URL: https://no5gdz.000webhostapp.com/Passau/Passau.htm
Submission: On October 04 via manual from DE

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 3 HTTP transactions.
The main IP is 2a02:4780:dead:cbcd::1, located in United States and belongs to AWEX, US. The main domain is no5gdz.000webhostapp.com.
TLS certificate: Issued by RapidSSL RSA CA 2018 on June 11th 2019. Valid for: 2 years.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 100/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against Outlook Web Access (Online)
  • googlesafebrowsing - Score: 100 (1 resources matched) -
    social_engineering

Domain & IP information

IP Address AS Autonomous System
2 2a02:4780:dea... 204915 (AWEX)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
3 3
Domain
Subdomains
Transfer
2 000webhostapp.com
29 KB
1 000webhost.com
2 KB
3 2
Domain Requested by
2 no5gdz.000webhostapp.com no5gdz.000webhostapp.com
1 cdn.000webhost.com no5gdz.000webhostapp.com
3 2

This site contains links to these domains. Also see Links.

Domain
www.000webhost.com
Subject / Issuer Validity Valid
*.000webhostapp.com
RapidSSL RSA CA 2018
2019-06-11 -
2021-07-10
2 years
*.000webhost.com
COMODO RSA Domain Validation Secure Server CA
2018-10-19 -
2020-12-17
2 years

Screenshot



Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Passau.htm
/Passau
62 KB
29 KB
Document
General
Full URL
https://no5gdz.000webhostapp.com/Passau/Passau.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:cbcd::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
f2699f5fc1413a7f409d96d14bde65ca367cf3da325e7a9bd0f2e2bca9e4a5e6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
no5gdz.000webhostapp.com
:scheme
https
:path
/Passau/Passau.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
date
Fri, 04 Oct 2019 12:30:28 GMT
content-type
text/html; charset=UTF-8
server
awex
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-request-id
780191586a4c12d1ee35648193605c25
content-encoding
gzip
footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo
2 KB
2 KB
Image
General
Full URL
https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png
Requested by
Host: no5gdz.000webhostapp.com
URL: https://no5gdz.000webhostapp.com/Passau/Passau.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:432e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
Security Headers
Name Value
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://no5gdz.000webhostapp.com/Passau/Passau.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 04 Oct 2019 12:30:28 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
2866
cf-polished
origFmt=png, origSize=2046
status
200
content-disposition
inline; filename="footer-powered-by-000webhost-white2.webp"
x-hostinger-datacenter
srv
vary
Accept
content-length
1696
x-xss-protection
1; mode=block
last-modified
Fri, 04 Oct 2019 06:52:21 GMT
server
cloudflare
x-frame-options
sameorigin
etag
"5d96ec25-7fe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000
content-type
image/webp
expires
Fri, 04 Oct 2019 16:30:28 GMT
cache-control
public, max-age=14400
x-hostinger-node
nl-srv-cdn2
accept-ranges
bytes
cf-ray
52072ad6184ecba0-VIE
cf-bgj
imgq:100
data:truncated
data:truncated
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
8 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
data:truncated
data:truncated
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
segoeui-regular.ttf
/owa/auth/15.1.1713/themes/resources
0
0
Font
General
Full URL
https://no5gdz.000webhostapp.com/owa/auth/15.1.1713/themes/resources/segoeui-regular.ttf
Requested by
Host: no5gdz.000webhostapp.com
URL: https://no5gdz.000webhostapp.com/Passau/Passau.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:cbcd::1 , United States, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Sec-Fetch-Mode
cors
Referer
https://no5gdz.000webhostapp.com/Passau/Passau.htm
Origin
https://no5gdz.000webhostapp.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 04 Oct 2019 12:30:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
awex
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
x-request-id
0588c174b94863ab2eccae5763d084b7

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: Outlook Web Access (Online)

50 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| initLogon function| redir function| shw function| hd function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick function| getCookie object| notification object| hostingerLogo undefined| mainContent object| newList undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| h1Tag undefined| paragraph undefined| list undefined| listElements undefined| org_html undefined| new_html undefined| saleImage

1 Cookies

Domain/Path Name / Value
no5gdz.000webhostapp.com/Passau Name: cookieTest
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block