhostapp.com/
Effective URL: https://shujaroyallimo.com/365-office/
Submission: On May 04 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 67.211.213.120, located in Secaucus, United States and belongs to NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US. The main domain is shujaroyallimo.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 25th 2018. Valid for: 3 months.
This is the only time shujaroyallimo.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer) Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
1 145.14.144.9 204915 (AWEX)
7 67.211.213.120 19318 (NJIIX-AS-1)
1 91.198.174.208 14907 (WIKIMEDIA)
13 4
Domain Requested by
7 shujaroyallimo.com shujaroyallimo.com
1 upload.wikimedia.org shujaroyallimo.com
1 stalew330.000webhostapp.com
0 www.shujaroyallimo.com Failed shujaroyallimo.com
0 fonts.googleapis.com Failed shujaroyallimo.com
13 5

This site contains no links.

Subject Issuer Validity Valid
*.000webhostapp.com
COMODO RSA Domain Validation Secure Server CA		 2016-06-02 -
2019-06-02		 3 years crt.sh
shujaroyallimo.com
cPanel, Inc. Certification Authority		 2018-03-25 -
2018-06-23		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://shujaroyallimo.com/365-office/
Frame ID: 468F9DA3F533AA875F312C3642FE7289
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://stalew330.000webhostapp.com/ Page URL
  2. https://shujaroyallimo.com/365-office/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

13
Requests

62 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

491 kB
Transfer

488 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://stalew330.000webhostapp.com/ Page URL
  2. https://shujaroyallimo.com/365-office/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9
  • https://shujaroyallimo.com/fonts/fontawesome-webfont5b62.html?v=4.6.3 HTTP 301
  • https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.html?v=4.6.3
Request Chain 10
  • https://shujaroyallimo.com/fonts/fontawesome-webfont5b62.woff?v=4.6.3 HTTP 301
  • https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.woff?v=4.6.3
Request Chain 11
  • https://shujaroyallimo.com/fonts/fontawesome-webfont5b62.ttf?v=4.6.3 HTTP 301
  • https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.ttf?v=4.6.3

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
stalew330.000webhostapp.com/ 		86 B
291 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stalew330.000webhostapp.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
145.14.144.9 , Netherlands, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
c321d2fa2c72f3c3363f439c545d5a65ffde5cb26e80fb2c217c4187d1407bf1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:path
/
pragma
no-cache
accept-encoding
gzip, deflate
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control
no-cache
:authority
stalew330.000webhostapp.com
:scheme
https
:method
GET
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

date
Fri, 04 May 2018 14:23:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
200
x-xss-protection
1; mode=block
x-request-id
45a342558a46bbbf36920bdc235881bc
Primary Request /
shujaroyallimo.com/365-office/ 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
0d1f265bf9e862d10c3d28252d1df179495867b5604c3a9cf9df826f8b5b34b5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://stalew330.000webhostapp.com/
Connection
keep-alive
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Referer
https://stalew330.000webhostapp.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:50 GMT
Last-Modified
Tue, 01 May 2018 03:52:42 GMT
Server
Apache
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5372
first.css
shujaroyallimo.com/365-office/ 		203 KB
203 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://shujaroyallimo.com/365-office/first.css
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
8178c795d51417ec3e73ea0be8fcd1d051cfbf684b83e782d7b05644762b968f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://shujaroyallimo.com/365-office/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:50 GMT
Last-Modified
Sun, 29 Apr 2018 04:07:44 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
207752
second.css
shujaroyallimo.com/365-office/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://shujaroyallimo.com/365-office/second.css
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
2cc68b94666feb1fdd89122bf25fe10b0089cd51abbeec09913026d20f085dd5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://shujaroyallimo.com/365-office/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:50 GMT
Last-Modified
Sun, 29 Apr 2018 04:10:12 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1762
logo.png
shujaroyallimo.com/365-office/image/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://shujaroyallimo.com/365-office/image/logo.png
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
3ae10ed925ca3203f6f4907da618fa90061d565b0b38af565b2fc5396477361a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://shujaroyallimo.com/365-office/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:50 GMT
Last-Modified
Sun, 29 Apr 2018 04:18:48 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
21171
wor.png
shujaroyallimo.com/365-office/image/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://shujaroyallimo.com/365-office/image/wor.png
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
2cbcd235e7bd37011920b82ef900a4c2e87a048faa7345a1af59c1f28bce7188

