![](/screenshots/8178b9b0-ec76-422d-81b8-a3f8279ddda3.png)
www7.avantgardestatement.xyz
Open in
urlscan Pro
2606:4700::6812:4595
Malicious Activity!
Public Scan
Effective URL: https://www7.avantgardestatement.xyz/iwxb/rimnc/index-en-c-xs.html?td=www.watervilleireland.com&browser=Chrome&country=United%20Kingd...
Submission: On August 13 via api from BE
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on July 3rd 2019. Valid for: a year.
This is the only time www7.avantgardestatement.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.162.69.134 192.162.69.134 | 16347 (RMI-FITECH) (RMI-FITECH) | |
2 4 | 65.98.48.235 65.98.48.235 | 25653 (FORTRESSITX) (FORTRESSITX - FortressITX) | |
1 | 178.32.104.162 178.32.104.162 | 16276 (OVH) (OVH) | |
1 1 | 104.17.214.35 104.17.214.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
22 | 2606:4700::68... 2606:4700::6812:4595 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
25 | 3 |
ASN16347 (RMI-FITECH, FR)
PTR: bestdeals-shopping.com
bestdeals-shopping.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.watervilleireland.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www7.avantgardestatement.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
avantgardestatement.xyz
www7.avantgardestatement.xyz |
86 KB |
4 |
carblck.com
2 redirects
carblck.com |
3 KB |
1 |
watervilleireland.com
1 redirects
www.watervilleireland.com |
1 KB |
1 |
laudypauty.com
laudypauty.com |
417 B |
1 |
bestdeals-shopping.com
1 redirects
bestdeals-shopping.com |
280 B |
25 | 5 |
Domain | Requested by | |
---|---|---|
22 | www7.avantgardestatement.xyz |
laudypauty.com
www7.avantgardestatement.xyz |
4 | carblck.com |
2 redirects
carblck.com
|
1 | www.watervilleireland.com | 1 redirects |
1 | laudypauty.com |
carblck.com
|
1 | bestdeals-shopping.com | 1 redirects |
25 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
carblck.com Let's Encrypt Authority X3 |
2019-07-09 - 2019-10-07 |
3 months | crt.sh |
www.laudypauty.com Go Daddy Secure Certificate Authority - G2 |
2019-04-30 - 2020-06-28 |
a year | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-07-03 - 2020-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www7.avantgardestatement.xyz/iwxb/rimnc/index-en-c-xs.html?td=www.watervilleireland.com&browser=Chrome&country=United%20Kingdom&city=London&os=MacOS&pr=$999&yp=$1&cep=i83Zs-aRqyXGwtK4a9s9YpkfcJVVG-RisXcMnorKBcFeoU2vEnvEaPIq-7DyctH5aSnqRQCwYReomi7MNvGQZrfcVBvkGFYs7fQ-pTkVICWaD29pn5aNqMlqDok-FZ1PGRCu1dBO7AI-eTjmpv-Zp55i8P_22t_BehXGPPTUCUMIneb7Gpv4KZ3EWymsV1PMTkrMkJqn1Blms9ZNcN1Tbg4vtzSheDNdhGlqoE3ziJK_H_FL4TcqzR917ovhpDh8ISb1LoQjCXdFQZ60ngPHAoSTs4XC923Bd7q_dQeui39qcWasVuaHsOcJxusaNuZg&lptoken=15b765ed6966673585b1&4=&3=&5=&6=&7=&8=472125&2=&1=843172696&s1=472125&s0=843172696
Frame ID: 7FB95D11CD24F1EDF30666F6F0399FE5
Requests: 25 HTTP requests in this frame
Screenshot
![](/screenshots/8178b9b0-ec76-422d-81b8-a3f8279ddda3.png)
Page URL History Show full URLs
-
http://bestdeals-shopping.com/5345wn16861325io7273jg22697hs1798td1951rr
HTTP 302
http://carblck.com/r/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/16861325 Page URL
-
https://carblck.com/r2/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/16861325/d108893f-bc01-49da-...
HTTP 302
https://carblck.com/r/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325//?fctr=1&ptid=d10889... Page URL
-
https://carblck.com/r2/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325/4a785474-d5e1-4161-...
