goriteway.cf
Open in
urlscan Pro
67.21.65.38
Malicious Activity!
Public Scan
Submission: On August 13 via api from CA
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 9th 2017. Valid for: 3 months.
This is the only time goriteway.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 67.21.65.38 67.21.65.38 | 46844 (ST-BGP) (ST-BGP - Sharktech) | |
4 | 184.30.220.87 184.30.220.87 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
7 | 3 |
ASN46844 (ST-BGP - Sharktech, US)
PTR: vps.customer.rectified.net
goriteway.cf |
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-220-87.deploy.static.akamaitechnologies.com
auth.gfx.ms |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
gfx.ms
auth.gfx.ms |
47 KB |
2 |
goriteway.cf
goriteway.cf |
13 KB |
0 |
live.com
Failed
sc.imp.live.com Failed |
|
7 | 3 |
Domain | Requested by | |
---|---|---|
4 | auth.gfx.ms |
goriteway.cf
auth.gfx.ms |
2 | goriteway.cf |
auth.gfx.ms
|
0 | sc.imp.live.com Failed |
auth.gfx.ms
|
7 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
signup.live.com |
go.microsoft.com |
login.live.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
goriteway.cf cPanel, Inc. Certification Authority |
2017-08-09 - 2017-11-07 |
3 months | crt.sh |
msagfx.live.com Microsoft IT TLS CA 4 |
2017-07-27 - 2019-07-17 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://goriteway.cf/swa/plx/page/out.php
Frame ID: 12821.1
Requests: 5 HTTP requests in this frame
Frame:
https://goriteway.cf/swa/plx/page/images/bannerlogo.png
Frame ID: 12821.2
Requests: 1 HTTP requests in this frame
Frame:
https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/mai/EN-US.html?id=64855&mkt=EN-US&cbcxt=mai
Frame ID: 12821.3
Requests: 1 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title: Sign up now
Search URL Search Domain Scan URL
Title: What's this?
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
out.php
goriteway.cf/swa/plx/page/ |
8 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
R3WinLive1033.css
auth.gfx.ms/16.000.26064.00/ |
27 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Login_Strings_JS1033.js
auth.gfx.ms/16.000.26064.00/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Login_Core.js
auth.gfx.ms/16.000.26064.00/ |
116 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bannerlogo.png
goriteway.cf/swa/plx/page/images/ Frame 1282 |
4 KB 4 KB |
Document
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
EN-US.html
sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/mai/ Frame 1282 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
controls.png
auth.gfx.ms/16.000.26064.00/hig/img/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- sc.imp.live.com
- URL
- https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/mai/EN-US.html?id=64855&mkt=EN-US&cbcxt=mai
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
goriteway.cf/swa/plx/page | Name: CkTst Value: G1502654619464 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.gfx.ms
goriteway.cf
sc.imp.live.com
sc.imp.live.com
184.30.220.87
67.21.65.38
0e4b89e476147b45570b61f3b1163c9f959f1553d66fe6afe8e7a5b3980c75dd
1a91133c66f82213d1d33e6425d4ce870b0ae7edefbcde898bcea7985bc648bd
30a4159ca9bac492707b10b14d1147dce3b18cfae839033fb2b38f1eb6f7a878
4cfcef23396ffbb9981c9e373e2c24b51a2dc32cd91cd6b86ddaf82121716c1e
91ba3a1a10ef3f09ab5eb0e842742bfd22b156fcc021e28a0322c72f0d4b563b
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603