dtwqs.com
Open in
urlscan Pro
66.235.200.6
Malicious Activity!
Public Scan
Effective URL: https://dtwqs.com/
Submission: On December 01 via manual from MY — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 20th 2022. Valid for: a year.
This is the only time dtwqs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 13 | 66.235.200.6 66.235.200.6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:2800:133... 2606:2800:133:f17:19e8:2356:251b:2a9 | 15133 (EDGECAST) (EDGECAST) | |
3 | 35.190.14.35 35.190.14.35 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:830::2010 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:6b19 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 13.92.180.208 13.92.180.208 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 52.239.140.10 52.239.140.10 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 52.239.142.132 52.239.142.132 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
27 | 9 |
ASN15133 (EDGECAST, US)
149b4.wpc.azureedge.net |
ASN15169 (GOOGLE, US)
PTR: 35.14.190.35.bc.googleusercontent.com
components.mywebsitebuilder.com |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
in-us-east-event-hubs.servicebus.windows.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
wzuk.blob.core.windows.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
webzaitest.blob.core.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
dtwqs.com
1 redirects
dtwqs.com |
475 KB |
7 |
windows.net
in-us-east-event-hubs.servicebus.windows.net — Cisco Umbrella Rank: 87824 wzuk.blob.core.windows.net — Cisco Umbrella Rank: 117161 webzaitest.blob.core.windows.net — Cisco Umbrella Rank: 138392 |
449 KB |
3 |
googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 383 |
518 KB |
3 |
mywebsitebuilder.com
components.mywebsitebuilder.com — Cisco Umbrella Rank: 77737 |
555 KB |
1 |
sitebuilder.com
localize.sitebuilder.com — Cisco Umbrella Rank: 322833 |
389 B |
1 |
azureedge.net
149b4.wpc.azureedge.net — Cisco Umbrella Rank: 118722 |
8 KB |
27 | 6 |
Domain | Requested by | |
---|---|---|
13 | dtwqs.com |
1 redirects
dtwqs.com
|
4 | in-us-east-event-hubs.servicebus.windows.net |
149b4.wpc.azureedge.net
|
3 | storage.googleapis.com |
dtwqs.com
|
3 | components.mywebsitebuilder.com |
dtwqs.com
components.mywebsitebuilder.com |
2 | wzuk.blob.core.windows.net |
dtwqs.com
|
1 | webzaitest.blob.core.windows.net |
components.mywebsitebuilder.com
|
1 | localize.sitebuilder.com |
149b4.wpc.azureedge.net
|
1 | 149b4.wpc.azureedge.net |
dtwqs.com
|
27 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.facebook.com |
www.twitter.com |
www.linkedin.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
dtwqs.com Cloudflare Inc ECC CA-3 |
2022-09-20 - 2023-09-19 |
a year | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2022-07-11 - 2023-07-11 |
a year | crt.sh |
*.mywebsitebuilder.com Sectigo RSA Domain Validation Secure Server CA |
2022-10-23 - 2023-11-23 |
a year | crt.sh |
storage.googleapis.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-08 - 2023-06-08 |
a year | crt.sh |
servicebus.windows.net Microsoft Azure TLS Issuing CA 01 |
2022-10-16 - 2023-10-11 |
a year | crt.sh |
*.blob.core.windows.net Microsoft RSA TLS CA 02 |
2022-09-25 - 2023-09-25 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://dtwqs.com/
Frame ID: 438721563DADD75A5C42A2FF41F3441B
Requests: 25 HTTP requests in this frame
Frame:
https://components.mywebsitebuilder.com/sitebuilder/freebanner.html
Frame ID: C5976A1D757E9EF4C6EF7B0CA4DE1E44
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
HomePage URL History Show full URLs
-
http://dtwqs.com/
HTTP 301
https://dtwqs.com/ Page URL
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: î©…
Search URL Search Domain Scan URL
Title: 
Search URL Search Domain Scan URL
Title: 
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://dtwqs.com/
HTTP 301
https://dtwqs.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
dtwqs.com/ Redirect Chain
|
18 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t.js
149b4.wpc.azureedge.net/80149B4/insights/ |
16 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
viewer.css
components.mywebsitebuilder.com/g-202210071010199314/viewer-sitebuilder/ |
144 KB 22 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
viewer.js
components.mywebsitebuilder.com/g-202210071010199314/viewer/ |
2 MB 522 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2d916f892c67476dac01da70e2b4de80.js
storage.googleapis.com/te-sitebuilder-sites/user-21947313/sites/50248649/0804f59c70f0436289e765b0b127185f/ |
22 KB 22 KB |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ec858b4fbc1e45a1a741a7f0ef94a732.js
storage.googleapis.com/te-sitebuilder-sites/user-21947313/sites/50248649/0804f59c70f0436289e765b0b127185f/ |
354 KB 354 KB |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
83b2262e4bc04bfe8b44b4839043a7b7.js
storage.googleapis.com/te-sitebuilder-sites/user-21947313/sites/50248649/0804f59c70f0436289e765b0b127185f/ |
142 KB 142 KB |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
localize.sitebuilder.com/ |
