buildingex.com
Open in
urlscan Pro
199.204.248.132
Malicious Activity!
Public Scan
Submitted URL: http://buildingex.com/mberdo.com/?email=andreeacristea95@yahoo.com
Effective URL: http://buildingex.com/mberdo.com/secure/index.php?em=andreeacristea95@yahoo.com
Submission: On September 06 via manual from RO
Effective URL: http://buildingex.com/mberdo.com/secure/index.php?em=andreeacristea95@yahoo.com
Submission: On September 06 via manual from RO
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 4 HTTP transactions.
The main IP is 199.204.248.132, located in
St. Petersburg, United States and
belongs to AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US.
The main domain is buildingex.com.
This is the only time buildingex.com was scanned on urlscan.io!
This is the only time buildingex.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 5 | 199.204.248.132 199.204.248.132 | 17054 (AS17054) (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA) | |
| 4 | 1 |
5
199.204.248.132
(St. Petersburg, United States)
ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US)
PTR: cp21.machighway.com
ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US)
PTR: cp21.machighway.com
| buildingex.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
buildingex.com
1 redirects
buildingex.com |
46 KB |
| 4 | 1 |
| Domain | Requested by | |
|---|---|---|
| 5 | buildingex.com |
1 redirects
buildingex.com
|
| 4 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| 1970-01-01 - 1970-01-01 |
a few seconds | crt.sh |
This page contains 1 frames:
Primary Page:
http://buildingex.com/mberdo.com/secure/index.php?em=andreeacristea95@yahoo.com
Frame ID: D75778C0C982BA3F60CFA5BDA5FF0976
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://buildingex.com/mberdo.com/?email=andreeacristea95@yahoo.com
HTTP 302
http://buildingex.com/mberdo.com/secure/index.php?em=andreeacristea95@yahoo.com Page URL
Detected technologies
OpenSSL
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://buildingex.com/mberdo.com/?email=andreeacristea95@yahoo.com
HTTP 302
http://buildingex.com/mberdo.com/secure/index.php?em=andreeacristea95@yahoo.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.php
buildingex.com/mberdo.com/secure/ Redirect Chain
|
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
buildingex.com/mberdo.com/secure/ |
31 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
google2_gooogle1.png
buildingex.com/mberdo.com/secure/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fuji-spinner-1.0.1.svg
buildingex.com/mberdo.com/secure/ |
5 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| buildingex.com/ | Name: PHPSESSID Value: e5694073f00538b452b02bcf4fef65d7 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
buildingex.com
199.204.248.132
186034da48941b64b5f6b4d8a0176fb86e2ad6adda436b8eeef521b0166d06c5
4dc875d64c91e3bf64fbb9109a3b15a328cd5ef462a41c8b181e6cc85df8628e
6652382086fffd4e58321096ef1597102a043b3216ea251cf9da3d0eb177eecb
fd4d9d732e7a4af52746ebabe6bb16941ee71ae3e919131af700cf4e1228a16a