liberaux.net Open in urlscan Pro
192.185.14.222 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identifi...
Submission: On July 06 via automatic, source openphish (July 6th 2022, 1:29:50 am UTC) — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 16 HTTP transactions. The main IP is 192.185.14.222, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is liberaux.net.

This is the only time liberaux.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fifth Third Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
13	192.185.14.222 192.185.14.222	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
3	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2

13 192.185.14.222 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: mail.qcorp.qa

liberaux.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	liberaux.net liberaux.net	145 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	83 KB
16	2

	Domain	Requested by
13	liberaux.net	liberaux.net
3	cdnjs.cloudflare.com	liberaux.net
16	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Frame ID: 8209EB0805E6C131C0981782F2C71CF9
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Verification - Fifth Third Bank

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

19 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

229 kB
Transfer

800 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request c20.php Show response
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/ 63 KB
10 KB 333ms
191ms Document
text/html 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: 67e9ef603e7874fff2051e83979df869c94282801e11c1c2246008e1cf74de6f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 10328
Content-Type: text/html; charset=UTF-8
Date: Wed, 06 Jul 2022 01:29:45 GMT
Keep-Alive: timeout=5, max=75
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding

GET
H/1.1 200
OK lp_53.css
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/css/ 846 B
590 B 148ms
147ms Stylesheet
text/css 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/css/lp_53.css
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: 47a17ec750e9b80a8fea129ad75cd4c45947a55f51e1b367cf13ea89471634b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 303

GET
H/1.1 200
OK autocomplete.css
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/css/ 268 KB
67 KB 336ms
194ms Stylesheet
text/css 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/css/autocomplete.css
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: fa481938b765790e06d52408ec3d4b5296f40adfa5852246bb1556c0b8a3973a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Vary: Accept-Encoding
Upgrade: h2,h2c
Transfer-Encoding: chunked
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=75

GET
H/1.1 200
OK formValidation.min.css
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/css/ 19 KB
4 KB 327ms
183ms Stylesheet
text/css 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/css/formValidation.min.css
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: a1df840d52a6e1a2b85ed8ea59e25b34c824d520ca34b2a84adf7fef4b2689d8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Vary: Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: text/css
Keep-Alive: timeout=5, max=75
Content-Length: 4070

GET
H2 200 es6-shim.min.js Show response
cdnjs.cloudflare.com/ajax/libs/es6-shim/0.35.3/ 55 KB
14 KB 74ms
28ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/es6-shim/0.35.3/es6-shim.min.js

Requested by

Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c79606528eab7b89d35276752f1b2a53b970790b8855f644ae3d8adb8aad7da

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://liberaux.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 06 Jul 2022 01:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1282492
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14321
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:56 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e54-dca5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yc68yiGHa0VlsWU8X14l%2BgKw2Q%2BvxGoBhQj4cUGNQ0ZaEPkASH%2FYJDbFL4Vrih%2BSp6Wt9n6biHWXS%2BNur1Fdn8xCUTZg7TJxF8H%2Fk7iRFyC4gI5sgA69qJef%2B7cPCUTAf%2FlL6G0kcRT2PXMaans%2FEt2%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 72649239c863bb44-FRA
expires: Mon, 26 Jun 2023 01:29:45 GMT

GET
H/1.1 200
OK 53_Horizontal-logo.svg
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/ 9 KB
9 KB 304ms
155ms Image
image/svg+xml 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/53_Horizontal-logo.svg
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: 909b33e41bbfa67cf7c1227e05b1b9c0e9d8c2a11b5cdc0618e7bb09d49124be

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/svg+xml
Keep-Alive: timeout=5, max=75
Content-Length: 8875

GET
H/1.1 200
OK 53_Shield-logo-small.svg
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/ 2 KB
2 KB 455ms
151ms Image
image/svg+xml 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/53_Shield-logo-small.svg
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: c61a11c9e8c7b27848483a7d469e9e1b4d5226ab2377f02c8665a7352be0ce60

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 1707

GET
H/1.1 200
OK user-Question-o.svg
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/ 2 KB
2 KB 484ms
166ms Image
image/svg+xml 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/user-Question-o.svg
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: a7abbce85d88803c72cfa7917730744140f547363661a478e6e092326f7ddf89

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 1994

GET
H/1.1 200
OK error_icon_2x.svg
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/ 3 KB
3 KB 164ms
164ms Image
image/svg+xml 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/error_icon_2x.svg
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: 4dc9dca7e7d556eb8428860a71642025cf21ee5e1b379170efbdf2d95d67e7a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 3265

GET
H/1.1 200
OK FormValidation.min.js Show response
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/js/ 66 KB
22 KB 330ms
187ms Script
application/javascript 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/js/FormValidation.min.js
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: d90224cd9ba0d138e7ba721d12b39e5e680999b2a1b246691542b195514e91ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Vary: Accept-Encoding
Upgrade: h2,h2c
Transfer-Encoding: chunked
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=75

