customercare.dev.vfpartnerservices.com
Open in
urlscan Pro
52.212.241.25
Malicious Activity!
Public Scan
Submitted URL: https://customercare.dev.vfpartnerservices.com/
Effective URL: https://customercare.dev.vfpartnerservices.com/admin
Submission: On February 19 via automatic, source certstream-suspicious
Effective URL: https://customercare.dev.vfpartnerservices.com/admin
Submission: On February 19 via automatic, source certstream-suspicious
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 5 HTTP transactions.
The main IP is 52.212.241.25, located in
Dublin, Ireland and
belongs to AMAZON-02, US.
The main domain is customercare.dev.vfpartnerservices.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 19th 2020. Valid for: 3 months.
This is the only time customercare.dev.vfpartnerservices.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on February 19th 2020. Valid for: 3 months.
This is the only time customercare.dev.vfpartnerservices.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Vodafone (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 6 | 52.212.241.25 52.212.241.25 | 16509 (AMAZON-02) (AMAZON-02) | |
| 5 | 1 |
6
52.212.241.25
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-241-25.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-241-25.eu-west-1.compute.amazonaws.com
| customercare.dev.vfpartnerservices.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 6 |
vfpartnerservices.com
1 redirects
customercare.dev.vfpartnerservices.com |
1 MB |
| 5 | 1 |
| Domain | Requested by | |
|---|---|---|
| 6 | customercare.dev.vfpartnerservices.com |
1 redirects
customercare.dev.vfpartnerservices.com
|
| 5 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| customercare.dev.vfpartnerservices.com Let's Encrypt Authority X3 |
2020-02-19 - 2020-05-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://customercare.dev.vfpartnerservices.com/admin
Frame ID: 5CA6BB5C3C2247E60EE9284CE9816E80
Requests: 5 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://customercare.dev.vfpartnerservices.com/
HTTP 302
https://customercare.dev.vfpartnerservices.com/admin Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://customercare.dev.vfpartnerservices.com/
HTTP 302
https://customercare.dev.vfpartnerservices.com/admin Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
admin
customercare.dev.vfpartnerservices.com/ Redirect Chain
|
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
entry-admin.js
customercare.dev.vfpartnerservices.com/admin/dist/ |
1 MB 1 MB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
getAllUsers
customercare.dev.vfpartnerservices.com/api/ |
2 B 97 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
4dbec2f38d8780ddb9ade4a7993a7811.jpg
customercare.dev.vfpartnerservices.com/admin/dist/ |
45 KB 45 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
VodafoneLt.woff
customercare.dev.vfpartnerservices.com/admin/dist/fonts/ |
25 KB 25 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Vodafone (Telecommunication)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate string| opco string| language string| adminRoot string| selfcareRoot string| environment function| browserSupportsAllFeatures function| loadScript function| __cdnAssetPath object| __$$GLOBAL_REWIRE_REGISTRY__ function| __rewire_reset_all__ number| __$$GLOBAL_REWIRE_NEXT_MODULE_ID__ object| __SECRET_EMOTION__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
customercare.dev.vfpartnerservices.com
52.212.241.25
01839303dbcdcbcfbf7a77ed28fa81a3420dc03174d22cd30dabf096ac900632
1eae84d47a02419a0d8ac8aeb8dd586a2d40a3f3d4c317b3b93e689c34f2b17a
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
823b74c12e4c31c69ed2c8e58d0fa035c71170d0a1ec2a1f975f025a96248518
f270992ec6c2ca4a4fb816222f5572908c386b75917f120bbf11099a3ff1e7f0