www.pju.info
Open in
urlscan Pro
104.28.30.30
Malicious Activity!
Public Scan
Effective URL: https://www.pju.info/act10ncadtx/access.php
Submission: On January 31 via manual from CA
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on January 24th 2018. Valid for: 6 months.
This is the only time www.pju.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Canadian Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.24.107.24 104.24.107.24 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 13 | 104.28.30.30 104.28.30.30 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
13 | 2 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
veryhelpful.info |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.pju.info |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
pju.info
1 redirects
www.pju.info |
76 KB |
1 |
veryhelpful.info
veryhelpful.info |
504 B |
13 | 2 |
Domain | Requested by | |
---|---|---|
13 | www.pju.info |
1 redirects
www.pju.info
|
1 | veryhelpful.info | |
13 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
apps4.ams-sga.cra-arc.gc.ca |
www.cra-arc.gc.ca |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni174702.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-01-27 - 2018-08-05 |
6 months | crt.sh |
sni175314.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-01-24 - 2018-08-02 |
6 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://www.pju.info/act10ncadtx/access.php
Frame ID: (7FF1A1A57DA2C28CEE34C04E2C8D612C)
Requests: 11 HTTP requests in this frame
Frame:
https://www.pju.info/act10ncadtx/assets/wmms.svg
Frame ID: (9D239868F05B91E8D349E8644DA6D2FD)
Requests: 1 HTTP requests in this frame
Frame:
https://www.pju.info/act10ncadtx/assets/sig-en.svg
Frame ID: (74C171E26C9E012F56E6B2DF3BD85AB8)
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://veryhelpful.info/drwxc0decad/ Page URL
-
https://www.pju.info/act10ncadtx/
HTTP 302
https://www.pju.info/act10ncadtx/access.php Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Fran�ais
Search URL Search Domain Scan URL
Title: Terms and conditions
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://veryhelpful.info/drwxc0decad/ Page URL
-
https://www.pju.info/act10ncadtx/
HTTP 302
https://www.pju.info/act10ncadtx/access.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
veryhelpful.info/drwxc0decad/ |
139 B 504 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
access.php
www.pju.info/act10ncadtx/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wet-boew.css
www.pju.info/act10ncadtx/assets/ |
182 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theme.css
www.pju.info/act10ncadtx/assets/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
www.pju.info/act10ncadtx/assets/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
www.pju.info/act10ncadtx/assets/ |
21 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
timeout.css
www.pju.info/act10ncadtx/assets/ |
428 B 333 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-leaf.jpg
www.pju.info/act10ncadtx/assets/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header-bg.jpg
www.pju.info/act10ncadtx/assets/ |
15 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sft-deco.gif
www.pju.info/act10ncadtx/assets/ |
80 B 172 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sft-deco-leaf.gif
www.pju.info/act10ncadtx/assets/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wmms.svg
www.pju.info/act10ncadtx/assets/ Frame (9D2 |
5 KB 2 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sig-en.svg
www.pju.info/act10ncadtx/assets/ Frame (74C |
11 KB 2 KB |
Document
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Canadian Government (Government)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| checkLuhn function| checkSin2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.pju.info/ | Name: PHPSESSID Value: 2j8vi7ov53c2vkdoaeke248r06 |
|
.pju.info/ | Name: __cfduid Value: d6d1bca15d98e642b529f1b6e1276c0b61517412478 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
veryhelpful.info
www.pju.info
104.24.107.24
104.28.30.30
2a481a182c07013aaee868579166f3d0aee4f67386b787d20b697330ce87fb2e
352e74be133b2633ede15ab1d9f60703978fe5c748571d79df4eb5b78cc11bdd
372dbc2821a06ee701e74972f6783b83951fe88459a28913ba425613ff15b909
447a4a6c6d785d6fc009367d1fd835b3245114e3162a5dafe288ea54ffd7e0c7
4abb822643a858c9b438cad647548f83e2212ae25f714b11a436360bb507dcac
508d1167367486f2f605cdd5f2c5ff7ace65576343c9b492622b61abf160e266
52e75f289c865f1608d23ef199d4ddcf6c35a9b1c6596d0b515df7b2ffd5dcb4
546cf8ce8330bb243f37c8be0f73230a352d0aae0e911982471fca8d84c74eaf
585defecffe2aae3c3daf15f7ce9c8b6482dab389bcbeb030d399f24232e6f64
79dd1a03ecd39468cdcd0f1b60cef4b717a0f9270392ff14b95f28b4025e9e2b
8f977a0316128ef82012696dd5c0e2325fe894451eff1e54b9677e66efcf539d
93c11c985807fa11dee8e93dabece88c3b74c1e945fa8911c032e75ddd2a6f2d