www.haloffshore.in
Open in
urlscan Pro
166.62.28.134
Malicious Activity!
Public Scan
Submitted URL: http://rt.willio.id/
Effective URL: https://www.haloffshore.in/x28zal2am/log_in/?sslchannel=true&sessionid=RftXUGoKdludtVYh41jSL3h2865Oe3t6jW3dDsYQNs4hn2zr3SjP...
Submission: On September 25 via manual from US
Effective URL: https://www.haloffshore.in/x28zal2am/log_in/?sslchannel=true&sessionid=RftXUGoKdludtVYh41jSL3h2865Oe3t6jW3dDsYQNs4hn2zr3SjP...
Submission: On September 25 via manual from US
Summary
This website contacted 3 IPs
in 3 countries
across 4 domains to perform 15 HTTP transactions.
The main IP is 166.62.28.134, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US.
The main domain is www.haloffshore.in.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 12th 2019. Valid for: a year.
This is the only time www.haloffshore.in was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 12th 2019. Valid for: a year.
This is the only time www.haloffshore.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 209.58.165.102 209.58.165.102 | 59253 (LEASEWEB-...) (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd.) | |
| 12 | 166.62.28.134 166.62.28.134 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:817::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 2 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 15 | 3 |
1
209.58.165.102
(Singapore, Singapore)
ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG)
PTR: mop103.hostmop.com
ASN59253 (LEASEWEB-APAC-SIN-11 Leaseweb Asia Pacific pte. ltd., SG)
PTR: mop103.hostmop.com
| rt.willio.id |
12
166.62.28.134
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-28-134.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-166-62-28-134.ip.secureserver.net
| www.haloffshore.in |
1
2a00:1450:4001:817::200a
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| fonts.googleapis.com |
2
2a00:1450:4001:825::2003
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| fonts.gstatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
haloffshore.in
www.haloffshore.in |
160 KB |
| 2 |
gstatic.com
fonts.gstatic.com |
18 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
929 B |
| 1 |
willio.id
1 redirects
rt.willio.id |
258 B |
| 15 | 4 |
| Domain | Requested by | |
|---|---|---|
| 12 | www.haloffshore.in |
www.haloffshore.in
|
| 2 | fonts.gstatic.com |
www.haloffshore.in
|
| 1 | fonts.googleapis.com |
www.haloffshore.in
|
| 1 | rt.willio.id | 1 redirects |
| 15 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| docs.microsoft.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| haloffshore.in Sectigo RSA Domain Validation Secure Server CA |
2019-09-12 - 2020-09-11 |
a year | crt.sh |
| *.googleapis.com GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
| *.google.com GTS CA 1O1 |
2019-09-05 - 2019-11-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.haloffshore.in/x28zal2am/log_in/?sslchannel=true&sessionid=RftXUGoKdludtVYh41jSL3h2865Oe3t6jW3dDsYQNs4hn2zr3SjPVBS3HXSW0m2ji5xWyvMlYQDlTcNX
Frame ID: F266B7DAFE56B0B5C6F3489D6D6C8B41
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://rt.willio.id/
HTTP 301
https://www.haloffshore.in/x28zal2am/ Page URL
- https://www.haloffshore.in/x28zal2am/log_in/?sslchannel=true&sessionid=RftXUGoKdludtVYh41jSL3h2865Oe3t6... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://docs.microsoft.com/
Title:
Title:
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/
Title: Get started here.
