desertsunlandscape.com Open in urlscan Pro
50.28.103.82 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://desertsunlandscape.com/wp-includes/js/promo/step2.php
Submission: On August 01 via automatic, source openphish (August 1st 2017, 10:27:31 am UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 50.28.103.82, located in Phoenix, United States and belongs to LIQUID-WEB-INC2 - Liquid Web, L.L.C, US. The main domain is desertsunlandscape.com.

This is the only time desertsunlandscape.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) USAA (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	50.28.103.82 50.28.103.82	53824 (LIQUID-WE...) (LIQUID-WEB-INC2 - Liquid Web)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
11	2

10 50.28.103.82 (Phoenix, United States)

ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US)
PTR: stg.stgeorgedesign.com

desertsunlandscape.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	desertsunlandscape.com desertsunlandscape.com	105 KB
1	sitepoint.com www.sitepoint.com	6 KB
11	2

	Domain	Requested by
10	desertsunlandscape.com	desertsunlandscape.com
1	www.sitepoint.com	desertsunlandscape.com
11	2

This site contains no links.

Subject Issuer	Validity	Valid
sitepoint.com SSL.com Premium EV CA	`2017-06-13` - `2018-08-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://desertsunlandscape.com/wp-includes/js/promo/step2.php
Frame ID: 6010.1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

11
Requests

9 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

111 kB
Transfer

122 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request step2.php Show response desertsunlandscape.com/wp-includes/js/promo/	4 KB 4 KB	301ms 151ms	Document text/html	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Full URL http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `a7c40454269c051591dbf832100cf49022f47b4346a1368e2838b55385af460f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:19 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=1, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	MaskedPassword.js Show response www.sitepoint.com/examples/password/MaskedPassword/	17 KB 6 KB	680ms 168ms	Script application/javascript	54.148.84.95 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-148-84-95.us-west-2.compute.amazonaws.com Software Apache/2.2.22 (Debian) / Resource Hash `2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 09:06:16 GMT Content-Encoding gzip X-Cache-Lookup HIT from ip-172-31-17-146.us-west-2.compute.internal:3128 Last-Modified Fri, 15 Oct 2010 00:03:45 GMT Server Apache/2.2.22 (Debian) Age 4864 ETag "680936-4208-4929c8f629a40" Vary Accept-Encoding X-Cache HIT from ip-172-31-17-146.us-west-2.compute.internal Content-Type application/javascript Accept-Ranges bytes Content-Length 5767
GET H/1.1	200 OK	s20.png desertsunlandscape.com/wp-includes/js/promo/images/	23 KB 23 KB	153ms 152ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s20.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `31c0c98b71e183369b3cd03ab64edce93c2c47f8a86257dc3450d2ae579ee3f0` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Wed, 24 May 2017 06:24:34 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=99 Content-Length 23881
GET H/1.1	200 OK	s2.png desertsunlandscape.com/wp-includes/js/promo/images/	8 KB 8 KB	151ms 151ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s2.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `fb466eee9c8e8dad2f3db302292209c7ea7ff928ebb6855d132ca748182259df` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Wed, 24 May 2017 06:19:12 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=98 Content-Length 7861
GET H/1.1	200 OK	s21.png desertsunlandscape.com/wp-includes/js/promo/images/	2 KB 2 KB	151ms 151ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s21.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `1c1a74ad68f9f780c0c26f233132bef8a3958b1782c9fbb312c0901b6ddc65bd` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Wed, 24 May 2017 07:02:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=97 Content-Length 1662
GET H/1.1	200 OK	s13.png desertsunlandscape.com/wp-includes/js/promo/images/	44 KB 44 KB	151ms 150ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s13.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `9c07281b3549bbabe697a1be131f0860302b9073416f2a6a87edb86a094b410a` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Wed, 24 May 2017 06:32:52 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=96 Content-Length 44889
GET H/1.1	200 OK	s22.png desertsunlandscape.com/wp-includes/js/promo/images/	1 KB 1 KB	297ms 148ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s22.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `96a2a9a46b9270f7822709e7d2cb1d88624fa668fd3bc12167cc13f15c3015b6` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Sat, 20 Dec 2014 17:59:58 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=100 Content-Length 1364
GET H/1.1	200 OK	s23.png desertsunlandscape.com/wp-includes/js/promo/images/	869 B 869 B	302ms 151ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s23.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `7136ff8a691d77124fe0100c2c4c75f94d8d1899c75aa4a608d169aab4979d34` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Sat, 20 Dec 2014 18:00:08 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=100 Content-Length 869
GET H/1.1	200 OK	s.png desertsunlandscape.com/wp-includes/js/promo/images/	20 KB 20 KB	303ms 152ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `1bd2510d4e39e5faf16a19f98e06d306ca67699030c147f9b6254c512b7bff20` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Wed, 24 May 2017 06:19:52 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=100 Content-Length 20950
GET H/1.1	200 OK	next.png desertsunlandscape.com/wp-includes/js/promo/images/	1 KB 1 KB	304ms 152ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/next.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `d57ecdb1b1b63078608ce4aadcdb8c8f4e1a3a05e9bce86feff28ce2cae4196c` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Sat, 20 Dec 2014 17:59:46 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=100 Content-Length 1051
GET H/1.1	200 OK	s24.png desertsunlandscape.com/wp-includes/js/promo/images/	1 KB 1 KB	304ms 152ms	Image image/png	50.28.103.82 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://desertsunlandscape.com/wp-includes/js/promo/images/s24.png Requested by Host: desertsunlandscape.com URL: http://desertsunlandscape.com/wp-includes/js/promo/step2.php Protocol HTTP/1.1 Server 50.28.103.82 Phoenix, United States, ASN53824 (LIQUID-WEB-INC2 - Liquid Web, L.L.C, US), Reverse DNS stg.stgeorgedesign.com Software Apache / Resource Hash `9c6c579b1adb08e03cafe1ba9eae8e40443ff7a39c8d61fc4c4d7ad66696657d` Request headers Referer http://desertsunlandscape.com/wp-includes/js/promo/step2.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36 Response headers Date Tue, 01 Aug 2017 10:27:20 GMT Last-Modified Wed, 24 May 2017 06:32:00 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=100 Content-Length 1085

