urlscan.io logo urlscan.io
SecurityTrails logo

geoclassroom.org Open in urlscan Pro
199.204.248.125  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://geoclassroom.org/wp-admin/images/dex/index.php
Effective URL: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899...
Submission: On February 15 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 4 countries across 7 domains to perform 11 HTTP transactions. The main IP is 199.204.248.125, located in Saint Petersburg, United States and belongs to AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US. The main domain is geoclassroom.org.
TLS certificate: Issued by cPanel, Inc. Certification Authority on January 29th 2018. Valid for: 3 months.
This is the only time geoclassroom.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 199.204.248.125 17054 (AS17054)
1 2.20.23.219 20940 (AKAMAI-ASN1)
1 104.111.244.217 16625 (AKAMAI-AS)
2 54.228.243.159 16509 (AMAZON-02)
1 23.21.89.168 14618 (AMAZON-AES)
1 52.222.146.19 16509 (AMAZON-02)
2 34.237.228.123 14618 (AMAZON-AES)
1 52.207.31.195 14618 (AMAZON-AES)
1 34.197.243.146 14618 (AMAZON-AES)
11 10
2    199.204.248.125 (Saint Petersburg, United States)

ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US)
PTR: cp15.machighway.com
geoclassroom.org
1    2.20.23.219 (European Union)

ASN20940 (AKAMAI-ASN1, US)
secure.aadcdn.microsoftonline-p.com
1    104.111.244.217 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-244-217.deploy.static.akamaitechnologies.com
deluxe.script.ag
2    54.228.243.159 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-228-243-159.eu-west-1.compute.amazonaws.com
s.thebrighttag.com
1    23.21.89.168 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-23-21-89-168.compute-1.amazonaws.com
tag.crsspxl.com
1    52.222.146.19 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-52-222-146-19.fra53.r.cloudfront.net
static.traversedlp.com
2    34.237.228.123 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-237-228-123.compute-1.amazonaws.com
api.traversedlp.com
1    52.207.31.195 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-207-31-195.compute-1.amazonaws.com
api.traversedlp.com
1    34.197.243.146 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-197-243-146.compute-1.amazonaws.com
partner.mediawallahscript.com
Domain Requested by
3 api.traversedlp.com static.traversedlp.com
2 s.thebrighttag.com deluxe.script.ag
2 geoclassroom.org 1 redirects
1 partner.mediawallahscript.com geoclassroom.org
1 static.traversedlp.com deluxe.script.ag
1 tag.crsspxl.com geoclassroom.org
1 deluxe.script.ag geoclassroom.org
1 secure.aadcdn.microsoftonline-p.com geoclassroom.org
11 8

This site contains no links.

Subject Issuer Validity Valid
geoclassroom.org
cPanel, Inc. Certification Authority		 2018-01-29 -
2018-04-29		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: (AFD0150DF62AC6C8142F5E9F1EABC996)
Requests: 12 HTTP requests in this frame

Frame: https://partner.mediawallahscript.com/?account_id=1006&partner_id=1036&uid=&custom=1975ef06-0366-405a-8889-0baa5044edff&tag_format=img&tag_action=sync&cb=
Frame ID: (DE3FDC4F64CC004DF419EF5EB4CA7431)
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://geoclassroom.org/wp-admin/images/dex/index.php HTTP 302
    https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /Unix/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /tag\.crsspxl\.com\/s1\.js/i

Page Statistics

11
Requests

9 %
HTTPS

0 %
IPv6

7
Domains

8
Subdomains

10
IPs

4
Countries

321 kB
Transfer

556 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://geoclassroom.org/wp-admin/images/dex/index.php HTTP 302
    https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ns5ye6dcf3oknnn20480hu3v.php
geoclassroom.org/wp-admin/images/dex/
Redirect Chain
  • https://geoclassroom.org/wp-admin/images/dex/index.php
  • https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav....
293 KB
294 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.204.248.125 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
cp15.machighway.com
Software
Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.5.37
Resource Hash
22956f23570d0350f6fbfd395d1df400b64a652b2ecd7a8b68c8e4556e3a4a1b

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Cookie
PHPSESSID=307f8e0b4f5906f22844e5878bb05a8b
Host
geoclassroom.org
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 15 Feb 2018 08:57:27 GMT
Server
Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection
Keep-Alive
X-Powered-By
PHP/5.5.37
Transfer-Encoding
chunked
Keep-Alive
timeout=30, max=99
Content-Type
text/html