HTTP 302
https://laudypauty.com/fff0852e2b321b3800/100/4a785474-d5e1-4161-a46c-a5d393276f26 Page URL
-
https://www.watervilleireland.com/e7d741a7-d679-46b5-82e0-fb8353334c97?4=&3=&5=&6=&7=&8=472125&2=&1=843172696&...
HTTP 302
https://www7.avantgardestatement.xyz/iwxb/rimnc/index-en-c-xs.html?td=www.watervilleireland.com&browser=Chrome&co... Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bestdeals-shopping.com/5345wn16861325io7273jg22697hs1798td1951rr
HTTP 302
http://carblck.com/r/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/16861325 Page URL
-
https://carblck.com/r2/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/16861325/d108893f-bc01-49da-9254-63e58e525511/?fctr=0
HTTP 302
https://carblck.com/r/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325//?fctr=1&ptid=d108893f-bc01-49da-9254-63e58e525511 Page URL
-
https://carblck.com/r2/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325/4a785474-d5e1-4161-a46c-a5d393276f26/?fctr=1&ptid=d108893f-bc01-49da-9254-63e58e525511&red_param_1=http%3A%2F%2Fcarblck.com%2Fr%2F9661026e-8fcb-48d5-9cff-3a8704714f07%2F54%2F5345%2F16861325&fctr=1
HTTP 302
https://laudypauty.com/fff0852e2b321b3800/100/4a785474-d5e1-4161-a46c-a5d393276f26 Page URL
-
https://www.watervilleireland.com/e7d741a7-d679-46b5-82e0-fb8353334c97?4=&3=&5=&6=&7=&8=472125&2=&1=843172696&s1=472125&s0=843172696
HTTP 302
https://www7.avantgardestatement.xyz/iwxb/rimnc/index-en-c-xs.html?td=www.watervilleireland.com&browser=Chrome&country=United%20Kingdom&city=London&os=MacOS&pr=$999&yp=$1&cep=i83Zs-aRqyXGwtK4a9s9YpkfcJVVG-RisXcMnorKBcFeoU2vEnvEaPIq-7DyctH5aSnqRQCwYReomi7MNvGQZrfcVBvkGFYs7fQ-pTkVICWaD29pn5aNqMlqDok-FZ1PGRCu1dBO7AI-eTjmpv-Zp55i8P_22t_BehXGPPTUCUMIneb7Gpv4KZ3EWymsV1PMTkrMkJqn1Blms9ZNcN1Tbg4vtzSheDNdhGlqoE3ziJK_H_FL4TcqzR917ovhpDh8ISb1LoQjCXdFQZ60ngPHAoSTs4XC923Bd7q_dQeui39qcWasVuaHsOcJxusaNuZg&lptoken=15b765ed6966673585b1&4=&3=&5=&6=&7=&8=472125&2=&1=843172696&s1=472125&s0=843172696 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://bestdeals-shopping.com/5345wn16861325io7273jg22697hs1798td1951rr HTTP 302
- http://carblck.com/r/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/16861325
- https://carblck.com/r2/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/16861325/d108893f-bc01-49da-9254-63e58e525511/?fctr=0 HTTP 302
- https://carblck.com/r/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325//?fctr=1&ptid=d108893f-bc01-49da-9254-63e58e525511
- https://carblck.com/r2/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325/4a785474-d5e1-4161-a46c-a5d393276f26/?fctr=1&ptid=d108893f-bc01-49da-9254-63e58e525511&red_param_1=http%3A%2F%2Fcarblck.com%2Fr%2F9661026e-8fcb-48d5-9cff-3a8704714f07%2F54%2F5345%2F16861325&fctr=1 HTTP 302
- https://laudypauty.com/fff0852e2b321b3800/100/4a785474-d5e1-4161-a46c-a5d393276f26
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
16861325
carblck.com/r/9661026e-8fcb-48d5-9cff-3a8704714f07/54/5345/ Redirect Chain
|
691 B 858 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
carblck.com/r/29e028de-409a-4a78-8317-2efe4b5cb991/54/5345/16861325// Redirect Chain
|
843 B 952 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() laudypauty.com/fff0852e2b321b3800/100/ Redirect Chain
|
195 B 417 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index-en-c-xs.html
www7.avantgardestatement.xyz/iwxb/rimnc/ Redirect Chain
|
13 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clean.css
www7.avantgardestatement.xyz/iwxb/rimnc/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pw_ix.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
28 KB 28 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ixo.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
11 KB 11 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ix-s.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
9 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ix-g.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
