phsdeals.com Open in urlscan Pro
192.185.150.72 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://phsdeals.com/shared/wamp.php?warp=020202
Submission: On October 01 via manual (October 1st 2020, 7:08:41 pm UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 192.185.150.72, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is phsdeals.com.

This is the only time phsdeals.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	192.185.150.72 192.185.150.72	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2 4	2606:4700::68... 2606:4700::6811:e30	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:818::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81b::2003	15169 (GOOGLE) (GOOGLE)
9	4

4 192.185.150.72 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-150-72.unifiedlayer.com

phsdeals.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:e30 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

codepen.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	codepen.io 2 redirects codepen.io	1 KB
4	phsdeals.com phsdeals.com	153 KB
2	gstatic.com fonts.gstatic.com	22 KB
1	googleapis.com fonts.googleapis.com	1 KB
9	4

	Domain	Requested by
4	codepen.io	2 redirects phsdeals.com
4	phsdeals.com	phsdeals.com
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	phsdeals.com
9	4

This site contains no links.

Subject Issuer	Validity	Valid
codepen.io Cloudflare Inc ECC CA-3	`2020-07-02` - `2021-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://phsdeals.com/shared/wamp.php?warp=020202
Frame ID: 93C1E99FEED62EADCBABE7BFC7C7808A
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

9
Requests

22 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

176 kB
Transfer

182 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://codepen.io/assets/libs/fullpage/jquery-ui.css HTTP 301
https://codepen.io/assets/libs/fullpage/jquery-ui.css

Request Chain 3

http://codepen.io/assets/libs/fullpage/jquery_and_jqueryui.js HTTP 301
https://codepen.io/assets/libs/fullpage/jquery_and_jqueryui.js

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request wamp.php Show response
phsdeals.com/shared/ 4 KB
1 KB 330ms
317ms Document
text/html 192.185.150.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://phsdeals.com/shared/wamp.php?warp=020202
Protocol: HTTP/1.1
Server: 192.185.150.72 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-150-72.unifiedlayer.com
Software: Apache /
Resource Hash: c7f69586338bc6754e54dbe49bed426e182c9df43d30fa68124728e1392a1ccc

Request headers

Host: phsdeals.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 01 Oct 2020 19:08:23 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 827
Keep-Alive: timeout=5, max=75
Content-Type: text/html

GET
H2

404

jquery-ui.css
codepen.io/assets/libs/fullpage/
Redirect Chain

http://codepen.io/assets/libs/fullpage/jquery-ui.css
https://codepen.io/assets/libs/fullpage/jquery-ui.css

0
0

790ms
779ms

Stylesheet
text/html

2606:4700::6811:e30
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codepen.io/assets/libs/fullpage/jquery-ui.css
Requested by: Host: phsdeals.com
URL: http://phsdeals.com/shared/wamp.php?warp=020202
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e30 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://phsdeals.com/shared/wamp.php?warp=020202
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Date: Thu, 01 Oct 2020 19:08:23 GMT
Server: cloudflare
Vary: Accept-Encoding
Location: https://codepen.io/assets/libs/fullpage/jquery-ui.css
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 5db878d829ca1f29-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 058729db1700001f29f92e9200000001
Expires: Thu, 01 Oct 2020 20:08:23 GMT

GET
H/1.1 200
OK style.css
phsdeals.com/shared/css/ 2 KB
1 KB 132ms
131ms Stylesheet
text/css 192.185.150.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://phsdeals.com/shared/css/style.css
Requested by: Host: phsdeals.com
URL: http://phsdeals.com/shared/wamp.php?warp=020202
Protocol: HTTP/1.1
Server: 192.185.150.72 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-150-72.unifiedlayer.com
Software: Apache /
Resource Hash: 4a59e765c380a9c9fae1260174f2d6300feb853f22b8d3054e4f2260777ee7a7

Request headers

Referer: http://phsdeals.com/shared/wamp.php?warp=020202
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 01 Oct 2020 19:08:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 May 2020 09:43:44 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 909

GET
H/1.1 200
OK off.png
phsdeals.com/shared/img/ 36 KB
36 KB 245ms
230ms Image
image/png 192.185.150.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://phsdeals.com/shared/img/off.png
Requested by: Host: phsdeals.com
URL: http://phsdeals.com/shared/wamp.php?warp=020202
Protocol: HTTP/1.1
Server: 192.185.150.72 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-150-72.unifiedlayer.com
Software: Apache /
Resource Hash: 6d6d501fa6ee092b755fd24fff5e5b6b0ae4ae502e5053f03b5cc264c52ca294

Request headers

Referer: http://phsdeals.com/shared/wamp.php?warp=020202
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 01 Oct 2020 19:08:23 GMT
Last-Modified: Tue, 19 May 2020 09:23:14 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Content-Type: image/png
Keep-Alive: timeout=5, max=75
Content-Length: 36607