Redirect headers

Pragma
no-cache
Date
Thu, 15 Feb 2018 08:57:27 GMT
Server
Apache/2.4.23 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By
PHP/5.5.37
Content-Type
text/html
Location
ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
Set-Cookie
PHPSESSID=307f8e0b4f5906f22844e5878bb05a8b; path=/
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
Keep-Alive
Keep-Alive
timeout=30, max=100
Content-Length
0
Expires
Thu, 19 Nov 1981 08:52:00 GMT
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
microsoft_logo.png
secure.aadcdn.microsoftonline-p.com/ests/2.1.4276.9/content/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.4276.9/content/images/microsoft_logo.png
Requested by
Host: geoclassroom.org
URL: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
2.20.23.219 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 15 Feb 2018 08:57:28 GMT
Last-Modified
Fri, 10 Jun 2016 21:37:39 GMT
Content-MD5
5LZ1AH3GSS7lkBMdH337sw==
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=185273
Connection
keep-alive
Content-Length
1040
tag.js
deluxe.script.ag/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://deluxe.script.ag/tag.js
Requested by
Host: geoclassroom.org
URL: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
104.111.244.217 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-244-217.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d83b628407a21e171eab4ebd3baa638ecda547d65cc8d7d4443939e5ec3a0c41

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 15 Feb 2018 08:57:28 GMT
Content-Encoding
gzip
Last-Modified
Thu, 08 Feb 2018 17:52:28 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
12398
tag
s.thebrighttag.com/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=0M6ZVb2&H=-837ohuh
Requested by
Host: deluxe.script.ag
URL: https://deluxe.script.ag/tag.js
Protocol
HTTP/1.1
Server
54.228.243.159 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-228-243-159.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6c87bea2bbf2405eb95046115d33b805f14c852f5c4772c89e9dab7a0fa78bde

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 15 Feb 2018 08:57:28 GMT
Content-Encoding
gzip
Server
nginx
ETag
89f84a9df391e84a0ead2390c58fcb67
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript
X-BT-RequestId
40278ed1-122e-11e8-9ffb-00000ac4a34c
Expires
Thu, 01 Jan 1970 00:00:00 GMT
s1.js
tag.crsspxl.com/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.crsspxl.com/s1.js?d=2419&cb=1518685048917
Requested by
Host: geoclassroom.org
URL: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
23.21.89.168 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-23-21-89-168.compute-1.amazonaws.com
Software
/
Resource Hash
4394cc75692e1432a67c21ab57bf3e070bef1d14392bac4d28f7330801cfd1fd

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 15 Feb 2018 08:57:28 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT", CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-control
no-cache="set-cookie"
Connection
keep-alive
Content-Type
text/javascript
Content-Length
680
traverse-container.js
static.traversedlp.com/v1/container/ 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.traversedlp.com/v1/container/traverse-container.js?clientId=1975ef06-0366-405a-8889-0baa5044edff
Requested by
Host: deluxe.script.ag
URL: https://deluxe.script.ag/tag.js
Protocol
HTTP/1.1
Server
52.222.146.19 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-222-146-19.fra53.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
b9f7ad8e0829fba724799826ce31bb6ef8e9160cb06ec68bd6149175a5c63e67

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 15 Feb 2018 06:38:49 GMT
Content-Encoding
gzip
Server
nginx/1.12.1
Age
24
ETag
W/"4c4f-ENATyU5DvvQbSYGqDoL1cw"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
P3P
CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
Via
1.1 2f43d3215923fbce97b22ee733b0401f.cloudfront.net (CloudFront)
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
X-Amz-Cf-Id
JAsSoSpGzi1FvmxXIBu-PDNfxF_re_f8uxQWd6XbErmuGKyV9mNL_A==
tag
s.thebrighttag.com/ 		0
363 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=0M6ZVb2&H=-837ohuh&referrer=https%3A%2F%2Fgeoclassroom.org%2Fwp-admin%2Fimages%2Fdex%2Fns5ye6dcf3oknnn20480hu3v.php%3Frand%3D13InboxLightaspxn.1774256418%26fid.4.1252899642%26fid%3D1%26fav.1%26rand.13InboxLight.aspxn.1774256418%26fid.1252899642%26fid.1%26fav.1%26email%3D%26.rand%3D13InboxLight.aspx%3Fn%3D1774256418%26fid%3D4&mode=v2&_cb_bt_data(%27url%20domain%27)=geoclassroom.org&btpdb.0M6ZVb2.dGZjLjYwOTQyNzg=REFZUw&btpdb.0M6ZVb2.dGZjLjYwOTQyOTk=U0VTU0lPTg&btpdb.0M6ZVb2.dGZjLjYwOTQyODU=VVNFUg
Requested by
Host: deluxe.script.ag
URL: https://deluxe.script.ag/tag.js
Protocol
HTTP/1.1
Server
54.228.243.159 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-228-243-159.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 15 Feb 2018 08:57:28 GMT
Server
nginx
ETag
d41d8cd98f00b204e9800998ecf8427e
P3P
CP=NOI DSP COR NID
Cache-Control
private, must-revalidate
Connection
keep-alive
X-BT-RequestId
402d8240-122e-11e8-ab92-00000a5105e3
Content-Type
text/javascript
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
truncated
/ 		199 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpeg
cookie
api.traversedlp.com/linkage/v1/ 		70 B
855 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.traversedlp.com/linkage/v1/cookie
Requested by
Host: static.traversedlp.com
URL: https://static.traversedlp.com/v1/container/traverse-container.js?clientId=1975ef06-0366-405a-8889-0baa5044edff
Protocol
HTTP/1.1
Server
34.237.228.123 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-228-123.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
a23a8000e2af62afee4f51409579d88200dd8ad8d90f2914273f4e37ef677fc2