29 B 389 B |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
messages
in-us-east-event-hubs.servicebus.windows.net/in-us-east-event-hub-a1/publishers/080e9ed2-cfbd-48be-88a9-9b375609c57d/ |
0 304 B |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
messages
in-us-east-event-hubs.servicebus.windows.net/in-us-east-event-hub-a1/publishers/080e9ed2-cfbd-48be-88a9-9b375609c57d/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
freebanner.html
components.mywebsitebuilder.com/sitebuilder/ Frame C597 |
11 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
messages
in-us-east-event-hubs.servicebus.windows.net/in-us-east-event-hub-a1/publishers/080e9ed2-cfbd-48be-88a9-9b375609c57d/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
messages
in-us-east-event-hubs.servicebus.windows.net/in-us-east-event-hub-a1/publishers/080e9ed2-cfbd-48be-88a9-9b375609c57d/ |
0 304 B |
XHR
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
JYwDjrpa8U6xfI7FKlWegw.woff
wzuk.blob.core.windows.net/assets/fonts/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ALyKWGaVsEemWmMSYxY8yg.woff
wzuk.blob.core.windows.net/assets/fonts/ |
20 KB 21 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webzai-icons.woff
webzaitest.blob.core.windows.net/assets/icons/201610060849567328/ |
380 KB 380 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
46 KB 46 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
148 KB 149 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
68 KB 68 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
44 KB 44 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
59 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
dtwqs.com/x/cdn/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame C597 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online)43 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontentvisibilityautostatechange undefined| _gaq undefined| ga object| _fc function| getInsights object| require object| EventHubHistory object| AMInsights object| PageData object| Global object| SiteInformation object| Settings function| safeExecution undefined| $ undefined| jQuery undefined| TraceKit undefined| Raygun object| _wzErrorHandler object| html5 object| JSONPController object| WzPublicIcons function| $f function| Froogaloop function| onYouTubeIframeAPIReady function| onGoogleMapAPIReady object| jQuery111202752577421025131 object| VideoDataSourceEnum object| GalleryDataSourceEnum object| PhotosDataSourceEnum object| ReviewsEnum object| EventsDataSourceEnum object| MusicDataSourceEnum object| NewsDataSourceEnum object| _wz_ object| Viewer object| SiteStructure object| PagesStructures object| MasterPagesStructures object| SiteFilesMap object| DynamicPageContent object| DBSiteMetaData object| TemporaryImages2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
dtwqs.com/ | Name: app_ses_key Value: AF610BFE-FDF8-576C-4503-4F92737D6021/none |
|
dtwqs.com/ | Name: app_key Value: 3206ACD9-856A-3190-CB61-82C5229CE9B2/1669861352197 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
149b4.wpc.azureedge.net
components.mywebsitebuilder.com
dtwqs.com
in-us-east-event-hubs.servicebus.windows.net
localize.sitebuilder.com
storage.googleapis.com
webzaitest.blob.core.windows.net
wzuk.blob.core.windows.net
13.92.180.208
2606:2800:133:f17:19e8:2356:251b:2a9
2606:4700::6812:6b19
2a00:1450:4001:830::2010
35.190.14.35
52.239.140.10
52.239.142.132
66.235.200.6
01ab90d4b21eeb86a3c1f36232f817db9a3943ba1c7ceafa525838cc0e1927d2
0ec7efeff41765a3047cd11994c678e1dfc04b38d6ddfbde623cb06a903f5041
23ee4ea65db6fe9c920d6844298f9ac16152841c7813f02c5d8c7da29f49b60a
2579bf25ff2bc8ec6d3c4a2ca278319442013864c0a17bae00684acc71faa1a1
386c452c9e290397a1030703dc28722600805976a4d33d490486bdd474033cd3
47288c781b8e41928c3d3c6905a0695fb882daa2ca1bf8b7451b513dff922c26
4eedee31b77c6a4b9ac8f378dbb4d9809389a5d1d316f5c520f6c28e11bb4d72
5bf1d0b987968b781f81d0900742fc7195af92f184aaefe693c16d5976eb47b6
637b1abaa626f347a4215f443e0f5571925f226fd000d00c8744b6e994cbf398
6e67627ade0d8f3e1dd6596ad823ecedff08be44662ef81716f17e18947605f9
730a96009a2a61b32cf3ba4aefe964c33c226e813bfef721b81886e6dae805af
750994d782f6722b444d71b11edda92d4793c59d6133ff828b3e12e11dc2344b
7a3311085e8cf2c4ca90aeca436475a8ee8c68658bdaa34b3319649b4b671d1f
9b1fd0defff0db51a08a7ba9e87ebd97675c119e6001e396b94ba3923dc7c989
a32ef116c7b872daefb998a32a7bc6c1a2e05db2a78f3fd698b4283b3342a393
af4c34b5a675ea222217841d47840455b8c934db6b46df10638b16d21f52c419
b407b1eaf801528248b0865354fe7e95317ec215fe39bc1e05c43cb93c82ca0f
beaeee363dfe196d0e4a02e0b75ef53b377cab6cb4ce99289dc173f870658505
c2a0b120c2402e01a7435790733bd5cd2015e5eb9a63d157515b730fa83f2028
caf10d68e2c4e2ded1a93f1a6fe330a364882ade74f9e045284dc30e9e3ce358
dbc448fcf1639f1afb72ee42f8980a21171a54f5b2f0079eefe3dcff82725a9e
df7de1f609f36bc4f0b8c56c23ffd2dfaa78f3341e479b0a3a8a4c802f6acc80
e2df61837aa42b1565ba06ca18c0636953a395a0f176d12a5aea867e6bdf6413
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e51b7601fdeb11da54b0325f330996f146d42b29405411a906ff4483f90b2e58
fdbf4e4d37e772bdfa4710110ad52e98516b744dfb92f8117f2bd3ceb3ae598e