urlscan.io logo urlscan.io
SecurityTrails logo

livre96.com Open in urlscan Pro
216.59.16.231  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Submission: On January 13 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 216.59.16.231, located in Rio de Janeiro, Brazil and belongs to IMMEDION - Immedion, LLC, US. The main domain is livre96.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 24th 2019. Valid for: 3 months.
This is the only time livre96.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rackspace (Online)

Domain & IP information

IP Address AS Autonomous System
1 216.59.16.231 15085 (IMMEDION)
1 2001:4802:7a0... 27357 (RACKSPACE)
4 8 2001:4802:7a0... 27357 (RACKSPACE)
8 4
Apex Domain
Subdomains		 Transfer
9 rackspace.com
apps.rackspace.com
cp.rackspace.com
43 KB
1 livre96.com
livre96.com
15 KB
0 googleadservices.com Failed
www.googleadservices.com Failed
0 googleapis.com Failed
ajax.googleapis.com Failed
8 4
Domain Requested by
8 cp.rackspace.com 4 redirects livre96.com
1 apps.rackspace.com livre96.com
1 livre96.com
0 www.googleadservices.com Failed livre96.com
0 ajax.googleapis.com Failed livre96.com
8 5

This site contains links to these domains. Also see Links.

Domain
www.rackspace.com
cp.rackspace.com
apps.rackspace.com
Subject Issuer Validity Valid
livre96.com
cPanel, Inc. Certification Authority		 2019-12-24 -
2020-03-23		 3 months crt.sh
apps.rackspace.com
Thawte TLS RSA CA G1		 2018-07-06 -
2020-07-05		 2 years crt.sh
cp.rackspace.com
Thawte TLS RSA CA G1		 2018-06-08 -
2020-07-07		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Frame ID: C4FBD52001A73887115EDA1AF71669CB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

75 %
HTTPS

67 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

57 kB
Transfer

56 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif HTTP 302
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif
Request Chain 3
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/logo_20141002.png HTTP 302
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/logo_20141002.png
Request Chain 4
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/plus-anytime_anywhere-190x294.png HTTP 302
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/plus-anytime_anywhere-190x294.png
Request Chain 5
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif HTTP 302
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request rackspace.html
livre96.com/wp-includes/c/RackSpace/ 		15 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.59.16.231 Rio de Janeiro, Brazil, ASN15085 (IMMEDION - Immedion, LLC, US),
Reverse DNS
host14.cp3.sh15.net
Software
Apache/2.4.41 (cPanel) OpenSSL/1.0.2t mod_bwlimited/1.4 /
Resource Hash
d222954f291b767aa6e07a4cc96cbcd2b7cc755bed2a408d61a102a0bb2d46c8

Request headers

Host
livre96.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

Date
Mon, 13 Jan 2020 22:32:12 GMT
Server
Apache/2.4.41 (cPanel) OpenSSL/1.0.2t mod_bwlimited/1.4
Last-Modified
Mon, 13 Jan 2020 18:39:33 GMT
ETag
"28b497-3b04-59c09cbf0372f"
Accept-Ranges
bytes
Content-Length
15108
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
login.js
apps.rackspace.com/js/ 		29 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apps.rackspace.com/js/login.js?2230
Requested by
Host: livre96.com
URL: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2001:4802:7a01:10::4 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
openresty /
Resource Hash
254954afb10634ad2eead14d873510c39a68c15d3bf54bf958655962cb7e1450
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://livre96.com/wp-includes/c/RackSpace/rackspace.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 13 Jan 2020 22:32:12 GMT
Expires
Tue, 12 Jan 2021 22:32:12 +0000
Server
openresty
Connection
keep-alive
Content-Length
29376
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/
Redirect Chain
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif
43 B
313 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif
Requested by
Host: livre96.com
URL: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2894fa1d1ebe2f99a165317c3c46ea23a7de28590a1c3965508acaf802e9c9a8

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 13 Jan 2020 22:32:12 GMT
ETag
"03a78f396d7cb1:0"
Last-Modified
Mon, 28 Feb 2011 22:29:24 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
no-cache
Accept-Ranges
bytes
Content-Length
43

Redirect headers

Location
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/blank.gif
Server
BigIP
Connection
Keep-Alive
Content-Length
0
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.10.2/ 		0
0
logo_20141002.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/
Redirect Chain
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/logo_20141002.png
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/logo_20141002.png
2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/logo_20141002.png
Requested by
Host: livre96.com
URL: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
f167dfd881b45166119fce39b1fa639e925f80e4e7391e3cbe83f843490b7b19

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 13 Jan 2020 22:32:13 GMT
ETag
"4924cebd65decf1:0"
Last-Modified
Thu, 02 Oct 2014 17:24:37 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Type
image/png
Cache-Control
no-cache
Accept-Ranges
bytes
Content-Length
2080

Redirect headers

Location
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/logo_20141002.png
Server
BigIP
Connection
Keep-Alive
Content-Length
0
plus-anytime_anywhere-190x294.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/
Redirect Chain
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/plus-anytime_anywhere-190x294.png
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/plus-anytime_anywhere-190x294.png
9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/plus-anytime_anywhere-190x294.png
Requested by
Host: livre96.com
URL: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
db18ad437ed30b29a15bb4a394df2f29cd5073ccab904b6ed5e2cf870530dc62

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 13 Jan 2020 22:32:13 GMT
ETag
"af449aea8252d31:0"
Last-Modified
Tue, 31 Oct 2017 20:00:35 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Type
image/png
Cache-Control
no-cache
Accept-Ranges
bytes
Content-Length
9209

Redirect headers

Location
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/plus-anytime_anywhere-190x294.png
Server
BigIP
Connection
Keep-Alive
Content-Length
0
ssllogo.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/
Redirect Chain
  • http://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif
  • https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif
1023 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif
Requested by
Host: livre96.com
URL: https://livre96.com/wp-includes/c/RackSpace/rackspace.html
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
2001:4802:7a01:10::7 , United States, ASN27357 (RACKSPACE - Rackspace Hosting, US),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
bdad796e4ae503ca04d1227dbdc8e4934802aa9f828b0c81ca7f1588b7b04ade

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Mon, 13 Jan 2020 22:32:13 GMT
ETag
"0ee3cf896d7cb1:0"
Last-Modified
Mon, 28 Feb 2011 22:29:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
Content-Type
image/gif
Cache-Control
no-cache
Accept-Ranges
bytes
Content-Length
1023

Redirect headers

Location
https://cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ssllogo.gif
Server
BigIP
Connection
Keep-Alive
Content-Length
0
conversion.js
www.googleadservices.com/pagead/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ajax.googleapis.com
URL
http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rackspace (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate boolean| _wm_redirect function| onFormSubmit object| Webmail object| $Login object| $TEAEncrypt number| google_conversion_id string| google_conversion_language string| google_conversion_format string| google_conversion_color string| google_conversion_label number| google_conversion_value

0 Cookies