facesitting.za.net
Open in
urlscan Pro
192.185.12.229
Malicious Activity!
Public Scan
Submission: On September 08 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 7th 2020. Valid for: 3 months.
This is the only time facesitting.za.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 192.185.12.229 192.185.12.229 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
9 | 45.60.13.52 45.60.13.52 | 19551 (INCAPSULA) (INCAPSULA) | |
1 | 185.67.45.137 185.67.45.137 | 201682 (LIQUID-WE...) (LIQUID-WEB-BV) | |
5 | 2a00:1450:400... 2a00:1450:4001:824::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c01::9c | 15169 (GOOGLE) (GOOGLE) | |
21 | 6 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-12-229.unifiedlayer.com
facesitting.za.net |
ASN19551 (INCAPSULA, US)
cdn.clareitysecurity.net | |
collector.clareity.net |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
clareitysecurity.net
cdn.clareitysecurity.net |
1 MB |
5 |
google-analytics.com
www.google-analytics.com |
18 KB |
4 |
za.net
facesitting.za.net |
10 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
85 B |
1 |
novosco.com
www.novosco.com |
58 KB |
1 |
clareity.net
collector.clareity.net |
5 KB |
0 |
jquery.com
Failed
code.jquery.com Failed |
|
21 | 7 |
Domain | Requested by | |
---|---|---|
8 | cdn.clareitysecurity.net |
facesitting.za.net
cdn.clareitysecurity.net |
5 | www.google-analytics.com |
cdn.clareitysecurity.net
www.google-analytics.com facesitting.za.net |
4 | facesitting.za.net |
facesitting.za.net
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.novosco.com |
facesitting.za.net
|
1 | collector.clareity.net |
facesitting.za.net
|
0 | code.jquery.com Failed |
facesitting.za.net
|
21 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.google.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
webmail.facesitting.za.net Let's Encrypt Authority X3 |
2020-09-07 - 2020-12-06 |
3 months | crt.sh |
cdn.clareitysecurity.net DigiCert SHA2 High Assurance Server CA |
2020-03-31 - 2022-04-05 |
2 years | crt.sh |
*.clareity.net DigiCert SHA2 High Assurance Server CA |
2020-01-06 - 2022-01-10 |
2 years | crt.sh |
*.novosco.com Go Daddy Secure Certificate Authority - G2 |
2019-01-21 - 2021-02-15 |
2 years | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-08-19 - 2020-11-11 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1O1 |
2020-08-19 - 2020-11-11 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://facesitting.za.net/CD/Login/Login.htm
Frame ID: 3DEEDB9238934FE1A0C743CFE93004EA
Requests: 18 HTTP requests in this frame
Frame:
https://facesitting.za.net/idp/server.jsp
Frame ID: 1E56DDDD66DC905A5FE598FF068A9DA4
Requests: 4 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
- script /jquery-ui.*\.js/i
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- script /jquery-ui.*\.js/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: UA-39826640-43
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
Login.htm
facesitting.za.net/CD/Login/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
cdn.clareitysecurity.net/css/ |
10 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
cdn.clareitysecurity.net/js/ |
91 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginxkd-dd-2.9.min.js
cdn.clareitysecurity.net/js/ |
41 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1583937068116
collector.clareity.net/kdl/ |
18 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
googletrack.js
cdn.clareitysecurity.net/sys/alberta/ |
651 B 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Office-365.jpg
www.novosco.com/images/easyblog_articles/37/ |
58 KB 58 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
45 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
server.jsp
facesitting.za.net/idp/ Frame 1E56 |
12 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
paragon-login-background.png
cdn.clareitysecurity.net/sys/alberta/ |
860 KB 862 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
paragon-login-bg.png
cdn.clareitysecurity.net/sys/alberta/ |
395 KB 396 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.min.js
cdn.clareitysecurity.net/js/ |
86 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.min.css
cdn.clareitysecurity.net/css/ |
30 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
2 B 126 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
1 B 25 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 85 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
simple-expand.min.js
facesitting.za.net/cgi-sys/js/ Frame 1E56 |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
x.png
facesitting.za.net/cgi-sys/images/ Frame 1E56 |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery-3.3.1.min.js
code.jquery.com/ Frame 1E56 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
collect
www.google-analytics.com/ |
35 B 63 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
collect
www.google-analytics.com/ |
35 B 57 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- code.jquery.com
- URL
