![](/screenshots/5c43e762-3b69-492a-9f1c-08296d0d444a.png)
sn.prosperityflowleads.com
Open in
urlscan Pro
206.123.159.18
Malicious Activity!
Public Scan
Effective URL: http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt...
Submission: On November 20 via automatic, source openphish
Summary
This is the only time sn.prosperityflowleads.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 206.123.159.18 206.123.159.18 | 29802 (HVC-AS) (HVC-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:814::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:806::200e | 15169 (GOOGLE) (GOOGLE) | |
14 | 4 |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
prosperityflowleads.com
1 redirects
sn.prosperityflowleads.com |
440 KB |
2 |
google-analytics.com
www.google-analytics.com |
17 KB |
1 |
googleapis.com
fonts.googleapis.com |
1022 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
12 | sn.prosperityflowleads.com |
1 redirects
sn.prosperityflowleads.com
|
2 | www.google-analytics.com |
sn.prosperityflowleads.com
|
1 | fonts.googleapis.com |
sn.prosperityflowleads.com
|
14 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: 5C0FD5AB7E5DB58ECEC0E519F1EC1F88
Requests: 6 HTTP requests in this frame
Frame:
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/log.php?mylove=
Frame ID: 29BDF10DBCCF89E9D4D231BCF00D64B6
Requests: 1 HTTP requests in this frame
Frame:
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/l0gins.php?mylove=
Frame ID: D5A6E2E27A22D1CFA133AA521BF1F187
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/5c43e762-3b69-492a-9f1c-08296d0d444a.png)
Page URL History Show full URLs
-
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel
HTTP 301
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/ Page URL
- http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=6... Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel
HTTP 301
http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/ Page URL
- http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel HTTP 301
- http://sn.prosperityflowleads.com/new/Excel/xl/link/Excel/
- http://www.google-analytics.com/ga.js HTTP 307
- https://www.google-analytics.com/ga.js
- http://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=1838619345&utmhn=sn.prosperityflowleads.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=504x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1792046611&utmr=0&utmp=%2Fnew%2FExcel%2Fxl%2Flink%2FExcel%2FPO%2Fl0gins.php%3Fmylove%3D&utmht=1605836092443&utmac=UA-43981329-1&utmcc=__utma%3D236861763.1504371661.1605836092.1605836092.1605836092.1%3B%2B__utmz%3D236861763.1605836092.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1871745448&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
- https://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=1838619345&utmhn=sn.prosperityflowleads.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=504x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1792046611&utmr=0&utmp=%2Fnew%2FExcel%2Fxl%2Flink%2FExcel%2FPO%2Fl0gins.php%3Fmylove%3D&utmht=1605836092443&utmac=UA-43981329-1&utmcc=__utma%3D236861763.1504371661.1605836092.1605836092.1605836092.1%3B%2B__utmz%3D236861763.1605836092.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1871745448&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/ Redirect Chain
|
909 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lintex.png
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/ |
119 KB 119 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
page.php
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ |
19 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pobg.gif
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ |
149 KB 149 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
log.php
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ Frame 29BD |
657 B 864 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
l0gins.php
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ Frame D5A6 |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ga.js
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ Frame D5A6 |
42 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ Frame D5A6 |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_popup.css
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ Frame D5A6 |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_popup.js
sn.prosperityflowleads.com/new/Excel/xl/link/Excel/PO/ Frame D5A6 |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ Frame D5A6 |
2 KB 1022 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
www.google-analytics.com/ Frame D5A6 Redirect Chain
|
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
__utm.gif
www.google-analytics.com/r/ Frame D5A6 Redirect Chain
|
35 B 197 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame D5A6 |
622 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated number| myVar function| myFunction function| showPage5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.sn.prosperityflowleads.com/ | Name: __utmb Value: 236861763.1.10.1605836092 |
|
.sn.prosperityflowleads.com/ | Name: __utmz Value: 236861763.1605836092.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.sn.prosperityflowleads.com/ | Name: __utmc Value: 236861763 |
|
.sn.prosperityflowleads.com/ | Name: __utmt Value: 1 |
|
.sn.prosperityflowleads.com/ | Name: __utma Value: 236861763.1504371661.1605836092.1605836092.1605836092.1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
sn.prosperityflowleads.com
www.google-analytics.com
206.123.159.18
2a00:1450:4001:806::200e
2a00:1450:4001:814::200a
06c16a259eae4270acd719c7aa7420b5e0b5104f65b325e47dc55a8d31343b7a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
4e2ed635abf0b2dcbac3ea04d16ccf58bb2195364d65b76190f03da0f43255c5
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19
642b823bfda63344a1342fbc28bc61fde43119e208b77bffe545d2d4f0518e85
70c9e275dcf7632521d0d51814b515cae9a793fc894dde687d95138935f4d067
7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5
8180ef2d3d03fad302b169e59b768fadf177b947ffd376b7d2dfe06f3a23d73e
82f04c5d953b2ccb07f301b00299566e9a6efcc00a654259cd44ca71bb4db7fb
8308cd4f7dbe8a301e058f6ed215fdeca44bdec56c2ea2ff7d645bf631afe7b2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8ca3883a0ab4a909fe78d219e4d2380d3013ea3e0e83542d71cc0a0a759d3ac3
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
baa9df790a290c26723f44e85f9d8a09b08ef7a4409f7bd1f2804f5b3e30a4ae
c04cf09840411f295ff69f2918f3b47668034fecc79e11211d2cef3436c1c513
e9c6d9cac375cc5fb90af25b47287a11f77163ff788777143df127c074d661f6