![](/screenshots/8c58f5be-854a-4925-abcc-34ffd36046ec.png)
roxellrichards.com
Open in
urlscan Pro
192.185.5.17
Malicious Activity!
Public Scan
Effective URL: http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e/
Submission: On April 24 via manual from US
Summary
This is the only time roxellrichards.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Charles Schwab (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 395224 (BITLY-AS) (BITLY-AS - Bitly Inc) | |
11 20 | 192.185.5.17 192.185.5.17 | 20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC) | |
1 | 104.108.57.119 104.108.57.119 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
2 | 104.108.66.229 104.108.66.229 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 104.108.43.95 104.108.43.95 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
2 | 104.108.39.8 104.108.39.8 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 54.230.202.177 54.230.202.177 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 162.93.229.167 162.93.229.167 | 6949 (CHARLES-S...) (CHARLES-SCHWAB - Charles Schwab & Co.) | |
24 | 8 |
ASN20013 (CYRUSONE - CyrusOne LLC, US)
roxellrichards.com | |
www.roxellrichards.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-57-119.deploy.static.akamaitechnologies.com
lms.schwab.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-66-229.deploy.static.akamaitechnologies.com
www.schwab.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-43-95.deploy.static.akamaitechnologies.com
tracker.marinsm.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-39-8.deploy.static.akamaitechnologies.com
content.schwab.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-54-230-202-177.fra50.r.cloudfront.net
cdn.appdynamics.com |
ASN6949 (CHARLES-SCHWAB - Charles Schwab & Co., Inc., US)
eum-appd.schwab.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
roxellrichards.com
11 redirects
roxellrichards.com www.roxellrichards.com |
43 KB |
6 |
schwab.com
lms.schwab.com www.schwab.com content.schwab.com eum-appd.schwab.com |
84 KB |
1 |
appdynamics.com
cdn.appdynamics.com |
18 KB |
1 |
marinsm.com
tracker.marinsm.com |
308 B |
1 |
bit.ly
1 redirects
bit.ly |
453 B |
24 | 5 |
Domain | Requested by | |
---|---|---|
12 | roxellrichards.com | 11 redirects |
8 | www.roxellrichards.com |
roxellrichards.com
|
2 | content.schwab.com |
roxellrichards.com
|
2 | www.schwab.com |
roxellrichards.com
|
1 | eum-appd.schwab.com |
roxellrichards.com
|
1 | cdn.appdynamics.com |
roxellrichards.com
|
1 | tracker.marinsm.com |
roxellrichards.com
|
1 | lms.schwab.com |
roxellrichards.com
|
1 | bit.ly | 1 redirects |
24 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
international.schwab.com |
www.schwab.com |
client.schwab.com |
lms.schwab.com |
brokercheck.finra.org |
www.sipc.org |
www.schwab-global.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e/
Frame ID: 4225D5FF29D76D137A42648C654E24C8
Requests: 25 HTTP requests in this frame
Screenshot
![](/screenshots/8c58f5be-854a-4925-abcc-34ffd36046ec.png)
Page URL History Show full URLs
-
https://bit.ly/2Fbskbl
HTTP 301
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb HTTP 301
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/ HTTP 302
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e HTTP 301
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e/ Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Forgot your password?
Search URL Search Domain Scan URL
Title: New user?
Search URL Search Domain Scan URL
Title: Log in to mobile
Search URL Search Domain Scan URL
Title: FINRA's BrokerCheck
Search URL Search Domain Scan URL
Title: member SIPC
Search URL Search Domain Scan URL
Title: non-U.S. residents
Search URL Search Domain Scan URL
Title: Learn more >
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/2Fbskbl
HTTP 301
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb HTTP 301
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/ HTTP 302
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e HTTP 301
http://roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://roxellrichards.com/public/file/PROSPECT-CSS/ps.css HTTP 301
- http://www.roxellrichards.com/public/file/PROSPECT-CSS/ps.css
- http://roxellrichards.com/secure/asset/short/?cmsid=PS-HEAD-SCRIPT-BUNDLE HTTP 301
- http://www.roxellrichards.com/secure/asset/short/?cmsid=PS-HEAD-SCRIPT-BUNDLE
- http://roxellrichards.com/system/asset?cmsid=PS-TAG-HEADER&filename=hbx.js HTTP 301
- http://www.roxellrichards.com/system/asset?cmsid=PS-TAG-HEADER&filename=hbx.js
- http://roxellrichards.com/system/asset/short?cmsid=PR-HOME-EMB,BLANK-ASSET&pgformat=js&persjs=y HTTP 301
- http://www.roxellrichards.com/system/asset/short?cmsid=PR-HOME-EMB,BLANK-ASSET&pgformat=js&persjs=y
- http://roxellrichards.com/system/asset?cmsid=PS-TAG-FOOTER&filename=hbx.js HTTP 301
- http://www.roxellrichards.com/system/asset?cmsid=PS-TAG-FOOTER&filename=hbx.js
- http://roxellrichards.com/system/asset?cmsid=PS-TAG-HEADER&filename=hbx.js HTTP 301
- http://www.roxellrichards.com/system/asset?cmsid=PS-TAG-HEADER&filename=hbx.js
- http://roxellrichards.com/public/file/P-6220301/CharlesModern-Light.woff HTTP 301
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Light.woff
- http://roxellrichards.com/system/asset/short?cmsid=PR-HOME-EMB,BLANK-ASSET&pgformat=js&persjs=y HTTP 301
- http://www.roxellrichards.com/system/asset/short?cmsid=PR-HOME-EMB,BLANK-ASSET&pgformat=js&persjs=y
- http://roxellrichards.com/public/file/P-6220301/CharlesModern-Light.ttf HTTP 301
