rand-flooring.com
Open in
urlscan Pro
213.136.82.77
Malicious Activity!
Public Scan
Effective URL: https://rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/final.php
Submission: On December 02 via manual from FR
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 7th 2019. Valid for: 3 months.
This is the only time rand-flooring.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Axa (Insurance)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 5 | 213.136.82.77 213.136.82.77 | 51167 (CONTABO) (CONTABO) | |
1 | 163.171.132.119 163.171.132.119 | 54994 (QUANTILNE...) (QUANTILNETWORKS - QUANTIL NETWORKS INC) | |
1 | 95.211.156.232 95.211.156.232 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
1 | 171.18.34.198 171.18.34.198 | 12696 (AXA-TECH ...) (AXA-TECH Paris) | |
7 | 4 |
ASN51167 (CONTABO, DE)
PTR: server2.badinansoft.com
rand-flooring.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
rand-flooring.com
1 redirects
rand-flooring.com |
35 KB |
2 |
axa.fr
www.axa.fr espaceclient.axa.fr |
337 KB |
1 |
up-00.com
www.up-00.com |
2 KB |
7 | 3 |
Domain | Requested by | |
---|---|---|
5 | rand-flooring.com |
1 redirects
rand-flooring.com
|
1 | espaceclient.axa.fr |
rand-flooring.com
|
1 | www.up-00.com |
rand-flooring.com
|
1 | www.axa.fr |
rand-flooring.com
|
7 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
rand-flooring.com cPanel, Inc. Certification Authority |
2019-11-07 - 2020-02-05 |
3 months | crt.sh |
www.axa.fr DigiCert Global CA G2 |
2019-09-13 - 2021-10-12 |
2 years | crt.sh |
up-00.com cPanel, Inc. Certification Authority |
2019-10-18 - 2020-01-16 |
3 months | crt.sh |
espaceclient.axa.fr DigiCert SHA2 Extended Validation Server CA |
2018-03-15 - 2020-03-15 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/final.php
Frame ID: 717ECA1A1E4CF96FF220298D8045ADE9
Requests: 7 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/final.php
HTTP 301
https://rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/final.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/final.php
HTTP 301
https://rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/final.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
final.php
rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/ Redirect Chain
|
19 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
authentication.js
rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/c2otu=/AppData/Local/Temp/Rar$DRa0.682/casm/credita/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-axa.svg
www.axa.fr/content/dam/logo/ |
2 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
02c4stlqw0u3.png
www.up-00.com/i/00147/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background-axa.jpg
espaceclient.axa.fr/content/dam/axa-connect/ |
333 KB 334 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ar_h.gif
rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/imgs/imagesTemplates/ |
9 KB 9 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ar_b.gif
rand-flooring.com/.well-known/AXAconnectedd-loading/responsive/imgs/imagesTemplates/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Axa (Insurance)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate boolean| _csrff_cancel_onload_ object| _csrf_ object| _tsbp_ function| onLoadEvent function| startTimer function| checkSecond undefined| frmvalidator0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
espaceclient.axa.fr
rand-flooring.com
www.axa.fr
www.up-00.com
163.171.132.119
171.18.34.198
213.136.82.77
95.211.156.232
2dc308b717414e45b4546e9065b11ddcc60f9d91412498860486daac9e02b18a
4f15551e8df16365a4eba91f078b16e4dc40959a98f6f8e1de8b2ad895ccc705
86dc1e60726b28bf271f73d75e5f7408ca7fe62e3b38132497ae48863499da08
909001e767784a33ca48dde288e49027556e9f9d7641eb471ccf7794bff30099
9a4e3e462f938584e46198bfb790d9a9384d1c9531989534532a63525b7e2486
efd146763ed98326e1fd9ebf5d5beb3f125168f266862b2b62fa36c89fcc8a22