shopfastbestmedfor.icu Open in urlscan Pro
2606:4700:30::681f:4607  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response shopfastbestmedfor.icu/css/johnsonmatthey/	16 KB 5 KB	315ms 287ms	Document text/html	2606:4700:30::681f:4607 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://shopfastbestmedfor.icu/css/johnsonmatthey/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:30::681f:4607 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 8c3023b39fd534e70caf3b57bdac6c17f0c3eb4a56bdec41f742a385160a0f1c Request headers :method GET :authority shopfastbestmedfor.icu :scheme https :path /css/johnsonmatthey/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 accept-encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers status 200 date Fri, 07 Dec 2018 13:26:26 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d0b6f77ae435d6d9e9510fe72f69e12a11544189186; expires=Sat, 07-Dec-19 13:26:26 GMT; path=/; domain=.shopfastbestmedfor.icu; HttpOnly; Secure expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 485752efe863c2c9-FRA content-encoding gzip
GET H/1.1	200 OK	hack-run.png shopget24.com/images/sampledata/	24 KB 25 KB	350ms 115ms	Image image/png	31.220.17.26 AS-HOSTINGER
General Check archive.org Show headers Download Go to Show image Full URL http://shopget24.com/images/sampledata/hack-run.png Requested by Host: shopfastbestmedfor.icu URL: https://shopfastbestmedfor.icu/css/johnsonmatthey/ Protocol HTTP/1.1 Server 31.220.17.26 , United States, ASN47583 (AS-HOSTINGER, LT), Reverse DNS sifemgroup.com Software Apache / PHP/7.0.32 Resource Hash 6903fa3a18aa5c61b38ad74e21a448658c1a6958c26621b01589de6d8cedf907 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 07 Dec 2018 13:26:27 GMT Server Apache X-Powered-By PHP/7.0.32 Transfer-Encoding chunked Upgrade h2 Connection Upgrade, Keep-Alive Content-Type image/png Keep-Alive timeout=3, max=100
GET H2	200	style.css shopfastbestmedfor.icu/css/johnsonmatthey/index_files/	8 KB 2 KB	264ms 264ms	Stylesheet text/css	2606:4700:30::681f:4607 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://shopfastbestmedfor.icu/css/johnsonmatthey/index_files/style.css Requested by Host: shopfastbestmedfor.icu URL: https://shopfastbestmedfor.icu/css/johnsonmatthey/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:30::681f:4607 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205 Request headers :path /css/johnsonmatthey/index_files/style.css pragma no-cache cookie __cfduid=d0b6f77ae435d6d9e9510fe72f69e12a11544189186 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept text/css,*/*;q=0.1 cache-control no-cache :authority shopfastbestmedfor.icu referer https://shopfastbestmedfor.icu/css/johnsonmatthey/ :scheme https :method GET Referer https://shopfastbestmedfor.icu/css/johnsonmatthey/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Fri, 07 Dec 2018 13:26:27 GMT content-encoding gzip cf-cache-status REVALIDATED last-modified Wed, 05 Dec 2018 09:27:24 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=14400 cf-ray 485752f1cdffc2c9-FRA expires Fri, 07 Dec 2018 17:26:27 GMT
GET H2	200	logo.gif shopfastbestmedfor.icu/css/johnsonmatthey/index_files/	2 KB 3 KB	253ms 253ms	Image image/gif	2606:4700:30::681f:4607 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://shopfastbestmedfor.icu/css/johnsonmatthey/index_files/logo.gif Requested by Host: shopfastbestmedfor.icu URL: https://shopfastbestmedfor.icu/css/johnsonmatthey/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:30::681f:4607 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2fd34251394b1d72c2b569f82d5d957fee1656e5e650455dafc71856576a39cc Request headers :path /css/johnsonmatthey/index_files/logo.gif pragma no-cache cookie __cfduid=d0b6f77ae435d6d9e9510fe72f69e12a11544189186 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 accept image/webp,image/apng,image/*,*/*;q=0.8 cache-control no-cache :authority shopfastbestmedfor.icu referer https://shopfastbestmedfor.icu/css/johnsonmatthey/ :scheme https :method GET Referer https://shopfastbestmedfor.icu/css/johnsonmatthey/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Fri, 07 Dec 2018 13:26:27 GMT cf-cache-status REVALIDATED last-modified Wed, 05 Dec 2018 09:27:26 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/gif status 200 cache-control public, max-age=14400 accept-ranges bytes cf-ray 485752f1ce01c2c9-FRA content-length 2382 expires Fri, 07 Dec 2018 17:26:27 GMT
GET H/1.1	200 OK	illustration.gif sso.johnsonmatthey.com/adfs/portal/illustration/	158 KB 158 KB	120ms 43ms	Image image/gif	13.94.133.156 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://sso.johnsonmatthey.com/adfs/portal/illustration/illustration.gif?id=63B60BF35353088F0FD68C82AFD4F493577B4008AAA586871314A4281D2E73F1 Requested by Host: shopfastbestmedfor.icu URL: https://shopfastbestmedfor.icu/css/johnsonmatthey/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 13.94.133.156 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash 63b60bf35353088f0fd68c82afd4f493577b4008aaa586871314a4281d2e73f1 Request headers Referer https://shopfastbestmedfor.icu/css/johnsonmatthey/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 07 Dec 2018 13:26:27 GMT Expires Sun, 06 Jan 2019 13:26:27 GMT Server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 ETag 63B60BF35353088F0FD68C82AFD4F493577B4008AAA586871314A4281D2E73F1 Content-Length 161659 Content-Type image/gif

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors number| maxPasswordLength function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| SetIllustrationImage

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.shopfastbestmedfor.icu/	1970-01-19 05:42:05	Name: __cfduid Value: d0b6f77ae435d6d9e9510fe72f69e12a11544189186

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

shopfastbestmedfor.icu
shopget24.com
sso.johnsonmatthey.com
13.94.133.156
2606:4700:30::681f:4607
31.220.17.26
0a13280a86e7dfa6949bd016ea848912fcafc05e88cbedf538ac325b27041205
2fd34251394b1d72c2b569f82d5d957fee1656e5e650455dafc71856576a39cc
63b60bf35353088f0fd68c82afd4f493577b4008aaa586871314a4281d2e73f1
6903fa3a18aa5c61b38ad74e21a448658c1a6958c26621b01589de6d8cedf907
8c3023b39fd534e70caf3b57bdac6c17f0c3eb4a56bdec41f742a385160a0f1c