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin
https://geoclassroom.org

Response headers

Date
Thu, 15 Feb 2018 08:57:30 GMT
Content-Encoding
gzip
Server
nginx/1.12.1
ETag
W/"46-4X+HFemwp02Z8e5/2S2lPg"
Vary
Accept-Encoding
P3P
CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
Access-Control-Allow-Origin
https://geoclassroom.org
Access-Control-Expose-Headers
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
86
enqueue
api.traversedlp.com/linkage/v1/impression/ 		221 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.traversedlp.com/linkage/v1/impression/enqueue
Requested by
Host: static.traversedlp.com
URL: https://static.traversedlp.com/v1/container/traverse-container.js?clientId=1975ef06-0366-405a-8889-0baa5044edff
Protocol
HTTP/1.1
Server
52.207.31.195 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-52-207-31-195.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
13673c4b7990a3771368afffb99c40706a84e46c306b69d22bd249345dea368b

Request headers

Access-Control-Request-Method
POST
Origin
https://geoclassroom.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Access-Control-Request-Headers
content-type

Response headers

Date
Thu, 15 Feb 2018 08:57:31 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
nginx/1.12.1
ETag
W/"dd-lQv1Og0PCPVISh5xe2nofw"
Allow
ACL,BIND,CHECKOUT,CONNECT,COPY,DELETE,GET,HEAD,LINK,LOCK,M-SEARCH,MERGE,MKACTIVITY,MKCALENDAR,MKCOL,MOVE,NOTIFY,PATCH,POST,PROPFIND,PROPPATCH,PURGE,PUT,REBIND,REPORT,SEARCH,SUBSCRIBE,TRACE,UNBIND,UNLINK,UNLOCK,UNSUBSCRIBE
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS, HEAD
P3P
CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
Access-Control-Allow-Origin
https://geoclassroom.org
Access-Control-Expose-Headers
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
content-type,authorization
Content-Length
156
/
partner.mediawallahscript.com/ Frame (DE3 		32 B
626 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partner.mediawallahscript.com/?account_id=1006&partner_id=1036&uid=&custom=1975ef06-0366-405a-8889-0baa5044edff&tag_format=img&tag_action=sync&cb=
Requested by
Host: geoclassroom.org
URL: https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol
HTTP/1.1
Server
34.197.243.146 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-197-243-146.compute-1.amazonaws.com
Software
nginx/1.10.2 /
Resource Hash
853b983923a033223e4f391790e6e86619b31d542b40e7e1e8221fb0d6957ab1

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 15 Feb 2018 08:57:31 GMT
Server
nginx/1.10.2
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Cache-Control
private, no-cache, must-revalidate, no-store, max-age=0
Connection
keep-alive
Content-Type
image/png
Content-Length
32
Expires
Sat, 26 Jul 1997 05:00:00 GMT
enqueue
api.traversedlp.com/linkage/v1/impression/ 		0
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.traversedlp.com/linkage/v1/impression/enqueue
Protocol
HTTP/1.1
Server
34.237.228.123 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-237-228-123.compute-1.amazonaws.com
Software
nginx/1.12.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://geoclassroom.org/wp-admin/images/dex/ns5ye6dcf3oknnn20480hu3v.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin
https://geoclassroom.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Date
Thu, 15 Feb 2018 08:57:31 GMT
Server
nginx/1.12.1
Vary
X-HTTP-Method-Override
P3P
CP="CAO PSAo CONo OUR OTRo BUS PHY ONL UNI COM NAV DEM STA"
Access-Control-Allow-Origin
https://geoclassroom.org
Access-Control-Expose-Headers
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| LoginErrors function| InputUtil function| SelectOption function| Login undefined| emails undefined| msViewportStyle undefined| viewport function| getStyle function| computeLoadIllustration function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag object| TraverseContainer object| cp_C4w1ldN2d9PmVrkN object| tagIdsUsed

4 Cookies

Domain/Path Name / Value
geoclassroom.org/ Name: btpdb.0M6ZVb2.dGZjLjYwOTQyODU
Value: VVNFUg
geoclassroom.org/ Name: btpdb.0M6ZVb2.dGZjLjYwOTQyNzg
Value: REFZUw
geoclassroom.org/ Name: btpdb.0M6ZVb2.dGZjLjYwOTQyOTk
Value: U0VTU0lPTg
geoclassroom.org/ Name: PHPSESSID
Value: 307f8e0b4f5906f22844e5878bb05a8b