GET
H/1.1 200
OK Foundation.min.js Show response
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/js/plugins/ 2 KB
1 KB 317ms
173ms Script
application/javascript 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/js/plugins/Foundation.min.js
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: e347bf8a60497f126cd8d4df5cef31df2daa7ea19b48a0cb2c4070b6689dda51

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Vary: Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: application/javascript
Keep-Alive: timeout=5, max=75
Content-Length: 961

GET
H/1.1 200
OK forms.js Show response
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/js/ 14 KB
3 KB 327ms
181ms Script
application/javascript 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/dist/js/forms.js
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: b8b709a8a41499ce945c344fb7cc53f8f1b99f66d8f72e81d87f1847c40ba873

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 3259

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ 256 KB
64 KB 74ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/jquery.js

Requested by

Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://liberaux.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 06 Jul 2022 01:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2344047
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64839
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-40023"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XLuaOeBZ0PdhF%2FFUed53Wfgy0g60fqokfqZcQztvJ%2BO49sgjZEtn1lLgV43%2B78yBpWvf7PXMZLMSQasUU84xo8yT6OxS8amIQLIArpX9YJI07QxzJCIKXz2XsxaXwmB03pgUTXF%2BGLMm2pohPixIi0BE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 72649239c866bb44-FRA
expires: Mon, 26 Jun 2023 01:29:45 GMT

GET
H2 200 jquery.mask.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ 20 KB
5 KB 70ms
26ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js

Requested by

Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://liberaux.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 06 Jul 2022 01:29:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4680715
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4517
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-4e98"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sd0cLXYuj47GxulaT%2BHbCHcZF88coyMi%2FFBAAThcEGmM7Fo2FFzGOMAoKWzTBzuWE288sybQ%2BkSn9z2FNRcyfcGG9rZgaRL3aFNfM9DgCg4u6BkezvK8KW36pByYKB0aW1m193ggsFc5IXS%2Bd%2FZ7rKzD"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 72649239c867bb44-FRA
expires: Mon, 26 Jun 2023 01:29:45 GMT

GET
H/1.1 200
OK equal-housing-lender--large.png
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/ 7 KB
7 KB 162ms
162ms Image
image/png 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/equal-housing-lender--large.png
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: a6a561761acd53e674570d7ec3a2d119c75db57276efd9d1cfbce792389782e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=72
Content-Length: 6668

GET
H/1.1 200
OK member-fdic.png
liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/ 13 KB
13 KB 159ms
158ms Image
image/png 192.185.14.222
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/assets/img/member-fdic.png
Requested by: Host: liberaux.net
URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
Protocol: HTTP/1.1
Server: 192.185.14.222 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: mail.qcorp.qa
Software: Apache /
Resource Hash: 96b5e6548b16dff5e401d796818b8fc6c4158338dffadd90f550a48ca1d8a47c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Wed, 06 Jul 2022 01:29:45 GMT
Last-Modified: Tue, 05 Jul 2022 19:15:16 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=73
Content-Length: 13495

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fifth Third Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/es6-shim/0.35.3/es6-shim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/es6-shim/0.35.3/es6-shim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: http://liberaux.net/fa1ecbb29c36a80120fa7bba7191f1b8/c20.php?oamo/identity/=&token=cjmvjprw2dw1/mfacontacts_identification(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/jquery.mask.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
liberaux.net
192.185.14.222
2606:4700::6811:190e
47a17ec750e9b80a8fea129ad75cd4c45947a55f51e1b367cf13ea89471634b3
4c79606528eab7b89d35276752f1b2a53b970790b8855f644ae3d8adb8aad7da
4dc9dca7e7d556eb8428860a71642025cf21ee5e1b379170efbdf2d95d67e7a8
67e9ef603e7874fff2051e83979df869c94282801e11c1c2246008e1cf74de6f
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
909b33e41bbfa67cf7c1227e05b1b9c0e9d8c2a11b5cdc0618e7bb09d49124be
96b5e6548b16dff5e401d796818b8fc6c4158338dffadd90f550a48ca1d8a47c
a1df840d52a6e1a2b85ed8ea59e25b34c824d520ca34b2a84adf7fef4b2689d8
a6a561761acd53e674570d7ec3a2d119c75db57276efd9d1cfbce792389782e1
a7abbce85d88803c72cfa7917730744140f547363661a478e6e092326f7ddf89
b8b709a8a41499ce945c344fb7cc53f8f1b99f66d8f72e81d87f1847c40ba873
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
c61a11c9e8c7b27848483a7d469e9e1b4d5226ab2377f02c8665a7352be0ce60
d90224cd9ba0d138e7ba721d12b39e5e680999b2a1b246691542b195514e91ad
e347bf8a60497f126cd8d4df5cef31df2daa7ea19b48a0cb2c4070b6689dda51
fa481938b765790e06d52408ec3d4b5296f40adfa5852246bb1556c0b8a3973a

liberaux.net Open in urlscan Pro 192.185.14.222 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

19 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

229 kBTransfer

800 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

liberaux.net Open in urlscan Pro
192.185.14.222 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

19 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

229 kB
Transfer

800 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!