![](/screenshots/ceca904f-9253-46d8-aa92-3d01db1db45e.png)
demo.extor.org
Open in
urlscan Pro
2606:4700:30::681c:1911
Malicious Activity!
Public Scan
Effective URL: https://demo.extor.org/zzl/stylesedited/try.php?main_domain=mail.hhm.co.il&account=ifatch@hhm.co.il
Submission: On January 06 via manual from IL
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on September 26th 2019. Valid for: 6 months.
This is the only time demo.extor.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 2606:4700:30:... 2606:4700:30::681c:1911 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:821::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c00::9c | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:81e::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 2 | 193.34.56.50 193.34.56.50 | 41923 (HAREL-INS...) (HAREL-INSURANCE-INVESTMENT) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2606:4700::68... 2606:4700::6810:a40d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
13 | 7 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
demo.extor.org |
ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com |
ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google.de |
ASN41923 (HAREL-INSURANCE-INVESTMENT, IL)
PTR: mail.harel-hamishmar.co.il
mail.hhm.co.il |
ASN15169 (GOOGLE - Google LLC, US)
www.google.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.viglink.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
extor.org
1 redirects
demo.extor.org |
41 KB |
2 |
hhm.co.il
1 redirects
mail.hhm.co.il |
847 B |
2 |
google.com
1 redirects
www.google.com |
2 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
18 KB |
1 |
viglink.com
cdn.viglink.com |
28 KB |
1 |
google.de
www.google.de |
109 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
161 B |
1 |
googletagmanager.com
www.googletagmanager.com |
27 KB |
13 | 8 |
Domain | Requested by | |
---|---|---|
8 | demo.extor.org |
1 redirects
demo.extor.org
|
2 | mail.hhm.co.il |
1 redirects
demo.extor.org
|
2 | www.google.com |
1 redirects
demo.extor.org
|
2 | www.google-analytics.com |
1 redirects
www.googletagmanager.com
|
1 | cdn.viglink.com |
demo.extor.org
|
1 | www.google.de |
demo.extor.org
|
1 | stats.g.doubleclick.net | 1 redirects |
1 | www.googletagmanager.com |
demo.extor.org
|
13 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni88138.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-09-26 - 2020-04-03 |
6 months | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2019-12-03 - 2020-02-25 |
3 months | crt.sh |
www.google.de GTS CA 1O1 |
2019-12-03 - 2020-02-25 |
3 months | crt.sh |
*.harel-group.co.il DigiCert Global CA G2 |
2018-02-13 - 2021-05-13 |
3 years | crt.sh |
ssl418259.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-08-10 - 2020-02-16 |
6 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://demo.extor.org/zzl/stylesedited/try.php?main_domain=mail.hhm.co.il&account=ifatch@hhm.co.il
Frame ID: C328EC358AF83FC1782067DA0EEA1717
Requests: 12 HTTP requests in this frame
Frame:
https://mail.hhm.co.il/logon/LogonPoint/tmindex.html
Frame ID: 4139CF5058D817BCBEF12C1B147D9795
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/ceca904f-9253-46d8-aa92-3d01db1db45e.png)
Page URL History Show full URLs
-
https://demo.extor.org/zzl/stylesedited/index.php?email=ifatch@hhm.co.il
HTTP 302
https://demo.extor.org/zzl/stylesedited/try.php?main_domain=mail.hhm.co.il&account=ifatch@hhm.co.il Page URL
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /^cloudflare$/i
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
![](/vendor/wappa/icons/VigLink.png)
Detected patterns
- script /(?:^[^\/]*\/\/[^\/]*viglink\.com\/api\/|vglnk\.js)/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://demo.extor.org/zzl/stylesedited/index.php?email=ifatch@hhm.co.il
HTTP 302
https://demo.extor.org/zzl/stylesedited/try.php?main_domain=mail.hhm.co.il&account=ifatch@hhm.co.il Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://www.google-analytics.com/r/collect?v=1&_v=j79&a=17860566&t=pageview&_s=1&dl=https%3A%2F%2Fdemo.extor.org%2Fzzl%2Fstylesedited%2Ftry.php%3Fmain_domain%3Dmail.hhm.co.il%26account%3Difatch%40hhm.co.il&ul=en-us&de=UTF-8&dt=...&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=389225573&gjid=615453285&cid=1124148126.1578345712&tid=UA-10103988-27&_gid=686260363.1578345712&_r=1>m=2ouc61&z=2028973892 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-10103988-27&cid=1124148126.1578345712&jid=389225573&_gid=686260363.1578345712&gjid=615453285&_v=j79&z=2028973892 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-10103988-27&cid=1124148126.1578345712&jid=389225573&_v=j79&z=2028973892 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-10103988-27&cid=1124148126.1578345712&jid=389225573&_v=j79&z=2028973892&slf_rd=1&random=3368028508
- https://mail.hhm.co.il/ HTTP 302
- https://mail.hhm.co.il/logon/LogonPoint/tmindex.html
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
try.php
demo.extor.org/zzl/stylesedited/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xGOL4gSCnj8pDCeqYyUdmpU2x-Q.js
demo.extor.org/cdn-cgi/apps/head/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.js
demo.extor.org/zzl/stylesedited/try_files/ |
82 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
demo.extor.org/zzl/stylesedited/try_files/ |
1 KB 510 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
demo.extor.org/zzl/stylesedited/mail.hhm.co.il/ |
0 66 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email-decode.min.js
demo.extor.org/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 845 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
73 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
VBh1OBHlBmRG_6lVtmVeN9JjCFg.js
demo.extor.org/cdn-cgi/apps/body/ |
15 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() mail.hhm.co.il/logon/LogonPoint/ Frame 4139 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicons
www.google.com/s2/ |
791 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vglnk.js
cdn.viglink.com/api/ |
78 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Eager object| CloudflareApps object| dataLayer function| getParameterByName string| main_domain string| main_domain_1 string| account object| cid object| id string| phpName string| phpNameUrl object| google_tag_manager string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery function| validate function| action string| phpLog string| pageIcon undefined| vglnkjqry function| vglnkfn number| vglnkcldflr function| vglnk boolean| __v5k function| vl_cB function| vl_disable function| vglnk_157834571259161 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mail.hhm.co.il/ | Name: NSC_ESNS Value: 000602f9-a4f7-1e13-9678-00e0ed69d58b_3469235382_0000748972_00000000000000075752 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.viglink.com
demo.extor.org
mail.hhm.co.il
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
193.34.56.50
2606:4700:30::681c:1911
2606:4700::6810:a40d
2a00:1450:4001:81d::2004
2a00:1450:4001:81e::2004
2a00:1450:4001:821::2008
2a00:1450:4001:821::200e
2a00:1450:4001:825::2003
2a00:1450:400c:c00::9c
06f2b47a2e8017f8387d34806efc5c3643954171cc9cb38e4b1f583a42aaeaa1
15e6a84a2ba45e4ac28f80b2d0b4a5048f1f5242fd8362b9336cf6412f994699
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
9797911ba579201fb3daf4655070486bc4409c39c9b9b7a8fd77bece43dfce73
9ac89d2cb35bc8f7327a8462207f1238e603bb955c924e5de5daa9e6bdf4347b
cb1ddb4cb82293556e5426eaddeef7b6df7ae8ab38f68f0b18dd2f23af370f9f
d9c8635193be87bc23104480d5148991a6d56425367ed2d87786a5751ff0d4c9
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d
f4433d38d22e682147e611b499ccd79dc15b073fbf0510b1b55549912b5893ee