www.designcode.io Open in urlscan Pro
108.163.139.13 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.designcode.io/content/sections/manager/braamfontein/office.php
Submission: On May 21 via automatic, source openphish (May 21st 2018, 8:38:52 pm UTC)

Summary HTTP 5 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 108.163.139.13, located in Montréal, Canada and belongs to IWEB-AS - iWeb Technologies Inc., CA. The main domain is www.designcode.io.
TLS certificate: Issued by GeoTrust SSL CA - G3 on September 29th 2017. Valid for: a year.

This is the only time www.designcode.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address		AS Autonomous System
4	108.163.139.13 108.163.139.13		32613 (IWEB-AS) (IWEB-AS - iWeb Technologies Inc.)
1	2.20.23.219 2.20.23.219		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	2

4 108.163.139.13 (Montréal, Canada)

ASN32613 (IWEB-AS - iWeb Technologies Inc., CA)
PTR: vps1412.astralinternet.com

www.designcode.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.23.219 (European Union)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-23-219.deploy.static.akamaitechnologies.com

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	designcode.io www.designcode.io	211 KB
1	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	1 KB
5	2

	Domain	Requested by
4	www.designcode.io	www.designcode.io
1	secure.aadcdn.microsoftonline-p.com	www.designcode.io
5	2

This site contains no links.

Subject Issuer	Validity	Valid
designcode.io GeoTrust SSL CA - G3	`2017-09-29` - `2018-11-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.designcode.io/content/sections/manager/braamfontein/office.php
Frame ID: 5DFA060377AD912B9495E2DFA5D9D9B7
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

213 kB
Transfer

226 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request office.php Show response
www.designcode.io/content/sections/manager/braamfontein/ 15 KB
5 KB 449ms
126ms Document
text/html 108.163.139.13
iWeb Technologies...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.designcode.io/content/sections/manager/braamfontein/office.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.163.139.13 Montréal, Canada, ASN32613 (IWEB-AS - iWeb Technologies Inc., CA),

Reverse DNS

vps1412.astralinternet.com

Software

Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.4.39

Resource Hash

32feeea8419e569d84b17a4de56f538eeceecf11d8bf1c84208d316d0bb11bdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400;

Request headers

Host: www.designcode.io
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 5DFA060377AD912B9495E2DFA5D9D9B7

Response headers

Date: Mon, 21 May 2018 20:38:40 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.4.39
Cache-Control: max-age=0
Expires: Mon, 21 May 2018 20:38:40 GMT
X-UA-Compatible: IE=edge
Strict-Transport-Security: max-age=16070400;
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4208
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK style.css
www.designcode.io/content/sections/manager/braamfontein/css/ 8 KB
3 KB 108ms
107ms Stylesheet
text/css 108.163.139.13
iWeb Technologies...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.designcode.io/content/sections/manager/braamfontein/css/style.css

Requested by

Host: www.designcode.io
URL: https://www.designcode.io/content/sections/manager/braamfontein/office.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.163.139.13 Montréal, Canada, ASN32613 (IWEB-AS - iWeb Technologies Inc., CA),

Reverse DNS

vps1412.astralinternet.com

Software

Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /

Resource Hash

257af25056e896105cc8839d3ae4fa51f0635ace7ada02e23bb76dc22cda61bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400;

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.designcode.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Mon, 21 May 2018 20:38:40 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Dec 2017 20:27:24 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Vary: Accept-Encoding
Strict-Transport-Security: max-age=16070400;
Content-Type: text/css; charset=utf-8
Cache-Control: max-age=31536000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2369
Expires: Tue, 21 May 2019 20:38:40 GMT

GET
H/1.1 200
OK bannerlogo.png
www.designcode.io/content/sections/manager/braamfontein/css/ 4 KB
5 KB 215ms
106ms Image
image/png 108.163.139.13
iWeb Technologies...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.designcode.io/content/sections/manager/braamfontein/css/bannerlogo.png

Requested by

Host: www.designcode.io
URL: https://www.designcode.io/content/sections/manager/braamfontein/office.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.163.139.13 Montréal, Canada, ASN32613 (IWEB-AS - iWeb Technologies Inc., CA),

Reverse DNS

vps1412.astralinternet.com

Software

Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /

Resource Hash

fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400;

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.designcode.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Mon, 21 May 2018 20:38:40 GMT
Last-Modified: Fri, 08 Dec 2017 20:27:24 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Strict-Transport-Security: max-age=16070400;
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 4585
Expires: Wed, 20 Jun 2018 20:38:40 GMT

GET
H/1.1 200
OK microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.4276.9/content/images/ 1 KB
1 KB 27ms
5ms Image
image/png 2.20.23.219
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.4276.9/content/images/microsoft_logo.png

Requested by

Host: www.designcode.io
URL: https://www.designcode.io/content/sections/manager/braamfontein/office.php

Protocol

HTTP/1.1

Server

2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-20-23-219.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Mon, 21 May 2018 20:38:41 GMT
Last-Modified: Fri, 10 Jun 2016 21:37:39 GMT
Content-MD5: 5LZ1AH3GSS7lkBMdH337sw==
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=143209
Connection: keep-alive
Content-Length: 1040

GET
H/1.1 200
OK heroillustration.png
www.designcode.io/content/sections/manager/braamfontein/css/ 199 KB
199 KB 107ms
107ms Image
image/png 108.163.139.13
iWeb Technologies...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.designcode.io/content/sections/manager/braamfontein/css/heroillustration.png

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

108.163.139.13 Montréal, Canada, ASN32613 (IWEB-AS - iWeb Technologies Inc., CA),

Reverse DNS

vps1412.astralinternet.com

Software

Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /

Resource Hash

7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400;

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.designcode.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
Connection: keep-alive
Cache-Control: no-cache
Referer: https://www.designcode.io/content/sections/manager/braamfontein/office.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Mon, 21 May 2018 20:38:40 GMT
Last-Modified: Fri, 08 Dec 2017 20:27:24 GMT
Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Strict-Transport-Security: max-age=16070400;
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 203294
Expires: Wed, 20 Jun 2018 20:38:40 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=16070400;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secure.aadcdn.microsoftonline-p.com
www.designcode.io
108.163.139.13
2.20.23.219
257af25056e896105cc8839d3ae4fa51f0635ace7ada02e23bb76dc22cda61bf
32feeea8419e569d84b17a4de56f538eeceecf11d8bf1c84208d316d0bb11bdc
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603