archivesofinsanity.com Open in urlscan Pro
38.114.85.209  Malicious Activity! Public Scan

URL: https://archivesofinsanity.com/wp-content/themes/driven/cil/store/
Submission: On June 29 via automatic, source openphish — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 38.114.85.209, located in Camdenton, United States and belongs to CO-MO-COMM, US. The main domain is archivesofinsanity.com.
TLS certificate: Issued by R3 on May 11th 2022. Valid for: 3 months.
This is the only time archivesofinsanity.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Shopify (Online)

Domain & IP information

IP Address AS Autonomous System
1 38.114.85.209 33616 (CO-MO-COMM)
1 2
Apex Domain
Subdomains
Transfer
1 archivesofinsanity.com
archivesofinsanity.com
581 KB
1 1
Domain Requested by
1 archivesofinsanity.com
1 1

This site contains no links.

Subject Issuer Validity Valid
archivesofinsanity.com
R3
2022-05-11 -
2022-08-09
3 months crt.sh

This page contains 2 frames:

Primary Page: https://archivesofinsanity.com/wp-content/themes/driven/cil/store/
Frame ID: 9D309124CFC27C1936D7160891B3B145
Requests: 3 HTTP requests in this frame

Frame: data://truncated
Frame ID: F147DD7BAA4C7F370983AC4BE9D97BAB
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Shopify

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

618 kB
Transfer

1626 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
archivesofinsanity.com/wp-content/themes/driven/cil/store/
2 MB
581 KB
Document
General
Full URL
https://archivesofinsanity.com/wp-content/themes/driven/cil/store/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
38.114.85.209 Camdenton, United States, ASN33616 (CO-MO-COMM, US),
Reverse DNS
Software
nginx /
Resource Hash
7aaebe8d5642efbe8c80984a4aedbade3b01b73b052d2b2015312b0de47599bb
Security Headers
Name Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 29 Jun 2022 00:19:41 GMT
referrer-policy
same-origin
server
nginx
strict-transport-security
max-age=63072000
vary
Accept-Encoding
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
37 KB
37 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7cdcb8dafd2f35ec642986935ed106e2c36f93e2a3143297a98cdcf00351744b

Request headers

Referer
Origin
https://archivesofinsanity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/ Frame F147
16 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76d88b182de9fb2fc737373f07d88e8077a4cf241c24aa690d773aaa2c990607

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ Frame F147
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Shopify (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block