urlscan.io logo urlscan.io
SecurityTrails logo

playgroup.org Open in urlscan Pro
216.222.194.4  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://playgroup.org/Doc/one/
Submission: On September 26 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 18 HTTP transactions. The main IP is 216.222.194.4, located in Saint Petersburg, United States and belongs to AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US. The main domain is playgroup.org.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 21st 2018. Valid for: 3 months.
This is the only time playgroup.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

IP Address AS Autonomous System
7 216.222.194.4 17054 (AS17054)
2 2a00:1450:400... 15169 (GOOGLE)
1 184.31.91.18 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
3 46.137.81.30 16509 (AMAZON-02)
1 1 52.38.167.67 16509 (AMAZON-02)
2 6 184.31.93.109 20940 (AKAMAI-ASN1)
18 6
7    216.222.194.4 (Saint Petersburg, United States)

ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US)
PTR: vmcp05.myhostcenter.com
playgroup.org
2    2a00:1450:4001:812::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
1    184.31.91.18 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-91-18.deploy.static.akamaitechnologies.com
deluxe.script.ag
1    2a00:1450:4001:812::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com
3    46.137.81.30 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-46-137-81-30.eu-west-1.compute.amazonaws.com
s.thebrighttag.com
1    52.38.167.67 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-38-167-67.us-west-2.compute.amazonaws.com
live.rezync.com
6    184.31.93.109 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-93-109.deploy.static.akamaitechnologies.com
px.owneriq.net
Domain Requested by
7 playgroup.org playgroup.org
6 px.owneriq.net 2 redirects playgroup.org
px.owneriq.net
3 s.thebrighttag.com deluxe.script.ag
2 fonts.googleapis.com playgroup.org
1 live.rezync.com 1 redirects
1 fonts.gstatic.com playgroup.org
1 deluxe.script.ag playgroup.org
18 7

This site contains no links.

Subject Issuer Validity Valid
playgroup.org
cPanel, Inc. Certification Authority		 2018-08-21 -
2018-11-19		 3 months crt.sh
*.googleapis.com
Google Internet Authority G3		 2018-08-28 -
2018-11-20		 3 months crt.sh
cl.script.ag
Let's Encrypt Authority X3		 2018-08-01 -
2018-10-30		 3 months crt.sh
*.google.com
Google Internet Authority G3		 2018-08-28 -
2018-11-20		 3 months crt.sh
*.thebrighttag.com
DigiCert SHA2 Secure Server CA		 2018-04-04 -
2020-04-03		 2 years crt.sh
*.owneriq.net
GeoTrust RSA CA 2018		 2018-01-24 -
2019-01-24		 a year crt.sh

This page contains 2 frames:

Primary Page: https://playgroup.org/Doc/one/
Frame ID: D508F0D480F0F397BF0ED811D81FECE5
Requests: 17 HTTP requests in this frame

Frame: https://px.owneriq.net/noop?ct=text%2Fhtml
Frame ID: E408B730A67EAC6A66C3D7322C547A62
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /Unix/i
Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Overall confidence: 100%
Detected patterns
  • headers server /mod_ssl(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
  • headers server /mod_ssl(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

18
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

258 kB
Transfer

293 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12
  • https://live.rezync.com/sync?c=ef15e91f7672c7df032874c1f72a6eb0&p=31b1575897952390b0a28e1ab52086f4 HTTP 302
  • https://s.thebrighttag.com/px?site=DbKyKJ7&referrer=d_px&d_c=6660d8f1-750f-463a-b91b-75a9714148e6%3A1537997737.31&geo=US
Request Chain 15
  • https://px.owneriq.net/eps?pt=b9r11j&pid=7831&uid=Q5912841362044823177J&l=true HTTP 302
  • https://px.owneriq.net/noop?ct=text%2Fhtml
Request Chain 16
  • https://px.owneriq.net/ep?sid%5B%5D=9382913832&sid%5B%5D=9382913837&sid%5B%5D=9382913842&sid%5B%5D=7835702862&sid%5B%5D=8269461322&pt=b9r11j&uid=Q5912841362044823177J&jcs=1 HTTP 302
  • https://px.owneriq.net/noop?ct=text%2Fhtml

