account-activedirectory.gihd.net

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 104.219.248.182, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is account-activedirectory.gihd.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 13th 2020. Valid for: 3 months.

This is the only time account-activedirectory.gihd.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	151.101.65.195 151.101.65.195	54113 (FASTLY) (FASTLY)
1 1	13.238.164.9 13.238.164.9	16509 (AMAZON-02) (AMAZON-02)
4	104.219.248.182 104.219.248.182	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	13.226.155.92 13.226.155.92	16509 (AMAZON-02) (AMAZON-02)
6	3

1 151.101.65.195 (United States)

ASN54113 (FASTLY, US)

owapw1.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.238.164.9 (Sydney, Australia) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: awcp005.server-cpanel.com

ibexinteriors.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.219.248.182 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: ns33.grandlevel.net

account-activedirectory.gihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.92 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-92.dus51.r.cloudfront.net

logo.clearbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	gihd.net account-activedirectory.gihd.net	105 KB
1	clearbit.com logo.clearbit.com	6 KB
1	ibexinteriors.net 1 redirects ibexinteriors.net	321 B
1	firebaseapp.com owapw1.firebaseapp.com	592 B
6	4

	Domain	Requested by
4	account-activedirectory.gihd.net	owapw1.firebaseapp.com account-activedirectory.gihd.net
1	logo.clearbit.com	account-activedirectory.gihd.net
1	ibexinteriors.net	1 redirects
1	owapw1.firebaseapp.com
6	4

This site contains no links.

Subject Issuer	Validity	Valid
firebaseapp.com GTS CA 1O1	`2019-10-28` - `2020-10-26`	a year	crt.sh
account-activedirectory.gihd.net cPanel, Inc. Certification Authority	`2020-08-13` - `2020-11-11`	3 months	crt.sh
clearbit.com Amazon	`2020-05-20` - `2021-06-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Frame ID: CF80793BA6960D84239082D885B34327
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406 Page URL
https://ibexinteriors.net/https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406 HTTP 302
https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E= Page URL

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

112 kB
Transfer

110 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406 Page URL
https://ibexinteriors.net/https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406 HTTP 302
https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 404 s06Lim08j06nm90h06m020309u0504080406 Show response
owapw1.firebaseapp.com/ 515 B
592 B 440ms
346ms Document
text/html 151.101.65.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.65.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

5582b0a4ecb6dca068ce6a3b0fd05dfa05c9667745454ac734913a154f2ffd5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: owapw1.firebaseapp.com
:scheme: https
:path: /s06Lim08j06nm90h06m020309u0504080406
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 404
cache-control: max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
etag: "20533d04045b0f24c2a959c2fb891a45e747c39f6d950f50984f23e87f2f9638"
last-modified: Thu, 13 Aug 2020 12:25:25 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
accept-ranges: bytes
date: Thu, 13 Aug 2020 18:08:38 GMT
x-served-by: cache-hhn4079-HHN
x-cache: MISS
x-cache-hits: 0
x-timer: S1597342118.912877,VS0,VE307
vary: x-fh-requested-host, accept-encoding
content-length: 285

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
account-activedirectory.gihd.net/auth/
Redirect Chain

https://ibexinteriors.net/https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406
https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=

5 KB
6 KB

614ms
238ms

Document
text/html

104.219.248.182
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Requested by: Host: owapw1.firebaseapp.com
URL: https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.219.248.182 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: ns33.grandlevel.net
Software: Apache /
Resource Hash: c6bab26aad3f75ff52b7c34dbae6e8a6c2809bb06eba3fd10cb2942154f6a0f9

Request headers

Host: account-activedirectory.gihd.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://owapw1.firebaseapp.com/s06Lim08j06nm90h06m020309u0504080406

