socalprep.us
Open in
urlscan Pro
160.153.90.131
Malicious Activity!
Public Scan
Submitted URL: https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/OUTrefundxq5athndo6dq.html
Effective URL: https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/select-category.php?origin=hmc_claim&continue=details&id_c=lZtBLhEbV...
Submission: On September 11 via manual from GB
Effective URL: https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/select-category.php?origin=hmc_claim&continue=details&id_c=lZtBLhEbV...
Submission: On September 11 via manual from GB
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 13 HTTP transactions.
The main IP is 160.153.90.131, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US.
The main domain is socalprep.us.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 18th 2018. Valid for: 2 years.
This is the only time socalprep.us was scanned on urlscan.io!
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 18th 2018. Valid for: 2 years.
This is the only time socalprep.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: UK Government (Government)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 160.153.90.131 160.153.90.131 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 1 | 185.225.208.133 185.225.208.133 | 13213 (UK2NET-AS) (UK2NET-AS) | |
| 1 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST - Steadfast) | |
| 13 | 4 |
11
160.153.90.131
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-90-131.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-90-131.ip.secureserver.net
| socalprep.us |
1
67.202.94.93
(Chicago, United States)
ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us
ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us
| whos.amung.us |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
socalprep.us
socalprep.us |
253 KB |
| 1 |
amung.us
whos.amung.us |
145 B |
| 1 |
waust.at
waust.at |
7 KB |
| 13 | 3 |
| Domain | Requested by | |
|---|---|---|
| 11 | socalprep.us |
socalprep.us
|
| 1 | whos.amung.us |
waust.at
|
| 1 | waust.at |
socalprep.us
|
| 13 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| socalprep.us Go Daddy Secure Certificate Authority - G2 |
2018-09-18 - 2020-11-06 |
2 years | crt.sh |
| whos.amung.us GeoTrust EV RSA CA 2018 |
2018-03-09 - 2020-05-25 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/select-category.php?origin=hmc_claim&continue=details&id_c=lZtBLhEbVfiPNJIVfVqPRbalzFHwAvrlUkngSrInWrDkALFggwwxYWjYbrU
Frame ID: A23669D5E32AC618077B774DE6434CCC
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/OUTrefundxq5athndo6dq.html Page URL
- https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/select-category.php?origin=hmc_claim&continue=de... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/OUTrefundxq5athndo6dq.html Page URL
- https://socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/select-category.php?origin=hmc_claim&continue=details&id_c=lZtBLhEbVfiPNJIVfVqPRbalzFHwAvrlUkngSrInWrDkALFggwwxYWjYbrU Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
OUTrefundxq5athndo6dq.html
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/ |
360 B 531 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
d.js
waust.at/ |
13 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
whos.amung.us/pingjs/ |
29 B 145 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
select-category.php
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
te.css
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
fonts.css
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/ |
267 KB 197 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.css
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/ |
178 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gv.png
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
tep.css
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/ |
1 KB 615 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gvlc.png
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/outer/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
hm18.png
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/outer/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
94 KB 94 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
opgl.png
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/outer/ |
761 B 815 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
gvct.png
socalprep.us/.ssl/.49f4d31/HMCUSTOMTSTAX/game/outer/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
71 KB 71 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: UK Government (Government)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gvumjmUFitvl1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| socalprep.us/ | Name: PHPSESSID Value: rebcubjoti2q198j8j1iskaag0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
socalprep.us
waust.at
whos.amung.us
160.153.90.131
185.225.208.133
67.202.94.93
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30
203e1db49d3eff430d7dc450ce723c1002542fe1d2bce661b6d8571f14c1043c
47ca49c81a066fd72d7f96e727fd38b63ffbad9586731a5d1373c62f8a93a0f4
5ff8c53913434afd0072a480d7cfca67cace4c8d03f6ef96b78a4455728ce745
6175664d8d2e9b3d669844e4ffe144ff31f9e6c272f5f528892cb397780086c7
9aef19b23a01bd96033bc1f1acb3da5e38dc54bcc4aa1972919c7b2b2a71e4aa
b36f87c8630fd5750869fdaa271b798627d60943a098500454f469a3a362069b
b99a918c9ce507d734764555d5708c1c0439ac8a41cfcec57200c019fcb7f9c1
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
c1aedc8257961b938b4c7a21a2b0db3f2716dd9ef782cea73110dc69107c9042
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9
ea874a79e09423d63420aff44f016fd0b92dc6dec0cc2668d63b150c8669875e
fdac6f8dd37ba36e7e34783aceaf52549fc691f3c0139a9c2a2bc3b252f803e0