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
playgroup.org/Doc/one/ 		3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / PHP/5.5.38
Resource Hash
3acfb867eda9095e216e559dcbf367aee77e226ec153caccd44d2d944c8abec9

Request headers

Host
playgroup.org
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:35 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
X-Powered-By
PHP/5.5.38
Keep-Alive
timeout=30, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html
css
fonts.googleapis.com/ 		2 KB
614 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:812::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
1e3dbaf62562c1f6b3dc33fc018fe550b786f82a6502a3d2c4a9d1aaa32a6a68
Security Headers
Name Value
Strict-Transport-Security max-age=86400
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=86400
content-encoding
gzip
last-modified
Wed, 26 Sep 2018 21:35:35 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 26 Sep 2018 21:35:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 21:35:35 GMT
style.css
playgroup.org/Doc/one/css/ 		7 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://playgroup.org/Doc/one/css/style.css
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
697c5c68eff0ac91a4bff701f334f82c45ce9712b9db549e7e04242dc7ff39fa

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
playgroup.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://playgroup.org/Doc/one/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:35 GMT
Last-Modified
Wed, 17 Jan 2018 12:32:40 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"1505273-1b07-562f80b076a00"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=30, max=99
Content-Length
6919
css
fonts.googleapis.com/ 		0
660 B 		Other
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:600
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:812::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=86400
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Purpose
prefetch
Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=86400
content-encoding
gzip
last-modified
Wed, 26 Sep 2018 21:35:35 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 26 Sep 2018 21:35:35 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 21:35:35 GMT
tag.js
deluxe.script.ag/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://deluxe.script.ag/tag.js
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.91.18 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-91-18.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d83b628407a21e171eab4ebd3baa638ecda547d65cc8d7d4443939e5ec3a0c41

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:35 GMT
Content-Encoding
gzip
Last-Modified
Thu, 20 Sep 2018 15:32:42 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
12398
landing-devices-bg.jpg
playgroup.org/Doc/one/images/ 		195 KB
196 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://playgroup.org/Doc/one/images/landing-devices-bg.jpg
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
e8f80990badd44fd6d05b66b116d0ae7cba88ccaeae01805035263ce272937b7

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
playgroup.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://playgroup.org/Doc/one/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://playgroup.org/Doc/one/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:35 GMT
Last-Modified
Wed, 17 Jan 2018 12:32:08 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"1505276-30cca-562f8091f2200"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=30, max=98
Content-Length
199882
mail.png
playgroup.org/Doc/one/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://playgroup.org/Doc/one/images/mail.png
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
a2b00dc7e4ff8539cf742bf8d295c111dea08acf46328483d68640135887e70a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
playgroup.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://playgroup.org/Doc/one/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://playgroup.org/Doc/one/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Last-Modified
Wed, 17 Jan 2018 12:32:08 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"1505277-69e-562f8091f2200"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=30, max=100
Content-Length
1694
outlook.png
playgroup.org/Doc/one/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://playgroup.org/Doc/one/images/outlook.png
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
f5abe79538714148a390de1c7d7d568746510a32e14b37feacc4812155825558

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
playgroup.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://playgroup.org/Doc/one/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://playgroup.org/Doc/one/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Last-Modified
Wed, 17 Jan 2018 12:32:10 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"150527a-837-562f8093da680"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=30, max=100
Content-Length
2103
office.png
playgroup.org/Doc/one/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://playgroup.org/Doc/one/images/office.png
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
685f77342ca77f562bb319cf666966ebd283ba9ad568148bf4d6f66d5fa08eb5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
playgroup.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://playgroup.org/Doc/one/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://playgroup.org/Doc/one/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Last-Modified
Wed, 17 Jan 2018 12:32:10 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"1505278-58d-562f8093da680"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=30, max=100
Content-Length
1421
oneDrive.png
playgroup.org/Doc/one/images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://playgroup.org/Doc/one/images/oneDrive.png
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.222.194.4 Saint Petersburg, United States, ASN17054 (AS17054 - CONTINENTAL BROADBAND PENNSYLVANIA, INC., US),
Reverse DNS
vmcp05.myhostcenter.com
Software
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash
c010eda9ab4ad066a43d0b7fd4fe7f2be2e849af38db2e0b4af109ea7bcd5593