8 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
like_user_1.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
958 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
like_user_2.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
890 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
828 B 962 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
948 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
808 B 943 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
1010 B 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.jpg
www7.avantgardestatement.xyz/iwxb/rimnc/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
clip_footer_3.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
2 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
footer_right.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
4 KB 4 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
menu_2x.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
96 B 259 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notify_2x.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
154 B 310 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spin_prize2.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
3 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
action_icons_20px_2x.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
1 KB 2 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comment_action_2x.png
www7.avantgardestatement.xyz/iwxb/rimnc/ |
534 B 792 B |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)30 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| getURLParameter function| dateOffset string| page string| brand function| exit_a1 number| conMid object| mydate number| year number| month number| day number| weekday number| count object| headline object| topDate object| today object| con object| whCon object| dWheel object| button object| device object| first object| second function| setButtonHeight function| spin function| autospin2 function| autospin1 function| countdown1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www7.avantgardestatement.xyz/ | Name: __cfduid Value: de30e82e90bcdb563ec3010132cd7a9321565694985 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bestdeals-shopping.com
carblck.com
laudypauty.com
www.watervilleireland.com
www7.avantgardestatement.xyz
104.17.214.35
178.32.104.162
192.162.69.134
2606:4700::6812:4595
65.98.48.235
0c5ab4d82953c75353f423cd3c7d348b7cac91e360cfcc4b1c510f8f749825c4
17b1bac6d12b754c3b4485d3d32055ecba1111b4902e95c967fdf96358081897
199f6ae8518681f58fe56553710092878ec34bd63a279680ef5060229dbf054a
1b9c973cb081b775f103199a18d0a9d8c8f72823233e67c17944e8c987488f3b
264fbf1f90b563680d9e355ade5cab20f929479172e4da394696db222c322322
39720efaecb9e2103ba0e4604ed1c3066786c1c5a6688ba8636c46c08036d434
590013bbb57c0e8702722b161e08062123b5619e460147363062fa7562ec007a
592c2f44dadf2ce19d1656611d4648d3093944e2064c396dfe7fa06b3ab4b00f
59db3ae0bdc235b78511854ea6e0d9b542bf170852bbd6a1eccceca25d78fba6
61db8545a0cf15c9423bbb9df048d0e3d0c4a08989edd2c8638fccd1bbaac3ad
6fee572a382f3159158c8d04430fe53603aa64701f63f4a347f9c4249856e66e
9a0dcf9aaa169200206b3392e0fc135ccf9775e299ea5b2aa92b8e801d0ba6dc
b6e1695c80d5b398b46c750f765f0a34f8d875bfec3069668f02a58bfe7d1d9d
baa206fed393798fb82362aa3f820c2df3739d99e3cc59aa552d89141697de50
be53514225d38726519ababd8f26601b18eb154dde37556d8d7be6e9a85f997c
c0c0d7409264ab4d2bbe3879778b5ec125effdd7782c83b00df0da335ae8c0fb
c2544a2da8deb6f0eeee50349d98c48f3162e1e8af475036c2f8757fc31a5d38
ddc183a8e340a6eb798841f0ba3a079106e45274b7210837e1ebe0c4332cf5da
f3a675245b04458b6ddfc882273ca0a01bfe52b9dc5a8b87a76f71950e8bc2ae
f4db89273f554516136042a6d153eee23c4f47397d07e37457666854b592e667
f8ce943d537d7ac1882652f573847acae2fecf0fc48d409d9a6fd3d5897e6071
fafc87c41ff49a7a48177417b4bad79d619238f063a6458049c2df08792af3d3
fe171f8715eb5aed3d1b2cfbb3f7a5ee7a58ac8d8cd88c8c62f30c9d13d12796