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) USAA (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

desertsunlandscape.com
www.sitepoint.com
50.28.103.82
54.148.84.95
1bd2510d4e39e5faf16a19f98e06d306ca67699030c147f9b6254c512b7bff20
1c1a74ad68f9f780c0c26f233132bef8a3958b1782c9fbb312c0901b6ddc65bd
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
31c0c98b71e183369b3cd03ab64edce93c2c47f8a86257dc3450d2ae579ee3f0
7136ff8a691d77124fe0100c2c4c75f94d8d1899c75aa4a608d169aab4979d34
96a2a9a46b9270f7822709e7d2cb1d88624fa668fd3bc12167cc13f15c3015b6
9c07281b3549bbabe697a1be131f0860302b9073416f2a6a87edb86a094b410a
9c6c579b1adb08e03cafe1ba9eae8e40443ff7a39c8d61fc4c4d7ad66696657d
a7c40454269c051591dbf832100cf49022f47b4346a1368e2838b55385af460f
d57ecdb1b1b63078608ce4aadcdb8c8f4e1a3a05e9bce86feff28ce2cae4196c
fb466eee9c8e8dad2f3db302292209c7ea7ff928ebb6855d132ca748182259df

desertsunlandscape.com Open in urlscan Pro 50.28.103.82 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

11 Requests

9 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

111 kBTransfer

122 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

desertsunlandscape.com Open in urlscan Pro
50.28.103.82 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

9 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

111 kB
Transfer

122 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!