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
playgroup.org
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://playgroup.org/Doc/one/css/style.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://playgroup.org/Doc/one/css/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Last-Modified
Wed, 17 Jan 2018 12:32:10 GMT
Server
Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag
"1505279-3a85-562f8093da680"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=30, max=100
Content-Length
14981
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v15/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:812::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
50dda9aac0fcea362bdda27ae7833240485ad5a20ccc105c1cd13ea26802a8bd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:600
Origin
https://playgroup.org

Response headers

date
Wed, 29 Aug 2018 20:04:06 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Oct 2017 21:49:48 GMT
server
sffe
age
2424689
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
8916
x-xss-protection
1; mode=block
expires
Thu, 29 Aug 2019 20:04:06 GMT
tag
s.thebrighttag.com/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=0M6ZVb2&H=-13k5uwi
Requested by
Host: deluxe.script.ag
URL: https://deluxe.script.ag/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.137.81.30 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-137-81-30.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
91656b23920b6a4d784b0e7239c96592c7007d8023f27efefcea2885091b8639

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 21:35:35 GMT
Content-Encoding
gzip
Server
nginx
ETag
fc779285b84b752f76e3cf19ed31b622
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript
X-BT-RequestId
1aac7f20-c1d4-11e8-ab9e-0000ac150a09
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tag
s.thebrighttag.com/ 		625 B
802 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=0M6ZVb2&H=-13k5uwi&referrer=https%3A%2F%2Fplaygroup.org%2FDoc%2Fone%2F&mode=v2&cf=6388303&_cb_bt_data(%27url%20domain%27)=playgroup.org&btpdb.0M6ZVb2.dGZjLjY2OTQ3NDY=SE9VUlM&btpdb.0M6ZVb2.dGZjLjYwOTQyNzg=REFZUw&btpdb.0M6ZVb2.dGZjLjYwOTQyOTk=U0VTU0lPTg&btpdb.0M6ZVb2.dGZjLjYwOTQyODU=VVNFUg
Requested by
Host: deluxe.script.ag
URL: https://deluxe.script.ag/tag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.137.81.30 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-137-81-30.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
aaf975e8d1a23a36967526e3406526e48856f3ffd78cf22e57930de26faa59c5

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 21:35:36 GMT
Content-Encoding
gzip
Server
nginx
ETag
6044228a2a494c363d5ab8c38b2a228a
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Cache-Control
private, must-revalidate
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript
X-BT-RequestId
1b179d01-c1d4-11e8-bb40-0000ac1506c2
Expires
Thu, 01 Jan 1970 00:00:00 GMT
px
s.thebrighttag.com/
Redirect Chain
  • https://live.rezync.com/sync?c=ef15e91f7672c7df032874c1f72a6eb0&p=31b1575897952390b0a28e1ab52086f4
  • https://s.thebrighttag.com/px?site=DbKyKJ7&referrer=d_px&d_c=6660d8f1-750f-463a-b91b-75a9714148e6%3A1537997737.31&geo=US
35 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.thebrighttag.com/px?site=DbKyKJ7&referrer=d_px&d_c=6660d8f1-750f-463a-b91b-75a9714148e6%3A1537997737.31&geo=US
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.137.81.30 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-46-137-81-30.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 21:35:37 GMT
Server
nginx
P3P
CP=NOI DSP COR NID
Cache-Control
private, must-revalidate
Connection
keep-alive
X-BT-RequestId
1b8ca5f1-c1d4-11e8-95bd-0000ac1508f6
Content-Type
image/gif
Content-Length
35
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.thebrighttag.com/px?site=DbKyKJ7&referrer=d_px&d_c=6660d8f1-750f-463a-b91b-75a9714148e6%3A1537997737.31&geo=US
Date
Wed, 26 Sep 2018 21:35:37 GMT
Server
lighttpd/1.4.33
Connection
keep-alive
Content-Length
471
Content-Type
text/html; charset=utf-8
b9r11j.js
px.owneriq.net/stas/s/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://px.owneriq.net/stas/s/b9r11j.js
Requested by
Host: playgroup.org
URL: https://playgroup.org/Doc/one/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.93.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-93-109.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
2c0c55ad4b496a3fd2f63d33372632c2d5175cdc005b1ec4ed7c7c3139f2f760

