www.virginiataxattorney.net Open in urlscan Pro
2606:4700:3033::6815:20ba Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod
Submission: On March 10 via api (March 10th 2023, 11:23:39 am UTC) from US — Scanned from US

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3033::6815:20ba, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.virginiataxattorney.net.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 24th 2022. Valid for: a year.

This is the only time www.virginiataxattorney.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
7	2606:4700:303... 2606:4700:3033::6815:20ba		13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2

7 2606:4700:3033::6815:20ba (United States)

ASN13335 (CLOUDFLARENET, US)

www.virginiataxattorney.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	virginiataxattorney.net www.virginiataxattorney.net	212 KB
7	1

	Domain	Requested by
7	www.virginiataxattorney.net	www.virginiataxattorney.net
7	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-24` - `2023-08-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod
Frame ID: AAB94950CDA568BC5B94136998ABC8DF
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Client Portal Login

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

212 kB
Transfer

594 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request prod.php Show response www.virginiataxattorney.net/yz/c/	3 KB 2 KB	1098ms 995ms	Document text/html	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `14b270d308460ac21c4de9bdb620b2fbf930e8639d00f42500644d54f179bede` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control max-age=0 cf-cache-status DYNAMIC cf-ray 7a5b2fac9adde12f-ORD content-encoding br content-type text/html; charset=UTF-8 date Fri, 10 Mar 2023 11:23:34 GMT expires Fri, 10 Mar 2023 11:23:33 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NJqVMsIaO7GDRLXsTQ5pxyizulHFn1s63gkN%2F5CHrWuyF%2BCJQWlheXTcV1wUDww2dT4mxPv3kI3JLrr5yVhEmCzea7ClE7VCPeo437Qnmcdpguo%2BSyZAa40HBtNQct0r16s5WSSgn2xJOVe7YQuxEOIKRN4EHS3MlJQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent
GET H2	200	2.css www.virginiataxattorney.net/yz/c/wiz_files/	157 KB 25 KB	37ms 35ms	Stylesheet text/css	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.virginiataxattorney.net/yz/c/wiz_files/2.css Requested by Host: www.virginiataxattorney.net URL: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0bebdda0ca447eb1a4a995ebbcc25b753ecc40d3c8ecf0628beab00d98e0bf9d` Request headers accept-language en-US,en;q=0.9 Referer https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Fri, 10 Mar 2023 11:23:34 GMT content-encoding br cf-cache-status HIT last-modified Tue, 28 Feb 2023 17:07:49 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 236752 vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6jyEeY%2Fq%2BFL3r0599MASfz5icAP5BaMWCm%2BA3B0Kn%2BI%2BRsfyJ3nlXYWsSKg5S2uu4AKhDRLVd2D2xykWii5POkw8id5sJHGjx3jgKsqOjr0WDfyCyOi5m1hl7xx%2BbyDURfyUQK2HmNh9%2FwSFI7Ea6nY%2Fz9gr99pMEPo%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, max-age=31536000 cf-ray 7a5b2fb2daa1e12f-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Wed, 06 Mar 2024 17:37:42 GMT
GET H2	200	main.css www.virginiataxattorney.net/yz/c/wiz_files/	247 KB 182 KB	109ms 108ms	Stylesheet text/css	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.virginiataxattorney.net/yz/c/wiz_files/main.css Requested by Host: www.virginiataxattorney.net URL: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fef07e8b576d7181dce8ac608f81a75f616b5f984b72ed7395b97848789d4ac8` Request headers accept-language en-US,en;q=0.9 Referer https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Fri, 10 Mar 2023 11:23:34 GMT content-encoding br cf-cache-status MISS last-modified Tue, 28 Feb 2023 17:07:49 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=60kQ8RSzOT%2BKtZ7VD0I3md1L0AhurtZYHpSb0PDKI01JFtOwdv%2BzbW%2B5eXOSCzGV1EI9f82jA4GS7RuO5q0rHwyGxgrDMlJiaVzIaC5M7hNsW3sTI5D3XR1d03yWwW%2FSi04OGr1LzfRFa0HfX6TTFi%2FS6lHEK041ttw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 cache-control public, max-age=31536000 cf-ray 7a5b2fb2daa2e12f-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Sat, 09 Mar 2024 11:23:34 GMT