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Light.ttf
- http://roxellrichards.com/system/asset?cmsid=PS-TAG-FOOTER&filename=hbx.js HTTP 301
- http://www.roxellrichards.com/system/asset?cmsid=PS-TAG-FOOTER&filename=hbx.js
- http://roxellrichards.com/public/file/P-6220301/CharlesModern-Regular.woff HTTP 301
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Regular.woff
- http://roxellrichards.com/fonts/Schwab-Icon-Font.ttf HTTP 301
- http://www.roxellrichards.com/fonts/Schwab-Icon-Font.ttf
- http://roxellrichards.com/public/file/P-6220301/CharlesModern-Regular.ttf HTTP 301
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Regular.ttf
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
roxellrichards.com/__all_old_files_bkp_2017_03_23/scb/fb7deb844e4f2aaa42956e7872808b5e/ Redirect Chain
|
131 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
login-component-responsive-secondary
lms.schwab.com/bundles/styles/lib/ |
51 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ps.css
www.roxellrichards.com/public/file/PROSPECT-CSS/ Redirect Chain
|
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
www.roxellrichards.com/secure/asset/short/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset
www.roxellrichards.com/system/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
file
www.schwab.com/public/ |
26 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
short
www.roxellrichards.com/system/asset/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset
www.roxellrichards.com/system/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
file
www.schwab.com/public/ |
8 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xpxe4op6q0.js
tracker.marinsm.com/tracker/async/ |
0 308 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset
www.roxellrichards.com/system/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background_image_exblur_dev2b.jpg
content.schwab.com/web/login/ |
61 KB 61 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
schwabsafe_logo.svg
content.schwab.com/web/login/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
CharlesModern-Light.woff
www.roxellrichards.com/public/file/P-6220301/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Schwab-Icon-Font.woff
www.schwab.com/public/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
short
www.roxellrichards.com/system/asset/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Schwab-Icon-Font.ttf
www.schwab.com/public/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
CharlesModern-Light.ttf
www.roxellrichards.com/public/file/P-6220301/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asset
www.roxellrichards.com/system/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
CharlesModern-Regular.woff
www.roxellrichards.com/public/file/P-6220301/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
Schwab-Icon-Font.ttf
www.roxellrichards.com/fonts/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
CharlesModern-Regular.ttf
www.roxellrichards.com/public/file/P-6220301/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adrum-ext.57faf0924644548b2bc48baae88f0b25.js
cdn.appdynamics.com/ |
45 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
adrum
eum-appd.schwab.com/eumcollector/beacons/browser/v1/EUM-AAB-AWU/ |
0 397 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.roxellrichards.com
- URL
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Light.woff
- Domain
- www.schwab.com
- URL
- https://www.schwab.com/public/fonts/Schwab-Icon-Font.woff?51abjd
- Domain
- www.schwab.com
- URL
- https://www.schwab.com/public/fonts/Schwab-Icon-Font.ttf?51abjd
- Domain
- www.roxellrichards.com
- URL
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Light.ttf
- Domain
- www.roxellrichards.com
- URL
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Regular.woff
- Domain
- www.roxellrichards.com
- URL
- http://www.roxellrichards.com/fonts/Schwab-Icon-Font.ttf
- Domain
- www.roxellrichards.com
- URL
- http://www.roxellrichards.com/public/file/P-6220301/CharlesModern-Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Charles Schwab (Financial)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _mTrack boolean| APTload string| waEnvId string| tmsActiveDomain string| tmsActiveDomainDWT object| re undefined| waLanguage string| proactiveChatHost string| reactiveChatHost string| waCategoryName string| waPageName function| openPopup function| menuLink function| isValidUrl undefined| ie object| x function| onAbrSubmit function| abrPost function| BrowserVersionCheck object| schwab object| LMS number| adrum-start-time object| ADRUM0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
cdn.appdynamics.com
content.schwab.com
eum-appd.schwab.com
lms.schwab.com
roxellrichards.com
tracker.marinsm.com
www.roxellrichards.com
www.schwab.com
www.roxellrichards.com
www.schwab.com
104.108.39.8
104.108.43.95
104.108.57.119
104.108.66.229
162.93.229.167
192.185.5.17
54.230.202.177
67.199.248.10
0c1f7d2d3fa4ed7ec3cf2519cd017ddb5bc8de757e00ed8f84cd8991059a0631
2ccc4d3be744a29473fefe2f313fdae488f460b85a47e8427f748358a54ba048
309d53d549c1a62ec2bb6c9334f6dda20119e7799f4cf720f43508c5e18002cd
689137464c584b5cc1afb209ecf7e0ef9b0ac8648b0d0945561edaf46f650c40
69956546b189eee14c0fb675f03ec33fc504fc2c274dc196e858edd5d1f12273
96b3fb66dedebf8abd9b9a5885e3b8c6f434f1d536a75f775f1b62c273fdd567
b6e740d2c073c8e4942c7b02cb47ecedaa2359a5517c67cb91d4dff4d64b0252
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e87107962df2fa9db2bfb003dcb609f364cc8964242f1a7f8af98239e44ca472