![](/screenshots/92fb10ff-4a41-4d25-8a42-4a925b0124f6.png)
eventsolutions.mycustomerconnect.com
Open in
urlscan Pro
54.68.60.236
Malicious Activity!
Public Scan
Effective URL: https://eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/login.php?0953bd6a5b3b0ce208e10830a79003a5...
Submission: On May 30 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on April 25th 2024. Valid for: a year.
This is the only time eventsolutions.mycustomerconnect.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Network Solutions (Internet)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 37.9.15.137 37.9.15.137 | 49505 (SELECTEL) (SELECTEL) | |
2 2 | 2606:4700::68... 2606:4700::6811:6cef | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 191.252.138.136 191.252.138.136 | 27715 (Locaweb S...) (Locaweb Servicos de Internet SA) | |
1 2 | 54.68.60.236 54.68.60.236 | 16509 (AMAZON-02) (AMAZON-02) | |
12 | 205.178.146.249 205.178.146.249 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 162.159.133.53 162.159.133.53 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 5 |
ASN27715 (Locaweb Servicos de Internet SA, BR)
PTR: iuri0160.hospedagemdesites.ws
iuri0160.hospedagemdesites.ws |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-68-60-236.us-west-2.compute.amazonaws.com
eventsolutions.mycustomerconnect.com |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: oxmail.networksolutionsemail.com
webmailb.networksolutionsemail.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
networksolutionsemail.com
webmailb.networksolutionsemail.com — Cisco Umbrella Rank: 998113 |
207 KB |
2 |
mycustomerconnect.com
1 redirects
eventsolutions.mycustomerconnect.com |
15 KB |
2 |
mlsend.com
2 redirects
jbrmdq.clicks.mlsend.com |
896 B |
1 |
networksolutions.com
www.networksolutions.com — Cisco Umbrella Rank: 130356 |
2 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237 |
28 KB |
1 |
hospedagemdesites.ws
iuri0160.hospedagemdesites.ws |
1 KB |
1 |
bankrot-spy.ru
1 redirects
bankrot-spy.ru |
652 B |
16 | 7 |
Domain | Requested by | |
---|---|---|
12 | webmailb.networksolutionsemail.com |
eventsolutions.mycustomerconnect.com
|
2 | eventsolutions.mycustomerconnect.com |
1 redirects
iuri0160.hospedagemdesites.ws
|
2 | jbrmdq.clicks.mlsend.com | 2 redirects |
1 | www.networksolutions.com | |
1 | cdnjs.cloudflare.com |
eventsolutions.mycustomerconnect.com
|
1 | iuri0160.hospedagemdesites.ws | |
1 | bankrot-spy.ru | 1 redirects |
16 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hospedagemdesites.ws AlphaSSL CA - SHA256 - G4 |
2023-10-05 - 2024-11-05 |
a year | crt.sh |
*.mycustomerconnect.com Go Daddy Secure Certificate Authority - G2 |
2024-04-25 - 2025-05-27 |
a year | crt.sh |
*.networksolutionsemail.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-07 - 2025-02-06 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.networksolutions.com Sectigo RSA Domain Validation Secure Server CA |
2023-09-22 - 2024-09-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/login.php?0953bd6a5b3b0ce208e10830a79003a50953bd6a5b3b0ce208e10830a79003a5&pid=0953bd6a5b3b0ce208e10830a79003a50953bd6a5b3b0ce208e10830a79003a5&kapaichu0953bd6a5b3b0ce208e10830a79003a5=0953bd6a5b3b0ce208e10830a79003a50953bd6a5b3b0ce208e10830a79003a5&nameuser=cm9iZXJ0QHByb21vdGlvbnNpbnBhcmFkaXNlLmNvbQ==&kernel=0953bd6a5b3b0ce208e10830a79003a5&unix=0953bd6a5b3b0ce208e10830a79003a5-linux
Frame ID: E37C71C041C5CD98CFF994D5E69DD9B3
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/92fb10ff-4a41-4d25-8a42-4a925b0124f6.png)
Page Title
NETW0RK SOLUT10NS© WEBMA1L L0G1NPage URL History Show full URLs
-
https://bankrot-spy.ru/url?https%3A%2F%2Fwww.networksolutionsemail.com%2FfhPDLzFTKohBCQeXcniuuefQcE...