- http://code.jquery.com/jquery-3.3.1.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)154 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery string| url boolean| isOnQA boolean| alertMe undefined| debugit boolean| ie8 function| isIE string| requiredKd string| idpurl string| cdnUrl string| jQueryUiUrl string| jQueryUiCssUrl string| ie8CssUrl string| inputs string| pleasewait string| loginTypeVal string| loginTypeMsg string| failureMsgId string| failMsg string| logincssMsg string| logoMsg string| loginbtnMsg string| loginXkdMsg string| loginformMsg string| warnalert number| keyedChars boolean| isChrome object| loginXkdId string| loginXkdUrl undefined| oldbrowserWarnData undefined| oldbrowserUrlData undefined| setFocus undefined| inputAutoData undefined| disablePageData undefined| backSpaceClearData undefined| savePwdData undefined| fakeSafariPwdData undefined| fakeChromePwdData undefined| fontIconsData undefined| redirectUrlData undefined| idpTimeoutData undefined| secondsLeftData undefined| sessionWarnData undefined| loadingData undefined| collectorIcon undefined| kdIconData boolean| oldie function| cdnCheck string| googleTrackMsg string| googleJsUrlMsg string| googleJsUrlCdnMsg string| mlsgooglecode boolean| trackit function| googleCheck string| forgotPwdUrlMsg string| changePwdUrlMsg function| passLinks string| setFocusMsg object| usernameInput function| setInputFocus string| inputAutoMsg boolean| autocomp function| autoComplete string| disablePageMsg string| disablePageDiv boolean| disablepage string| backSpaceClearMsg boolean| backspace function| backspaceClear string| savePwdMsg boolean| savepassword string| fakeSafariPwdMsg boolean| fakepwdadded boolean| fakepwd function| fakeSafariPwd string| fakeChromePwdMsg function| fakeChromePwd string| fontIconsUrl string| fontIconsMsg boolean| fontawesome function| iconsFonts string| redirectUrl string| redirectUrlMsg number| idpTimeout string| idpTimeoutMsg number| secondsLeft string| secondsLeftMsg string| sessionWarnMsg boolean| sessionWarnMe string| sessionDialogHtml function| sessionPop function| runSessionDialog object| assocDropdownId object| assocDropdownRememberJsId undefined| assocDropdownRememberJsUrl string| assocDropdownRememberJsMsg string| assocDropdownMsg string| assocDropdownCookieMsg boolean| assocDrop object| assocDropdownCookie function| checkDropDown function| setDropDown function| saveDropdown function| inputCheck object| loadingId string| loadingMsg object| loginFormId string| loginFormMsg function| showInputs string| checkBootStrapMsg boolean| useboostrap function| checkBootStrap string| ssoTypeMsg function| ssoType function| basicLogin function| doLogin function| keyPress function| submitLoginForm object| collectIframe string| collectorMsg string| collectorIconMsg boolean| collectorchecker function| checkCollector function| collecterSet boolean| docollect function| collectObjectCheck object| kdCollecterId string| kdCollecterMsg string| kdIconMsg boolean| didkdload function| loginKd string| qaDialogHtml function| runQaDialog function| qaDialog boolean| fakechromepwdadded boolean| fakechromepwd function| initCallback_3xkd function| validCallback_3xkd function| kdFailed_3xkd object| CLAREITY object| _0xb3d3 object| b64 object| _0x6bf2 function| CLAREITY_KD function| madKD_getVersion function| xkd string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.facesitting.za.net/ | Name: _gat_newTracker Value: 1 |
|
.facesitting.za.net/ | Name: _gat Value: 1 |
|
.facesitting.za.net/ | Name: _gid Value: GA1.3.2032666272.1599588816 |
|
.facesitting.za.net/ | Name: _ga Value: GA1.3.1098286981.1599588816 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.clareitysecurity.net
code.jquery.com
collector.clareity.net
facesitting.za.net
stats.g.doubleclick.net
www.google-analytics.com
www.novosco.com
code.jquery.com
185.67.45.137
192.185.12.229
2a00:1450:4001:824::200e
2a00:1450:400c:c01::9c
45.60.13.52
00f973f96f9fcebd037f59485a24ac1f3f073d0fb20879ddf445265c7ef77d87
02324fbade97fbc223834e6afa838dc1e01185bd0393f8e26e084834b512ae69
0a27dc147ed1d0048a35f49ae3977452fd2050a59a569f790954afdf7f170c33
15cc6fc3f739fa8573e2785f1f6af0cff8cebd1118a4b4f11df63d0f51c3bb64
17cecc18ee875908251a0ab107cc1ec9dd5fe73af2b759caa69316f5793c85b9
1dcab816ca5ee2317f01c1822391bcf8d8f9fdfaa3e5d776592d6c3ce6e559af
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
2c024e287d53dcc084b60b01a69990c369e758dc7c91b0fe4791f02d18aae61a
5265f71403a318cdbeb0c4ec01dbba2f00fbc8f046b0a79e40e8abe675b398ce
64907bac65b3d6080557dbc26e2cc1ec94433cce8a4b7ad63dcf7ba4b959f948
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7989430e3c85121caa76c6da31aa38d43ef139062e2c3bd4f4350b62fe90d4d4
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9de5950e705f78d02ae70cc5ee55ee333562d8ec083384f64e8d4a401a809e7a
b0768898b0cf8b136b2fc00ac30c4e6884c6cdffeecb990f3706c1a12cd7ed0c
b7e5367878f252a70a3eaecd650b0613a9bf53439c6a73fc76213fab103baad9
bccb23d41c2cc69cf0c7d22c4314ca8181a513c6999b73e45307792830f4e482
d4c1acdde2d8dc96d4347a5da9c0a7198dfb1985fc6b863511f6eaa7bde4cc99
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af