GET H2	200	logger-1.js Show response www.virginiataxattorney.net/yz/c/wiz_files/	0 304 B	1076ms 1075ms	Script text/html	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.virginiataxattorney.net/yz/c/wiz_files/logger-1.js Requested by Host: www.virginiataxattorney.net URL: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-US,en;q=0.9 Referer https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Fri, 10 Mar 2023 11:23:35 GMT content-encoding br cf-cache-status MISS last-modified Fri, 10 Mar 2023 11:23:35 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BPCtR%2B2YGsAoIsQaNC7gbw6%2BFJ0YNtAHtSelBKYDHq5t17xVK5VMrkFXNiBUXKiacQp%2FIXS8aIwjijZy4eDJuL20vrXy%2F%2Fbb6n14EXN2kEIZXHuNrMflQZK8i8l78OUog29%2FrroOisLEW%2FzGj2Peiwzj%2BNXIvh2gWnA%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cache-control max-age=14400 cf-ray 7a5b2fb2facbe12f-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 10 Mar 2023 11:23:34 GMT
GET H2	200	loki.svg www.virginiataxattorney.net/yz/c/wiz_files/	4 KB 2 KB	64ms 63ms	Image image/svg+xml	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.virginiataxattorney.net/yz/c/wiz_files/loki.svg Requested by Host: www.virginiataxattorney.net URL: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language en-US,en;q=0.9 Referer https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Fri, 10 Mar 2023 11:23:34 GMT content-encoding br cf-cache-status MISS last-modified Tue, 28 Feb 2023 17:07:49 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DvyP1gDc9P9CgF9FJyq8g80trIJ5igTVtZikyFgnLlZul5AS2sKi0b8ypwvOH3VOH84g5%2BXlai5XZZDLAz%2B4jlCuV6ExF%2BWjG7KTnPD1DMgYlB2d9Rot1l5P9XCyWhqKs62b94azsT4vOqVApJ2Qrll%2Fs1u4TPqV9jc%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control public, max-age=10368000 cf-ray 7a5b2fb2facde12f-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Sat, 08 Jul 2023 11:23:34 GMT
GET H2	200	2.js Show response www.virginiataxattorney.net/yz/c/wiz_files/	0 329 B	1076ms 1074ms	Script text/html	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.virginiataxattorney.net/yz/c/wiz_files/2.js Requested by Host: www.virginiataxattorney.net URL: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-US,en;q=0.9 Referer https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Fri, 10 Mar 2023 11:23:35 GMT content-encoding br cf-cache-status EXPIRED last-modified Thu, 09 Mar 2023 09:15:07 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KfhmxXPsfSW5c4UBrv0kkxXBrJ8lzI8ppnBNDvSDi9PceuO%2BlmoRUKWMOpwEAGgB6dTEVCivb8nxQuUn1NVGPV%2BOqQIaGXQHaw4WXbXNEFA0nc3Vc3YINy9R47fcbgV0PQ%2FsFustoXR1kF%2FRW89nXZlpispPor0Xb2k%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cache-control max-age=14400 cf-ray 7a5b2fb2fac6e12f-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 10 Mar 2023 11:23:34 GMT
GET H2	200	main.js Show response www.virginiataxattorney.net/yz/c/wiz_files/	0 375 B	921ms 920ms	Script text/html	2606:4700:3033::6815:20ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.virginiataxattorney.net/yz/c/wiz_files/main.js Requested by Host: www.virginiataxattorney.net URL: https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6815:20ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-US,en;q=0.9 Referer https://www.virginiataxattorney.net/yz/c/prod.php?cm9ib2NvcA=mod User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Fri, 10 Mar 2023 11:23:35 GMT content-encoding br cf-cache-status MISS last-modified Fri, 10 Mar 2023 11:23:35 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qOs0SvLaTwETIvH91A09kb01%2Bc9vG0X7FTlmJ%2BKpHfyR4tHN3ugIbSG7rh%2FKIS4qk2p%2FcmctqVvAImTzDzmzPmfo6Ag5IgKAGyBvnRVd2anBU5c1kO3MLGludZubjqGA8uKbRqVGoUsqe9msn0CckDmUNNu1V5e60oM%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cache-control max-age=14400 cf-ray 7a5b2fb2fac8e12f-ORD alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Fri, 10 Mar 2023 11:23:34 GMT
GET DATA	200 OK	truncated /	183 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `724ef167b4989fc25f7abaf0de662208eb55159eb7bb33d67c3121fe23dee830` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| webpackJsonpweb.client-portal

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.virginiataxattorney.net
2606:4700:3033::6815:20ba
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0bebdda0ca447eb1a4a995ebbcc25b753ecc40d3c8ecf0628beab00d98e0bf9d
14b270d308460ac21c4de9bdb620b2fbf930e8639d00f42500644d54f179bede
724ef167b4989fc25f7abaf0de662208eb55159eb7bb33d67c3121fe23dee830
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fef07e8b576d7181dce8ac608f81a75f616b5f984b72ed7395b97848789d4ac8

www.virginiataxattorney.net Open in urlscan Pro 2606:4700:3033::6815:20ba Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

212 kBTransfer

594 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

www.virginiataxattorney.net Open in urlscan Pro
2606:4700:3033::6815:20ba Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

212 kB
Transfer

594 kB
Size

0
Cookies

7 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!