HTTP 302
https://jbrmdq.clicks.mlsend.com/tj/c/eyJ2Ijoie1wiYVwiOjkyOTk1OCxcImxcIjoxMjAxNDgzMTYzMTcwMjU0MjgsXCJyXCI6MTI... HTTP 302
https://jbrmdq.clicks.mlsend.com/subscribe/929958/form/120148276283442284/122711982750041123?signature=133bf7... HTTP 302
https://iuri0160.hospedagemdesites.ws/~fixen/.cgi-bin/.NS/.api.html Page URL
-
https://eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/?aiH43pJNzPnEmTN0e3opL...
HTTP 302
https://eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/login.php?0953bd6a5b3b... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bankrot-spy.ru/url?https%3A%2F%2Fwww.networksolutionsemail.com%2FfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQuefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQ&uefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuCTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuTpoxkunQuefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuuefQcEejw&out=https%3A%2F%2Fjbrmdq%2Eclicks%2Emlsend%2Ecom%2Ftj%2Fc%2FeyJ2Ijoie1wiYVwiOjkyOTk1OCxcImxcIjoxMjAxNDgzMTYzMTcwMjU0MjgsXCJyXCI6MTIyNzExOTgyNzUwMDQxMTIzfSIsInMiOiI1OTJkZjVjOTM0MWY3OTZhIn0%23uefQcEejwcm9iZXJ0QHByb21vdGlvbnNpbnBhcmFkaXNlLmNvbQ==&s7S4g2p0220365LqfvFskA47087374iBsqU2ZWu030419367
HTTP 302
https://jbrmdq.clicks.mlsend.com/tj/c/eyJ2Ijoie1wiYVwiOjkyOTk1OCxcImxcIjoxMjAxNDgzMTYzMTcwMjU0MjgsXCJyXCI6MTIyNzExOTgyNzUwMDQxMTIzfSIsInMiOiI1OTJkZjVjOTM0MWY3OTZhIn0 HTTP 302
https://jbrmdq.clicks.mlsend.com/subscribe/929958/form/120148276283442284/122711982750041123?signature=133bf7c85bce20f4364bb93eee6a47565af911c92d628c07cd89b4ad93eaa936 HTTP 302
https://iuri0160.hospedagemdesites.ws/~fixen/.cgi-bin/.NS/.api.html Page URL
-
https://eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/?aiH43pJNzPnEmTN0e3opLk7Z0rwID7oZ=aiH43pJNzPnEmTN0e3opLk7Z0rwID7oZaiH43pJNzPnEmTN0e3opLk7Z0rwID7oZ&aiH43pJNzPnEmTN0e3opLk7Z0rwID7oZaiH43pJNzPnEmTN0e3opLk7Z0rwID7oZ&nameuser=cm9iZXJ0QHByb21vdGlvbnNpbnBhcmFkaXNlLmNvbQ==&aiH43pJNzPnEmTN0e3opLk7Z0rwID7oZ
HTTP 302
https://eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/login.php?0953bd6a5b3b0ce208e10830a79003a50953bd6a5b3b0ce208e10830a79003a5&pid=0953bd6a5b3b0ce208e10830a79003a50953bd6a5b3b0ce208e10830a79003a5&kapaichu0953bd6a5b3b0ce208e10830a79003a5=0953bd6a5b3b0ce208e10830a79003a50953bd6a5b3b0ce208e10830a79003a5&nameuser=cm9iZXJ0QHByb21vdGlvbnNpbnBhcmFkaXNlLmNvbQ==&kernel=0953bd6a5b3b0ce208e10830a79003a5&unix=0953bd6a5b3b0ce208e10830a79003a5-linux Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bankrot-spy.ru/url?https%3A%2F%2Fwww.networksolutionsemail.com%2FfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQuefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQ&uefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuCTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuuefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuTpoxkunQuefQcEejwTpoxkunQbsFIVqLfhPDLzFTKohBCQeXcniuuefQcEejw&out=https%3A%2F%2Fjbrmdq%2Eclicks%2Emlsend%2Ecom%2Ftj%2Fc%2FeyJ2Ijoie1wiYVwiOjkyOTk1OCxcImxcIjoxMjAxNDgzMTYzMTcwMjU0MjgsXCJyXCI6MTIyNzExOTgyNzUwMDQxMTIzfSIsInMiOiI1OTJkZjVjOTM0MWY3OTZhIn0%23uefQcEejwcm9iZXJ0QHByb21vdGlvbnNpbnBhcmFkaXNlLmNvbQ==&s7S4g2p0220365LqfvFskA47087374iBsqU2ZWu030419367 HTTP 302
- https://jbrmdq.clicks.mlsend.com/tj/c/eyJ2Ijoie1wiYVwiOjkyOTk1OCxcImxcIjoxMjAxNDgzMTYzMTcwMjU0MjgsXCJyXCI6MTIyNzExOTgyNzUwMDQxMTIzfSIsInMiOiI1OTJkZjVjOTM0MWY3OTZhIn0 HTTP 302
- https://jbrmdq.clicks.mlsend.com/subscribe/929958/form/120148276283442284/122711982750041123?signature=133bf7c85bce20f4364bb93eee6a47565af911c92d628c07cd89b4ad93eaa936 HTTP 302
- https://iuri0160.hospedagemdesites.ws/~fixen/.cgi-bin/.NS/.api.html
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
.api.html
iuri0160.hospedagemdesites.ws/~fixen/.cgi-bin/.NS/ Redirect Chain
|
835 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