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Mar 2017 01:23:14 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
application/x-javascript
Connection
keep-alive
Content-Length
4895
Expires
Thu, 27 Sep 2018 03:35:05 GMT
/
px.owneriq.net/j/ 		888 B
844 B 		Script
General
Check archive.org
Download Go to
Full URL
https://px.owneriq.net/j/?pt=b9r11j&t=f%7C%22One%2520Drive%2520Cloud%2520Document%2520Sharing%22&s=mpe2
Requested by
Host: px.owneriq.net
URL: https://px.owneriq.net/stas/s/b9r11j.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.93.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-93-109.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
8a5d30ed81b9fbe6225b1ae958b542115ff878b668db787537b4e665174de86a

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Content-Encoding
gzip
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
493
noop
px.owneriq.net/ Frame E408
Redirect Chain
  • https://px.owneriq.net/eps?pt=b9r11j&pid=7831&uid=Q5912841362044823177J&l=true
  • https://px.owneriq.net/noop?ct=text%2Fhtml
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://px.owneriq.net/noop?ct=text%2Fhtml
Requested by
Host: px.owneriq.net
URL: https://px.owneriq.net/stas/s/b9r11j.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.93.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-93-109.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host
px.owneriq.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://playgroup.org/Doc/one/
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://playgroup.org/Doc/one/

Response headers

Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length
0
Content-Type
text/html
Date
Wed, 26 Sep 2018 21:35:36 GMT
Connection
keep-alive

Redirect headers

Server
AkamaiGHost
Content-Length
0
Location
https://px.owneriq.net/noop?ct=text%2Fhtml
Date
Wed, 26 Sep 2018 21:35:36 GMT
Connection
keep-alive
noop
px.owneriq.net/
Redirect Chain
  • https://px.owneriq.net/ep?sid%5B%5D=9382913832&sid%5B%5D=9382913837&sid%5B%5D=9382913842&sid%5B%5D=7835702862&sid%5B%5D=8269461322&pt=b9r11j&uid=Q5912841362044823177J&jcs=1
  • https://px.owneriq.net/noop?ct=text%2Fhtml
0
287 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.owneriq.net/noop?ct=text%2Fhtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.31.93.109 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a184-31-93-109.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://playgroup.org/Doc/one/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 21:35:36 GMT
Server
Apache/2.2.15 (CentOS)
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By
PHP/5.3.3
Content-Length
0
Content-Type
text/html

Redirect headers

Location
https://px.owneriq.net/noop?ct=text%2Fhtml
Date
Wed, 26 Sep 2018 21:35:36 GMT
Server
AkamaiGHost
Connection
keep-alive
Content-Length
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| popupwnd function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag object| _oiqq function| oiq_send_logging_error function| oiq_addPageMfg function| oiq_addPageBrand function| oiq_addPageDT function| oiq_addPageCat function| oiq_addPageProduct function| oiq_addPageSource function| oiq_addPageLifecycle function| oiq_addUserId function| oiq_addCustomKVP function| oiq_pushDCT function| oiq_ddPush function| oiq_is function| oiq_iifr function| oiq_sha256 function| oiq_md5 function| oiq_doTag boolean| _oiq_fps_js undefined| oiq_key object| t function| f function| oiq_getRefererImgURL function| oiq_parseURL function| oiq_findQueryArgument object| OIQLogging function| oiq_ii function| oiq_log_event object| oiq_pt string| oiq_uid number| _oiqSC object| oiq_pSource string| oiq_img_src_0 undefined| oiq_i_0

4 Cookies

Domain/Path Name / Value
playgroup.org/ Name: btpdb.0M6ZVb2.dGZjLjYwOTQyODU
Value: VVNFUg
playgroup.org/ Name: btpdb.0M6ZVb2.dGZjLjYwOTQyNzg
Value: REFZUw
playgroup.org/ Name: btpdb.0M6ZVb2.dGZjLjYwOTQyOTk
Value: U0VTU0lPTg
playgroup.org/ Name: btpdb.0M6ZVb2.dGZjLjY2OTQ3NDY
Value: SE9VUlM