works.s341.xrea.com Open in urlscan Pro
150.95.9.160 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://works.s341.xrea.com/sf/sf/tracking2.php
Submission: On March 01 via manual (March 1st 2022, 12:35:58 pm UTC) from BE — Scanned from JP

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 150.95.9.160, located in Japan and belongs to GMOOSK-NET GMO Internet,Inc, JP. The main domain is works.s341.xrea.com.

This is the only time works.s341.xrea.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: SF Express (Transportation) Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
10	150.95.9.160 150.95.9.160	58791 (GMOOSK-NE...) (GMOOSK-NET GMO Internet)
2	2606:4700:10:... 2606:4700:10::6814:8681	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2

10 150.95.9.160 (Japan)

ASN58791 (GMOOSK-NET GMO Internet,Inc, JP)
PTR: s341.xrea.com

works.s341.xrea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6814:8681 (United States)

ASN13335 (CLOUDFLARENET, US)

cache1.value-domain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.value-domain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	xrea.com works.s341.xrea.com	136 KB
2	value-domain.com cache1.value-domain.com www.value-domain.com	16 KB
12	2

	Domain	Requested by
10	works.s341.xrea.com	works.s341.xrea.com
1	www.value-domain.com
1	cache1.value-domain.com	works.s341.xrea.com
12	3

This site contains links to these domains. Also see Links.

Domain
www.value-domain.com

Subject Issuer	Validity	Valid
*.value-domain.com AlphaSSL CA - SHA256 - G2	`2022-02-10` - `2023-03-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://works.s341.xrea.com/sf/sf/tracking2.php
Frame ID: 03C019413BBDC45800ECF537C9AB527E
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

顺丰速运

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

12
Requests

8 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

152 kB
Transfer

151 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.value-domain.com/value-auth/?adref=xrea_ad&argument=w9Qy6aHQ&dmai=a5f3e009b2fa09

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request tracking2.php Show response
works.s341.xrea.com/sf/sf/ 4 KB
2 KB 1261ms
1236ms Document
text/html 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to

Full URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 556639fbeffc1064be2f9620bdf49e1b0426b8ec1d63f181112871158da8bc9d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9

Response headers

Date: Tue, 01 Mar 2022 12:35:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 1483
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK xrea_header.js Show response
cache1.value-domain.com/ 1 KB
1 KB 21ms
14ms Script
application/javascript 2606:4700:10::6814:8681
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://cache1.value-domain.com/xrea_header.js
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 2606:4700:10::6814:8681 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea3ce8b96f60a35f4a8c8489badb30254fe0b7b8d63c98601d4055c22c6f43b0

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 2061
Cf-Polished: origSize=1786
Transfer-Encoding: chunked
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Last-Modified: Tue, 19 Jan 2021 02:56:21 GMT
Server: cloudflare
ETag: W/"60064a55-6fa"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=14400
CF-RAY: 6e51ef57fc5b209b-NRT
Cf-Bgj: minify

GET
H/1.1 200
OK SFExpress.png
works.s341.xrea.com/sf/sf/images/ 8 KB
8 KB 12ms
12ms Image
image/png 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/SFExpress.png
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: d30eeb036a0992cbf196e9f08e7b05c8038fe04cfca03328d3ec21af21c8750a

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "1f80-5943f561aca00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=99
Content-Length: 8064

GET
H/1.1 200
OK alert-icon-red-md.png
works.s341.xrea.com/sf/sf/images/ 38 KB
39 KB 1213ms
1202ms Image
image/png 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/alert-icon-red-md.png
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 8fa2cd0c614884da89146e5ca369046b4b5a8a7df71213d0184753756e058d99

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "98f9-5943f561aca00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 39161

GET
H/1.1 200
OK mailenable.png
works.s341.xrea.com/sf/sf/images/ 9 KB
9 KB 181ms
170ms Image
image/png 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/mailenable.png
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: d520d21d83ca745dd8eb87cd367c13a3414756827aa3ac033d7d1632eba594a8

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "23b0-5943f561aca00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 9136

GET
H/1.1 200
OK qqmail.jpg
works.s341.xrea.com/sf/sf/images/ 33 KB
33 KB 630ms
619ms Image
image/jpeg 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/qqmail.jpg
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 2ba681b3bb179f5103018c11f3b43b5537e6a1be91e18f4b75482b5c370f82c1

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "82cb-5943f561aca00"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 33483

GET
H/1.1 200
OK foxmail_logo.gif
works.s341.xrea.com/sf/sf/images/ 2 KB
2 KB 710ms
699ms Image
image/gif 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/foxmail_logo.gif
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 4b3814ada58754daa7e2f161375d4924b2a36583e458d860268ea6e717a465b1

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "72f-5943f561aca00"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 1839

