www.kingsport3.com Open in urlscan Pro
158.69.50.245  Malicious Activity! Public Scan

URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Submission: On August 13 via automatic, source openphish

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 158.69.50.245, located in Montreal, Canada and belongs to OVH, FR. The main domain is www.kingsport3.com.
This is the only time www.kingsport3.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
10 158.69.50.245 16276 (OVH)
1 54.148.84.95 16509 (AMAZON-02)
12 3
Apex Domain
Subdomains
Transfer
10 kingsport3.com
www.kingsport3.com
416 KB
1 sitepoint.com
www.sitepoint.com
6 KB
0 csscheckbox.com Failed
csscheckbox.com Failed
12 3
Domain Requested by
10 www.kingsport3.com www.kingsport3.com
1 www.sitepoint.com www.kingsport3.com
0 csscheckbox.com Failed www.kingsport3.com
12 3

This site contains no links.

Subject Issuer Validity Valid
sitepoint.com
SSL.com Premium EV CA
2018-08-07 -
2019-09-23
a year crt.sh

1970-01-01 -
1970-01-01
a few seconds crt.sh

This page contains 1 frames:

Primary Page: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Frame ID: 94A9AA09A78C87308610927962054863
Requests: 12 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

12
Requests

8 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

422 kB
Transfer

430 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request authentication.php
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/
7 KB
7 KB
Document
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
a0a040804cafaf8e5c80a9607bf170606cf81f982b8dff16c711be6086b22160

Request headers

Host
www.kingsport3.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:39 GMT
Server
Apache
Content-Length
6880
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/
17 KB
6 KB
Script
General
Full URL
https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-148-84-95.us-west-2.compute.amazonaws.com
Software
Apache/2.2.22 (Debian) /
Resource Hash
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
Security Headers
Name Value
X-Frame-Options sameorigin

Request headers

Sec-Fetch-Mode
no-cors
Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:16:35 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
X-Cache-Lookup
HIT from ip-172-31-22-12.us-west-2.compute.internal:3128
Last-Modified
Fri, 15 Oct 2010 00:03:45 GMT
Server
Apache/2.2.22 (Debian)
Age
305
ETag
"680936-4208-4929c8f629a40"
X-Frame-Options
sameorigin
X-Cache
HIT from ip-172-31-22-12.us-west-2.compute.internal
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
5767
m1.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
33 KB
33 KB
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m1.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
2198157d1ee29b8b6957684b737d654250088e91cb08abe71d4de7f52b108646

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:39 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
33334
m2.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
60 KB
60 KB
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m2.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
85bcb3525082e212737e9fab5337868c3bce991160e82936a4734343f7a69ae2

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:39 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
61439
m3.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
116 KB
116 KB
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m3.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
0677b0bd86269dfb4078afd96b5ae78cb3ae8d2c9bcbe5eea33aaffc809732d8

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:40 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
118907
m4.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
185 KB
185 KB
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m4.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
f26462d064118c9b7d78a5b023f74b1f9bb653e0ce0720e428be19fea1a3427f

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:40 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=90
Content-Length
189081
m5.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
2 KB
2 KB
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m5.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
00ced541e81e6600003455e31f510dc530d2bc304292fe0e5bb8ad4ea96d8c7c

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:40 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=88
Content-Length
1921
m8.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
11 KB
11 KB
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m8.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
8f7f64218f25bea468e95c729d1092bf69a6693417212742038617dbb20fdb20

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:40 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=87
Content-Length
11012
m9.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
535 B
776 B
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m9.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
1dd98675a59629b1d72ebac1aa8cec1de19fc0763437097a4aeca8e62f5ecc76

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:40 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=86
Content-Length
535
m10.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
372 B
613 B
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/m10.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
5652515a9ce8929cba34f51d1aaab8f153b595866f363e833ab81d63f185698b

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:41 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=85
Content-Length
372
logn.png
www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/
385 B
626 B
Image
General
Full URL
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/images/logn.png
Requested by
Host: www.kingsport3.com
URL: http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
Protocol
HTTP/1.1
Security
, ,
Server
158.69.50.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
d0e8abceb949f3286c6c11f4982276e29b59a2067b4a10fafdc59152a71eeb0a

Request headers

Referer
http://www.kingsport3.com/ftoae8193/office365/1de7717eaf6ed0cb1b645b04770267f9/authentication.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 13 Aug 2019 00:21:40 GMT
Last-Modified
Sat, 13 Jul 2019 07:50:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
385
csscheckbox_a4824bcf5d413f078bdd6abd3e6e5bf4.png
csscheckbox.com/checkboxes/u/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
csscheckbox.com
URL
http://csscheckbox.com/checkboxes/u/csscheckbox_a4824bcf5d413f078bdd6abd3e6e5bf4.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| MaskedPassword function| unhideBody

0 Cookies