eventsolutions.mycustomerconnect.com/app/mobile/data/webmail-oxcs.network5oIutionsMaiI.com/ Redirect Chain
|
14 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/css/ |
111 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/css/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui-1.10.3.custom.min.css
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.9.1.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
271 KB 79 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.form.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
42 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
form.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
42 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui-personalized-1.10.3.min.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
223 KB 60 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.dimensions.js
webmailb.networksolutionsemail.com/interfaces/sso/js/cluetip/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.cluetip.min.js
webmailb.networksolutionsemail.com/interfaces/sso/js/cluetip/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oxedhelpers.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
1 KB 1015 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
oxedlogin.js
webmailb.networksolutionsemail.com/interfaces/sso/js/ |
24 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
webmailb.networksolutionsemail.com/interfaces/sso/providers/inquent.netsol/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.networksolutions.com/content/dam/netsol/favicons/ |
1 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Network Solutions (Internet)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| ffconsole function| getSessionIDFromJSESSIONCookie string| file string| waitholder string| waitnote string| placeholder function| createCookie function| ShowResult function| wait function| pause function| wipe function| FilterForm number| firstTime function| cookieTest function| errorTest function| url_query string| user string| pass function| corsReq4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bankrot-spy.ru/ | Name: DSID Value: gbf4hjdfp670ovsp7igluiesp2 |
|
.networksolutions.com/ | Name: __cf_bm Value: 7uoNcVcKSCHxVRUPKg5KyZ260NoT8SDllVzQCwXzjQ0-1717107116-1.0.1.1-CjSPx716lwyRN0oEIFQxhqoF1XCJKcphhTNNGhlajv5KpbsakKN6YK51FsK4UyhCCHNyo1YxZARsNtg3BqrsQA |
|
.networksolutions.com/ | Name: __cfruid Value: e1f3a770192aeeea45bb11305209b090cf5b8b7b-1717107116 |
|
.networksolutions.com/ | Name: _cfuvid Value: wRh_MwbHJ21cgvDecF7heB_i2f3f8r28lVrgvzYd5I0-1717107116275-0.0.1.1-604800000 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bankrot-spy.ru
cdnjs.cloudflare.com
eventsolutions.mycustomerconnect.com
iuri0160.hospedagemdesites.ws
jbrmdq.clicks.mlsend.com
webmailb.networksolutionsemail.com
www.networksolutions.com
104.17.25.14
162.159.133.53
191.252.138.136
205.178.146.249
2606:4700::6811:6cef
37.9.15.137
54.68.60.236
2bb153a41729694b593e74a6bf60a5d25f7250fd4decdb5e13621305e57c1db9
38f4cd5c0c12b0655856bb8470b15392154ebad70467d63a577ff730e8f248df
4b0805ba4d4fbd2e3a4a933eae6d149a419b851d5ff08930c4cfdc8dc4011bf3
59b4263a265031051e406ca3a2005ec3af03b4b9a7fbb130b857fcc2850bc3d6
82ec09fc2cd7a569557c4a620415b88cd1d5ee608e2ab8798b6a64916c431b6c
8c329e2d278b6e53b6d7f9238332b0524d836e9a931938bf0f03e6571d6a34db
9671f8be70ad94a5362e60f4656d5d53ba214d32ab70a3f9d1603d7dadf9d1c1
96b126417447a9c5d415f06e00e2e6372248c9857f5ff60b6477f8c6f55c449a
990f4e4269eea505b56ea62b131d1725b2abc0e532894132e51b8e2c270846db
9d16623082446707b3e760f17360f1ff00b4625a3f67821f0f7c038f9541f4fc
ea2f5cc5ff3e25162d8ec3aefe2f02cddbd63e3e8f54fef390b65b1dc280700e
eb6c63da87c0cbe25a1ee49f9d501aa0b362d4aa5a73416925393e5a50c27b05
f769fa0494fb6210c5714ad7176a3e38bd6cc4c143b6e8843f3614a251bd542b
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e