![](/screenshots/a554a0d0-1c9c-492b-8023-80e27cf5830a.png)
geoclassroom.org
Open in
urlscan Pro
199.204.248.125
Malicious Activity!
Public Scan
Effective URL: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899...
Submission: On February 15 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 29th 2018. Valid for: 3 months.
This is the only time geoclassroom.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 199.204.248.125 199.204.248.125 | 17054 (AS17054) (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA) | |
1 | 2.20.23.219 2.20.23.219 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 104.111.244.217 104.111.244.217 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
2 | 54.228.243.159 54.228.243.159 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 23.21.89.168 23.21.89.168 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 52.222.146.19 52.222.146.19 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 34.237.228.123 34.237.228.123 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 52.207.31.195 52.207.31.195 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 34.197.243.146 34.197.243.146 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
11 | 10 |
ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US)
PTR: cp15.machighway.com
geoclassroom.org |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-244-217.deploy.static.akamaitechnologies.com
deluxe.script.ag |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-228-243-159.eu-west-1.compute.amazonaws.com
s.thebrighttag.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-23-21-89-168.compute-1.amazonaws.com
tag.crsspxl.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-146-19.fra53.r.cloudfront.net
static.traversedlp.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-237-228-123.compute-1.amazonaws.com
api.traversedlp.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-207-31-195.compute-1.amazonaws.com
api.traversedlp.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-197-243-146.compute-1.amazonaws.com
partner.mediawallahscript.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
traversedlp.com
static.traversedlp.com api.traversedlp.com |
10 KB |
2 |
thebrighttag.com
s.thebrighttag.com |
2 KB |
2 |
geoclassroom.org
1 redirects
geoclassroom.org |
294 KB |
1 |
mediawallahscript.com
partner.mediawallahscript.com |
626 B |
1 |
crsspxl.com
tag.crsspxl.com |
1 KB |
1 |
script.ag
deluxe.script.ag |
12 KB |
1 |
microsoftonline-p.com
secure.aadcdn.microsoftonline-p.com |
1 KB |
11 | 7 |
Domain | Requested by | |
---|---|---|
3 | api.traversedlp.com |
static.traversedlp.com
|
2 | s.thebrighttag.com |
deluxe.script.ag
|
2 | geoclassroom.org | 1 redirects |
1 | partner.mediawallahscript.com |
geoclassroom.org
|
1 | static.traversedlp.com |
deluxe.script.ag
|
1 | tag.crsspxl.com |
geoclassroom.org
|
1 | deluxe.script.ag |
geoclassroom.org
|
1 | secure.aadcdn.microsoftonline-p.com |
geoclassroom.org
|
11 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
geoclassroom.org cPanel, Inc. Certification Authority |
2018-01-29 - 2018-04-29 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: (AFD0150DF62AC6C8142F5E9F1EABC996)
Requests: 12 HTTP requests in this frame
Frame:
https://partner.mediawallahscript.com/?account_id=1006&partner_id=1036&uid=&custom=1975ef06-0366-405a-8889-0baa5044edff&tag_format=img&tag_action=sync&cb=
Frame ID: (DE3FDC4F64CC004DF419EF5EB4CA7431)
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/a554a0d0-1c9c-492b-8023-80e27cf5830a.png)
Page URL History Show full URLs
-
https://geoclassroom.org/wp-admin/images/dex/index.php
HTTP 302
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774... Page URL
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
![](/vendor/wappa/icons/UNIX.png)
Detected patterns
- headers server /Unix/i
![](/vendor/wappa/icons/OpenSSL.png)
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
![](/vendor/wappa/icons/Cross Pixel.png)
Detected patterns
- script /tag\.crsspxl\.com\/s1\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://geoclassroom.org/wp-admin/images/dex/index.php
HTTP 302
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
ns5ye6dcf3oknnn20480hu3v.php
geoclassroom.org/wp-admin/images/dex/ Redirect Chain
|
293 KB 294 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.4276.9/content/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tag.js
deluxe.script.ag/ |
34 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tag
s.thebrighttag.com/ |
3 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s1.js
tag.crsspxl.com/ |
1 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
traverse-container.js
static.traversedlp.com/v1/container/ |
19 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tag
s.thebrighttag.com/ |
0 363 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
199 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cookie
api.traversedlp.com/linkage/v1/ |
70 B 855 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
enqueue
api.traversedlp.com/linkage/v1/impression/ |
221 B 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
partner.mediawallahscript.com/ Frame (DE3 |
32 B 626 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
enqueue
api.traversedlp.com/linkage/v1/impression/ |
0 467 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| LoginErrors function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag object| TraverseContainer object| cp_C4w1ldN2d9PmVrkN object| tagIdsUsed4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
geoclassroom.org/ | Name: btpdb.0M6ZVb2.dGZjLjYwOTQyODU Value: VVNFUg |
|
geoclassroom.org/ | Name: btpdb.0M6ZVb2.dGZjLjYwOTQyNzg Value: REFZUw |
|
geoclassroom.org/ | Name: btpdb.0M6ZVb2.dGZjLjYwOTQyOTk Value: U0VTU0lPTg |
|
geoclassroom.org/ | Name: PHPSESSID Value: 307f8e0b4f5906f22844e5878bb05a8b |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.traversedlp.com
deluxe.script.ag
geoclassroom.org
partner.mediawallahscript.com
s.thebrighttag.com
secure.aadcdn.microsoftonline-p.com
static.traversedlp.com
tag.crsspxl.com
104.111.244.217
199.204.248.125
2.20.23.219
23.21.89.168
34.197.243.146
34.237.228.123
52.207.31.195
52.222.146.19
54.228.243.159
13673c4b7990a3771368afffb99c40706a84e46c306b69d22bd249345dea368b
22956f23570d0350f6fbfd395d1df400b64a652b2ecd7a8b68c8e4556e3a4a1b
4394cc75692e1432a67c21ab57bf3e070bef1d14392bac4d28f7330801cfd1fd
6c87bea2bbf2405eb95046115d33b805f14c852f5c4772c89e9dab7a0fa78bde
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
853b983923a033223e4f391790e6e86619b31d542b40e7e1e8221fb0d6957ab1
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
a23a8000e2af62afee4f51409579d88200dd8ad8d90f2914273f4e37ef677fc2
b9f7ad8e0829fba724799826ce31bb6ef8e9160cb06ec68bd6149175a5c63e67
d83b628407a21e171eab4ebd3baa638ecda547d65cc8d7d4443939e5ec3a0c41
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603