GET
H2

404

jquery_and_jqueryui.js
codepen.io/assets/libs/fullpage/
Redirect Chain

http://codepen.io/assets/libs/fullpage/jquery_and_jqueryui.js
https://codepen.io/assets/libs/fullpage/jquery_and_jqueryui.js

0
0

783ms
767ms

Script
text/html

2606:4700::6811:e30
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://codepen.io/assets/libs/fullpage/jquery_and_jqueryui.js
Requested by: Host: phsdeals.com
URL: http://phsdeals.com/shared/wamp.php?warp=020202
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e30 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://phsdeals.com/shared/wamp.php?warp=020202
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

Date: Thu, 01 Oct 2020 19:08:23 GMT
Server: cloudflare
Vary: Accept-Encoding
Location: https://codepen.io/assets/libs/fullpage/jquery_and_jqueryui.js
Cache-Control: max-age=3600
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 5db878d82912c2f9-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 058729db160000c2f9968b4200000001
Expires: Thu, 01 Oct 2020 20:08:23 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 5 KB
1 KB 15ms
15ms Stylesheet
text/css 2a00:1450:4001:818::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Roboto:400,100

Requested by

Host: phsdeals.com
URL: http://phsdeals.com/shared/css/style.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fce65579c048677a98fe51233a9de3abac8fc6d3bac6feae637f16b34f136431

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://phsdeals.com/shared/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 01 Oct 2020 19:08:23 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 01 Oct 2020 19:08:23 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Thu, 01 Oct 2020 19:08:23 GMT

GET
H/1.1 200
OK bg.jpg
phsdeals.com/shared/img/ 114 KB
114 KB 127ms
127ms Image
image/jpeg 192.185.150.72
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://phsdeals.com/shared/img/bg.jpg
Requested by: Host: phsdeals.com
URL: http://phsdeals.com/shared/wamp.php?warp=020202
Protocol: HTTP/1.1
Server: 192.185.150.72 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-150-72.unifiedlayer.com
Software: Apache /
Resource Hash: 411044837db5ff66d77ecb4806839cdc0e0649df3d53e921f46c1186c556eba9

Request headers

Referer: http://phsdeals.com/shared/wamp.php?warp=020202
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 01 Oct 2020 19:08:24 GMT
Last-Modified: Tue, 19 May 2020 09:34:04 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=74
Content-Length: 116980

GET
H/1.1 200
OK KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 12ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Roboto:400,100

Protocol

HTTP/1.1

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://phsdeals.com
Referer: http://fonts.googleapis.com/css?family=Roboto:400,100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 30 Sep 2020 05:00:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 24 Jul 2019 01:18:50 GMT
Server: sffe
Age: 137257
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 11016
X-XSS-Protection: 0
Expires: Thu, 30 Sep 2021 05:00:47 GMT

GET
H/1.1 200
OK KFOkCnqEu92Fr1MmgVxIIzIXKMny.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:81b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1MmgVxIIzIXKMny.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Roboto:400,100

Protocol

HTTP/1.1

Server

2a00:1450:4001:81b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

969d3b8c3b846ba9d4dd5fa3936ec2c610f4f9f67f6f880cc9b00ebda3414083

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://phsdeals.com
Referer: http://fonts.googleapis.com/css?family=Roboto:400,100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 28 Sep 2020 11:29:31 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 24 Jul 2019 01:18:40 GMT
Server: sffe
Age: 286733
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 10984
X-XSS-Protection: 0
Expires: Tue, 28 Sep 2021 11:29:31 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

codepen.io
fonts.googleapis.com
fonts.gstatic.com
phsdeals.com
192.185.150.72
2606:4700::6811:e30
2a00:1450:4001:818::200a
2a00:1450:4001:81b::2003
411044837db5ff66d77ecb4806839cdc0e0649df3d53e921f46c1186c556eba9
4a59e765c380a9c9fae1260174f2d6300feb853f22b8d3054e4f2260777ee7a7
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
6d6d501fa6ee092b755fd24fff5e5b6b0ae4ae502e5053f03b5cc264c52ca294
969d3b8c3b846ba9d4dd5fa3936ec2c610f4f9f67f6f880cc9b00ebda3414083
c7f69586338bc6754e54dbe49bed426e182c9df43d30fa68124728e1392a1ccc
fce65579c048677a98fe51233a9de3abac8fc6d3bac6feae637f16b34f136431

phsdeals.com Open in urlscan Pro 192.185.150.72 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

22 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

176 kBTransfer

182 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

phsdeals.com Open in urlscan Pro
192.185.150.72 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

22 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

176 kB
Transfer

182 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!