Response headers

Date: Thu, 13 Aug 2020 18:08:40 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=f05a8e09ccac99ca5fa2645ab78772d6; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 13 Aug 2020 18:08:39 GMT
Server: Apache
X-Powered-By: PHP/5.3.29
Location: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Content-Length: 0
Keep-Alive: timeout=3, max=50
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK CookieAuth.css
account-activedirectory.gihd.net/auth/ 78 KB
78 KB 238ms
189ms Stylesheet
text/css 104.219.248.182
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://account-activedirectory.gihd.net/auth/CookieAuth.css
Requested by: Host: account-activedirectory.gihd.net
URL: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.219.248.182 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: ns33.grandlevel.net
Software: Apache /
Resource Hash: e2edd1c0ce07b5199dca81995c0fb2a7d514c1ec8963c1f29c80b59c9de0e94e

Request headers

Referer: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 13 Aug 2020 18:08:40 GMT
Last-Modified: Fri, 10 Jul 2020 07:06:20 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 79486

GET
H/1.1 200
OK logon.js Show response
account-activedirectory.gihd.net/auth/ 18 KB
19 KB 557ms
186ms Script
application/javascript 104.219.248.182
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://account-activedirectory.gihd.net/auth/logon.js
Requested by: Host: account-activedirectory.gihd.net
URL: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.219.248.182 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: ns33.grandlevel.net
Software: Apache /
Resource Hash: bf9a7d642c3575e7e97964c6879f2b0df69bbe506c78524b500ab8ae1fa288da

Request headers

Referer: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 13 Aug 2020 18:08:40 GMT
Last-Modified: Fri, 10 Jul 2020 09:03:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 18740

GET
H/1.1 200
OK logo2.png
account-activedirectory.gihd.net/auth/ 2 KB
3 KB 187ms
187ms Image
image/png 104.219.248.182
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://account-activedirectory.gihd.net/auth/logo2.png
Requested by: Host: account-activedirectory.gihd.net
URL: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.219.248.182 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: ns33.grandlevel.net
Software: Apache /
Resource Hash: d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 13 Aug 2020 18:08:40 GMT
Last-Modified: Fri, 10 Jul 2020 07:09:42 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 2503

GET
H2 200 ubc.ca
logo.clearbit.com/ 6 KB
6 KB 166ms
55ms Image
image/png 13.226.155.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://logo.clearbit.com/ubc.ca
Requested by: Host: account-activedirectory.gihd.net
URL: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.226.155.92 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-92.dus51.r.cloudfront.net
Software: envoy /
Resource Hash: fb670ac5ce00f1dcfd2f491275d388d55755b9b4703f03a3305f1940931fa616

Request headers

Referer: https://account-activedirectory.gihd.net/auth/?client-request-id=c2FsaW0uamFubW9oYW1lZEB1YmMuY2E=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 11 Aug 2020 01:31:40 GMT
via: 1.1 d47fba004c254adb4e354d0cef499808.cloudfront.net (CloudFront)
server: envoy
age: 232621
status: 200
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: gICg9ystEquDXsWF2LsLSMfqiCZ93Y49LcI0E85_pUaAR9t9qanNCg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			account-activedirectory.gihd.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: f05a8e09ccac99ca5fa2645ab78772d6
			account-activedirectory.gihd.net/auth	1970-01-19 11:42:22	Name: cookieTest Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account-activedirectory.gihd.net
ibexinteriors.net
logo.clearbit.com
owapw1.firebaseapp.com
104.219.248.182
13.226.155.92
13.238.164.9
151.101.65.195
5582b0a4ecb6dca068ce6a3b0fd05dfa05c9667745454ac734913a154f2ffd5b
bf9a7d642c3575e7e97964c6879f2b0df69bbe506c78524b500ab8ae1fa288da
c6bab26aad3f75ff52b7c34dbae6e8a6c2809bb06eba3fd10cb2942154f6a0f9
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e2edd1c0ce07b5199dca81995c0fb2a7d514c1ec8963c1f29c80b59c9de0e94e
fb670ac5ce00f1dcfd2f491275d388d55755b9b4703f03a3305f1940931fa616

account-activedirectory.gihd.net Open in urlscan Pro 104.219.248.182 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

112 kBTransfer

110 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

account-activedirectory.gihd.net Open in urlscan Pro
104.219.248.182 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

112 kB
Transfer

110 kB
Size

2
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!