18-116-64-79.cprapid.com
Open in
urlscan Pro
18.116.64.79
Malicious Activity!
Public Scan
Effective URL: https://18-116-64-79.cprapid.com/app-cra-ref/
Submission: On June 22 via manual from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 20th 2021. Valid for: a year.
This is the only time 18-116-64-79.cprapid.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.144.228.40 162.144.228.40 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
12 | 18.116.64.79 18.116.64.79 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700:10:... 2606:4700:10::6816:4bab | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 67.202.94.94 67.202.94.94 | 32748 (STEADFAST) (STEADFAST) | |
15 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: r1-singapore.webserversystems.com
illumin8.com.sg |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-116-64-79.us-east-2.compute.amazonaws.com
18-116-64-79.cprapid.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
cprapid.com
18-116-64-79.cprapid.com |
267 KB |
2 |
amung.us
widgets.amung.us whos.amung.us |
4 KB |
1 |
illumin8.com.sg
illumin8.com.sg |
2 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
12 | 18-116-64-79.cprapid.com |
illumin8.com.sg
18-116-64-79.cprapid.com |
1 | whos.amung.us |
widgets.amung.us
|
1 | widgets.amung.us |
18-116-64-79.cprapid.com
|
1 | illumin8.com.sg | |
15 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
apps4.ams-sga.cra-arc.gc.ca |
www.cra-arc.gc.ca |
Subject Issuer | Validity | Valid | |
---|---|---|---|
18-116-64-79.cprapid.com cPanel, Inc. Certification Authority |
2021-06-20 - 2022-06-20 |
a year | crt.sh |
whos.amung.us Sectigo RSA Domain Validation Secure Server CA |
2020-05-21 - 2022-05-21 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://18-116-64-79.cprapid.com/app-cra-ref/
Frame ID: 918CD865F58773D8E1598240B3CAE630
Requests: 14 HTTP requests in this frame
Frame:
https://18-116-64-79.cprapid.com/app-cra-ref/assets/wmms.svg
Frame ID: 43AAEFC6454E8493585710777FC92355
Requests: 1 HTTP requests in this frame
Frame:
https://18-116-64-79.cprapid.com/app-cra-ref/assets/sig-en.svg
Frame ID: C7038F49CCC43E5E04D4C30E07C452A2
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://illumin8.com.sg/be/ahqczobroxusyii Page URL
- https://18-116-64-79.cprapid.com/app-cra-ref/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Fran�ais
Search URL Search Domain Scan URL
Title: Terms and conditions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://illumin8.com.sg/be/ahqczobroxusyii Page URL
- https://18-116-64-79.cprapid.com/app-cra-ref/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
ahqczobroxusyii
illumin8.com.sg/be/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
18-116-64-79.cprapid.com/app-cra-ref/ |
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wet-boew.css
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
182 KB 182 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.css
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common.css
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
21 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
timeout.css
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
428 B 751 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-leaf.jpg
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-bg.jpg
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sft-deco.gif
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
80 B 402 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sft-deco-leaf.gif
18-116-64-79.cprapid.com/app-cra-ref/assets/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
small.js
widgets.amung.us/ |
8 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
wmms.svg
18-116-64-79.cprapid.com/app-cra-ref/assets/ Frame 43AA |
5 KB 5 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sig-en.svg
18-116-64-79.cprapid.com/app-cra-ref/assets/ Frame C703 |
11 KB 11 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
whos.amung.us/pingjs/ |
29 B 145 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| checkLuhn function| checkSin object| _wau object| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_lrs function| WAU_cps function| docReady object| x string| x1 string| x20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
18-116-64-79.cprapid.com
illumin8.com.sg
whos.amung.us
widgets.amung.us
162.144.228.40
18.116.64.79
2606:4700:10::6816:4bab
67.202.94.94
0298a25db873588e37945ece2b90e9f573dda86bfc84ae9f3efb8c3fbdcbce84
352e74be133b2633ede15ab1d9f60703978fe5c748571d79df4eb5b78cc11bdd
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
447a4a6c6d785d6fc009367d1fd835b3245114e3162a5dafe288ea54ffd7e0c7
4abb822643a858c9b438cad647548f83e2212ae25f714b11a436360bb507dcac
508d1167367486f2f605cdd5f2c5ff7ace65576343c9b492622b61abf160e266
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
546cf8ce8330bb243f37c8be0f73230a352d0aae0e911982471fca8d84c74eaf
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
7067890d8b973c617305c53dfa51af06d1d6a52d9b448f5d285ba02a1870a1fe
79dd1a03ecd39468cdcd0f1b60cef4b717a0f9270392ff14b95f28b4025e9e2b
8f977a0316128ef82012696dd5c0e2325fe894451eff1e54b9677e66efcf539d
93c11c985807fa11dee8e93dabece88c3b74c1e945fa8911c032e75ddd2a6f2d
d2ce26bd8d22c5ec8878dbc407facd9e8d9d4c5c036944a9183686409434f17d
ee5df666dfb2376ce7c2cfa1a49eaaf6d322c4a6189ab4de221f3cd27f603c90
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac