electricitypak.com
Open in
urlscan Pro
199.231.184.66
Malicious Activity!
Public Scan
Submission: On July 10 via manual from US
Summary
This is the only time electricitypak.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 199.231.184.66 199.231.184.66 | 19318 (IS-AS-1) (IS-AS-1 - Interserver) | |
1 | 2606:4700:20:... 2606:4700:20::6819:e56c | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 98.142.105.106 98.142.105.106 | 33182 (DIMENOC) (DIMENOC - HostDime.com) | |
3 | 3 |
ASN19318 (IS-AS-1 - Interserver, Inc, US)
PTR: server.lightpakistanexpo.com
electricitypak.com |
ASN33182 (DIMENOC - HostDime.com, Inc., US)
PTR: lin1508.byte90.net
dps-world.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
dps-world.com
dps-world.com |
|
1 |
aframe.io
aframe.io |
269 KB |
1 |
electricitypak.com
electricitypak.com |
943 B |
3 | 3 |
Domain | Requested by | |
---|---|---|
1 | dps-world.com |
electricitypak.com
|
1 | aframe.io |
electricitypak.com
|
1 | electricitypak.com | |
3 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl373155.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-07-07 - 2020-01-13 |
6 months | crt.sh |
dps-world.com cPanel, Inc. Certification Authority |
2019-06-15 - 2019-09-13 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://electricitypak.com/fakt/css/data/17/index.php?m=amcampbell@speedway.com
Frame ID: 2391AB0A1DA3F4939EE7206EDCA2C8E4
Requests: 2 HTTP requests in this frame
Frame:
https://dps-world.com/fakt/css/sc/portal
Frame ID: CF7CA977C5B40D406ECAE091444E2F93
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
A-Frame (JavaScript Graphics) Expand
Detected patterns
- html /<a-scene[^<>]*>/i
- script /\/?([\d.]+)?\/aframe(?:\.min)?\.js/i
three.js (JavaScript Graphics) Expand
Detected patterns
- html /<a-scene[^<>]*>/i
- script /\/?([\d.]+)?\/aframe(?:\.min)?\.js/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.php
electricitypak.com/fakt/css/data/17/ |
735 B 943 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aframe.min.js
aframe.io/releases/0.7.1/ |
1 MB 269 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
portal
dps-world.com/fakt/css/sc/ Frame CF7C |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| logs object| THREE boolean| hasNativeWebVRImplementation object| WebVRConfig function| VRDisplay function| VRFrameData function| WebVRPolyfill object| TWEEN function| rStats function| glStats function| threeStats function| BrowserStats function| aframeStats object| AFRAME5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.dps-world.com/ | Name: __utmt Value: 1 |
|
.dps-world.com/ | Name: __utmb Value: 149709667.1.10.1562783478 |
|
.dps-world.com/ | Name: __utmz Value: 149709667.1562783478.1.1.utmcsr=electricitypak.com|utmccn=(referral)|utmcmd=referral|utmcct=/fakt/css/data/17/index.php |
|
.dps-world.com/ | Name: __utmc Value: 149709667 |
|
.dps-world.com/ | Name: __utma Value: 149709667.643673246.1562783478.1562783478.1562783478.1 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aframe.io
dps-world.com
electricitypak.com
199.231.184.66
2606:4700:20::6819:e56c
98.142.105.106
580762a5fef670b177f62ff8dfbadb2fc271eba8a78df2b8eb9e50820aec7ead
7ad5c207d145e67eea462732be66b7193e7f18d1b459373a39e2ed0a99380df1