GET
H/1.1 200
OK outlook.png
works.s341.xrea.com/sf/sf/images/ 5 KB
5 KB 955ms
944ms Image
image/png 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/outlook.png
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 6b1af85883b2ab64690488468bf9fb0699b82e0b8c3239129847e726bcd79c1b

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "13f0-5943f561aca00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=100
Content-Length: 5104

GET
H/1.1 200
OK qiyelogo.jpg
works.s341.xrea.com/sf/sf/images/ 14 KB
15 KB 11ms
11ms Image
image/jpeg 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/qiyelogo.jpg
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 63c2ee1c99b0ceea71e3ee2f5c416e15890c77b9edd76882bd7016830485b9da

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "396e-5943f561aca00"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=98
Content-Length: 14702

GET
H/1.1 200
OK netease_png.png
works.s341.xrea.com/sf/sf/images/ 992 B
1 KB 13ms
12ms Image
image/png 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/netease_png.png
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: 821ed71ac4fb691c086ddb9e6453f3317c083413428f98271c2f52f3b170044b

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "3e0-5943f561aca00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=97
Content-Length: 992

GET
H/1.1 200
OK Qq1.png
works.s341.xrea.com/sf/sf/images/ 22 KB
22 KB 25ms
12ms Image
image/png 150.95.9.160
GMOOSK-NET GMO In...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://works.s341.xrea.com/sf/sf/images/Qq1.png
Requested by: Host: works.s341.xrea.com
URL: http://works.s341.xrea.com/sf/sf/tracking2.php
Protocol: HTTP/1.1
Server: 150.95.9.160 , Japan, ASN58791 (GMOOSK-NET GMO Internet,Inc, JP),
Reverse DNS: s341.xrea.com
Software: Apache /
Resource Hash: ea39d08c301bff6b21cf149ee9d22467b97855eb888b96e0f003691223b9bb78

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/sf/sf/tracking2.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Tue, 01 Mar 2022 12:35:51 GMT
Last-Modified: Sun, 06 Oct 2019 15:10:32 GMT
Server: Apache
ETag: "57de-5943f561aca00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=15, max=96
Content-Length: 22494

GET
H2 200 valueauth_bnr.png
www.value-domain.com/security/value-auth/img/ 14 KB
15 KB 38ms
23ms Image
image/webp 2606:4700:10::6814:8681
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.value-domain.com/security/value-auth/img/valueauth_bnr.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:8681 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d662c01c639b9b1db7b6397d3226e4b4dff93c4f29cd73216a43a95e39ca2bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://works.s341.xrea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 01 Mar 2022 12:35:52 GMT
vary: Accept
cf-cache-status: HIT
age: 208
cf-polished: origFmt=png, origSize=29981
content-disposition: inline; filename="valueauth_bnr.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14802
last-modified: Wed, 21 Jul 2021 00:55:52 GMT
server: cloudflare
etag: "751d-5c797a1d72c4c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: image/webp
expires: Tue, 01 Mar 2022 12:47:24 GMT
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6e51ef5fbd058aa4-NRT
cf-bgj: imgq:100,h2pri

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: SF Express (Transportation) Generic (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| validateForm

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			works.s341.xrea.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: f7rv8toaq0q4tc976ub6tf8mt3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cache1.value-domain.com
works.s341.xrea.com
www.value-domain.com
150.95.9.160
2606:4700:10::6814:8681
0d662c01c639b9b1db7b6397d3226e4b4dff93c4f29cd73216a43a95e39ca2bc
2ba681b3bb179f5103018c11f3b43b5537e6a1be91e18f4b75482b5c370f82c1
4b3814ada58754daa7e2f161375d4924b2a36583e458d860268ea6e717a465b1
556639fbeffc1064be2f9620bdf49e1b0426b8ec1d63f181112871158da8bc9d
63c2ee1c99b0ceea71e3ee2f5c416e15890c77b9edd76882bd7016830485b9da
6b1af85883b2ab64690488468bf9fb0699b82e0b8c3239129847e726bcd79c1b
821ed71ac4fb691c086ddb9e6453f3317c083413428f98271c2f52f3b170044b
8fa2cd0c614884da89146e5ca369046b4b5a8a7df71213d0184753756e058d99
d30eeb036a0992cbf196e9f08e7b05c8038fe04cfca03328d3ec21af21c8750a
d520d21d83ca745dd8eb87cd367c13a3414756827aa3ac033d7d1632eba594a8
ea39d08c301bff6b21cf149ee9d22467b97855eb888b96e0f003691223b9bb78
ea3ce8b96f60a35f4a8c8489badb30254fe0b7b8d63c98601d4055c22c6f43b0

works.s341.xrea.com Open in urlscan Pro 150.95.9.160 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

8 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

152 kBTransfer

151 kBSize

1 Cookies

1 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

works.s341.xrea.com Open in urlscan Pro
150.95.9.160 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

8 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

152 kB
Transfer

151 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!