gwenet.org Open in urlscan Pro
66.175.58.9  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 0ffice365.php Show response gwenet.org/oneee/	2 KB 1 KB	180ms 86ms	Document text/html	66.175.58.9 INFB2-AS
General Check archive.org Show headers Download Go to Full URL http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us Protocol HTTP/1.1 Server 66.175.58.9 , United States, ASN30447 (INFB2-AS, US), Reverse DNS hostedc38.carrierzone.com Software / Resource Hash 3a9a616b2f069b5b7f028b360ecc555041e4540d43cb586c6115e67b5d8a37d5 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Thu, 14 Jul 2022 19:43:37 GMT Transfer-Encoding chunked
GET H/1.1	200 OK	eciffo365body.png gwenet.org/oneee/signin_files/	17 KB 18 KB	54ms 54ms	Image image/png	66.175.58.9 INFB2-AS
General Check archive.org Show headers Download Go to Show image Full URL http://gwenet.org/oneee/signin_files/eciffo365body.png Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us Protocol HTTP/1.1 Server 66.175.58.9 , United States, ASN30447 (INFB2-AS, US), Reverse DNS hostedc38.carrierzone.com Software / Resource Hash 3a015de4750b7b43fe1b0f4e3798bffb689e4834f0788ae9e81e397d40b1f394 Request headers accept-language en-US,en;q=0.9 Referer http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 14 Jul 2022 19:43:37 GMT Last-Modified Fri, 04 May 2018 01:26:20 GMT ETag "4515-56b57350e2700" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 17685 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	count.js Show response count.carrierzone.com/app/count_server/	35 KB 35 KB	208ms 40ms	Script text/javascript	66.175.41.113 INFB2-AS
General Check archive.org Show headers Download Go to Full URL https://count.carrierzone.com/app/count_server/count.js Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.175.41.113 , United States, ASN30447 (INFB2-AS, US), Reverse DNS wiredminds.carrierzone.com Software Apache/2.2.15 (CentOS) / Resource Hash f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e Request headers accept-language en-US,en;q=0.9 Referer http://gwenet.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 14 Jul 2022 19:43:31 GMT Last-Modified Fri, 08 Jun 2012 10:17:02 GMT Server Apache/2.2.15 (CentOS) Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 36029
GET H/1.1	200 OK	subomi.png gwenet.org/oneee/signin_files/	643 B 938 B	83ms 44ms	Image image/png	66.175.58.9 INFB2-AS
General Check archive.org Show headers Download Go to Show image Full URL http://gwenet.org/oneee/signin_files/subomi.png Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us Protocol HTTP/1.1 Server 66.175.58.9 , United States, ASN30447 (INFB2-AS, US), Reverse DNS hostedc38.carrierzone.com Software / Resource Hash 9d4cb3339de1260a949342d669c5d6506c2bd7d02a60f04920c2f409e4a12e7d Request headers accept-language en-US,en;q=0.9 Referer http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Date Thu, 14 Jul 2022 19:43:37 GMT Last-Modified Fri, 04 May 2018 01:26:20 GMT ETag "283-56b57350e2700" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Content-Length 643 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	ctin.php count.carrierzone.com/track/	42 B 610 B	148ms 109ms	Image image/gif	66.175.41.113 INFB2-AS
General Check archive.org Show headers Download Go to Show image Full URL http://count.carrierzone.com/track/ctin.php?t=1657827817547&custnum=88d8c7091eaea901&sname=gwenet.org&pagename=0ffice365.php&group=%2Fservices%2Fwebpages%2Fg%2Fw%2Fgwenet.org%2Fpublic%2Foneee&version=%24Rev%3A%207840%20%24&js=1&jv=0&resolution=1600x1200&color_depth=24&campaign=&referrer=&page_url=http%253A%252F%252Fgwenet.org%252Foneee%252F0ffice365.php%253Fl%253D_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418%2526fid.123InboxLight.aspxn.1774256418%2526fid.1252899645289964213InboxLight_Product-userid%2526us&plugins=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&us Protocol HTTP/1.1 Server 66.175.41.113 , United States, ASN30447 (INFB2-AS, US), Reverse DNS wiredminds.carrierzone.com Software Apache/2.2.15 (CentOS) / PHP/5.2.17 Resource Hash 5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947 Request headers accept-language en-US,en;q=0.9 Referer http://gwenet.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers Pragma no-cache Date Thu, 14 Jul 2022 19:43:31 GMT Last-Modified Thu, 14 Jul 2022 19:43:32 GMT Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.2.17 P3P CP="NOI NID ADMa OUR IND UNI COM NAV" Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Type image/gif Keep-Alive timeout=10, max=100 Content-Length 42 Expires Thu, 01 Jan 1970 01:23:45 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| click_track function| getClick object| wm_indiv_stats object| wiredminds string| wm_custnum string| wm_page_name string| wm_group_name string| wm_campaign_key string| wm_track_alt

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

count.carrierzone.com
gwenet.org
66.175.41.113
66.175.58.9
3a015de4750b7b43fe1b0f4e3798bffb689e4834f0788ae9e81e397d40b1f394
3a9a616b2f069b5b7f028b360ecc555041e4540d43cb586c6115e67b5d8a37d5
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947
9d4cb3339de1260a949342d669c5d6506c2bd7d02a60f04920c2f409e4a12e7d
f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e