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://shujaroyallimo.com/365-office/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:51 GMT
Last-Modified
Sun, 29 Apr 2018 04:20:50 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
7259
Office_365_logo.png
upload.wikimedia.org/wikipedia/commons/7/74/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://upload.wikimedia.org/wikipedia/commons/7/74/Office_365_logo.png
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
SPDY
Server
91.198.174.208 , Netherlands, ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US),
Reverse DNS
upload-lb.esams.wikimedia.org
Software
/
Resource Hash
8ae79a4d18eea420af0fd562d43879b569bbd2c622da6deba79f6c202e385361
Security Headers
Name Value
Strict-Transport-Security max-age=106384710; includeSubDomains; preload

Request headers

Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

x-analytics
https=1;nocookies=1
date
Fri, 04 May 2018 14:23:51 GMT
via
1.1 varnish (Varnish/5.1), 1.1 varnish (Varnish/5.1), 1.1 varnish (Varnish/5.1)
age
7678
x-cache-status
hit-front
x-cache
cp1064 hit/13, cp3045 hit/9, cp3047 hit/28
status
200
content-length
25171
x-trans-id
tx6ab76b236c324596a6409-005aec4ef8
x-client-ip
148.251.45.254
x-object-meta-sha1base36
flhgcao47mncz49pngfpnpocardm4ug
timing-allow-origin
*
last-modified
Sun, 15 Mar 2015 03:26:59 GMT
etag
95e1d221f4f2f485c900d7c69d5f8049
strict-transport-security
max-age=106384710; includeSubDomains; preload
x-varnish
27872081 24948025, 177212590 172783851, 709274200 678547286
access-control-allow-origin
*
x-timestamp
1426390018.29420
accept-ranges
bytes
content-type
image/png
access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache, X-Varnish
third.js
shujaroyallimo.com/365-office/ 		222 KB
222 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://shujaroyallimo.com/365-office/third.js
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
2b75d4966e5a48b8fa179d687e45ec156ccb1e8323c06694bca8570c6960110c

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
*/*
Referer
https://shujaroyallimo.com/365-office/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:50 GMT
Last-Modified
Sun, 29 Apr 2018 04:16:44 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
227376
four.js
shujaroyallimo.com/365-office/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://shujaroyallimo.com/365-office/four.js
Requested by
Host: shujaroyallimo.com
URL: https://shujaroyallimo.com/365-office/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.211.213.120 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US),
Reverse DNS
business.skyhost.pk
Software
Apache /
Resource Hash
0ab74820d431d7ea1df57bfab0f85bbd729030a70da8aabe932a9d1f518edeeb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
shujaroyallimo.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
*/*
Referer
https://shujaroyallimo.com/365-office/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://shujaroyallimo.com/365-office/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Fri, 04 May 2018 14:23:50 GMT
Last-Modified
Sun, 29 Apr 2018 04:15:54 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
4231
css
fonts.googleapis.com/ 		0
0
fontawesome-webfont5b62.html
www.shujaroyallimo.com/fonts/
Redirect Chain
  • https://shujaroyallimo.com/fonts/fontawesome-webfont5b62.html?v=4.6.3
  • https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.html?v=4.6.3
0
0
fontawesome-webfont5b62.woff
www.shujaroyallimo.com/fonts/
Redirect Chain
  • https://shujaroyallimo.com/fonts/fontawesome-webfont5b62.woff?v=4.6.3
  • https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.woff?v=4.6.3
0
0
fontawesome-webfont5b62.ttf
www.shujaroyallimo.com/fonts/
Redirect Chain
  • https://shujaroyallimo.com/fonts/fontawesome-webfont5b62.ttf?v=4.6.3
  • https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.ttf?v=4.6.3
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Raleway:100,300,400,500%7CLato:300,400
Domain
www.shujaroyallimo.com
URL
https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.html?v=4.6.3
Domain
www.shujaroyallimo.com
URL
https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.woff?v=4.6.3
Domain
www.shujaroyallimo.com
URL
https://www.shujaroyallimo.com/fonts/fontawesome-webfont5b62.ttf?v=4.6.3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer) Office 365 (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _self object| Prism object| httpLanguages object| options string| contentType function| $ function| jQuery function| lity function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block