Title: Get started here.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://rt.willio.id/
HTTP 301
https://www.haloffshore.in/x28zal2am/ Page URL
- https://www.haloffshore.in/x28zal2am/log_in/?sslchannel=true&sessionid=RftXUGoKdludtVYh41jSL3h2865Oe3t6jW3dDsYQNs4hn2zr3SjPVBS3HXSW0m2ji5xWyvMlYQDlTcNX Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://rt.willio.id/ HTTP 301
- https://www.haloffshore.in/x28zal2am/
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
/
www.haloffshore.in/x28zal2am/ Redirect Chain
|
203 B 323 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
www.haloffshore.in/x28zal2am/log_in/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
qbox_login.css
www.haloffshore.in/x28zal2am/log_in/uij/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jqueryui.css
www.haloffshore.in/x28zal2am/log_in/uij/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
s.js
www.haloffshore.in/x28zal2am/log_in/uij/ |
510 KB 138 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ajax-loader.gif
www.haloffshore.in/x28zal2am/log_in/uij/ |
8 KB 8 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
microsoft_logo.svg
www.haloffshore.in/x28zal2am/log_in/uij/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
11 KB 929 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
overlay.png
www.haloffshore.in/images/ |
335 B 335 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
email_icon.png
www.haloffshore.in/x28zal2am/log_in/uij/ |
347 B 424 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
password.png
www.haloffshore.in/x28zal2am/log_in/uij/ |
879 B 964 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
lock.png
www.haloffshore.in/x28zal2am/log_in/uij/ |
409 B 486 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
0.jpg
www.haloffshore.in/x28zal2am/log_in/uij/ |
343 B 343 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)107 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| DOM function| trim function| checkLen function| onError function| onError2 function| validate function| checkCardNum function| evalForm function| cardExpiry function| isNumberKey function| compare function| rrighttrim function| dotTrim function| matchNames function| matchinChar function| callNanoScroller function| set_branch_code function| open_move_modal function| resize_win function| fixed_header_table function| fixmenuposition function| ajax_finish function| ajax_start function| json_callback function| open_updater function| close_updater function| notice function| notice_fade function| notice_hide function| callAjax function| load_duplicate function| duplicate_root function| send_invite function| displayTeamMember function| display_action_result function| get_change_bill_cycle function| format_decimal function| show_dialog function| pay_associate_commission function| edit_pay_associate_commission function| format_currency function| display_associate_free_folders function| display_associate_class_data function| fetch_associate_class function| check_arr_val function| sync_ad_users function| post_update_users function| update_users function| open_delete_confirmation function| add_changed_id function| add_ad_users function| update_branch function| handle_enter_for_update function| validate_inputs function| enable_inputs function| handle function| update_ldap function| password_validation function| sessPingServer function| sessServerAlive function| initSessionMonitor function| startIdleTime function| stopIdleTime function| checkIdleTimeout function| countdownDisplay function| sessLogOut function| set_password_callback boolean| flg object| emailValidation object| emailreg object| emailregIND object| alphachar object| userName object| alphanum object| phone object| phoneIND object| intnum object| pincodeIND object| pincode object| dt object| zeros object| htmltag object| cvvCC object| atleast_one_digit object| atleast_one_letter object| atleast_one_capital_letter object| atleast_one_special_letter boolean| done boolean| duplicate_query_needed number| sessServerAliveTime number| sessionTimeout undefined| sessLastActivity undefined| idleTimer undefined| remainingTimer boolean| isTimout undefined| sess_intervalID undefined| idleIntervalID undefined| sess_lastActivity undefined| timer boolean| isIdleTimerOn function| $ function| jQuery function| DP_jQuery_1569439383560 object| jQuery182002431814154067702 undefined| ass_class0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
rt.willio.id
www.haloffshore.in
166.62.28.134
209.58.165.102
2a00:1450:4001:817::200a
2a00:1450:4001:825::2003
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
06294e756d86f366ba20be4a20210323334ded1934537cce05a3f1d7cde882fb
0f7363bd5956109f348016886a449f89db2f29f62f38b86c3c092bfd535e2b21
1acd98c2997a38d0024a6e77f7cbb0f71d92ccb53826e29e456af1e75dcb7112
1b98ce3d345c4c32291c2336516046874c9bcf4a4f1dbcf477c1a3e6f0c380b3
1e9055ee42b3ae88d379f715b47ea51bda4e74752eba6e91185a7364f4965667
3ccbc566d4a10dee2e54e068fc9b650954838c26027b861ec61494d1d0c34e3b
3d1e0b130d6d03df02555ce3e2ab4f6ee8ec3a2d59deb614b4db114b2d78d5a9
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
6da17873bf3426fe821dd6f2b28759e752ef178dbf322b963e53d73010bb8dc1
825c003ec37f22a6312471dcb72664504a62782f6d7e251325e14838c7704e33
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
bff3efd5bba3910c780c89b982ec4d28cb09cdcec825d7a21caf9ebc43bd5274
de661b37c7db864e909e09397476a1845183271ec5e8dc9db7379ee8186d2dc6
e26959d70269e167bb567bf109e001cdc4aaf6c1f33ec549274b7b39adda47c9