gwenet.org Open in urlscan Pro
66.175.58.9  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 0ffice365.php Show response gwenet.org/oneee/	2 KB 1 KB	435ms 290ms	Document text/html	66.175.58.9 INFB2-AS
General Check archive.org Show headers Download Go to Full URL http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Protocol HTTP/1.1 Server 66.175.58.9 , United States, ASN30447 (INFB2-AS, US), Reverse DNS hostedc38.carrierzone.com Software / Resource Hash 3a9a616b2f069b5b7f028b360ecc555041e4540d43cb586c6115e67b5d8a37d5 Request headers Host gwenet.org Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 05 Jun 2021 10:12:41 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary X-Forwarded-Host Content-Encoding gzip
GET H/1.1	200 OK	eciffo365body.png gwenet.org/oneee/signin_files/	17 KB 18 KB	142ms 141ms	Image image/png	66.175.58.9 INFB2-AS
General Check archive.org Show headers Download Go to Show image Full URL http://gwenet.org/oneee/signin_files/eciffo365body.png Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Protocol HTTP/1.1 Server 66.175.58.9 , United States, ASN30447 (INFB2-AS, US), Reverse DNS hostedc38.carrierzone.com Software / Resource Hash 3a015de4750b7b43fe1b0f4e3798bffb689e4834f0788ae9e81e397d40b1f394 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host gwenet.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Connection keep-alive Cache-Control no-cache Referer http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 05 Jun 2021 10:12:42 GMT Last-Modified Fri, 04 May 2018 01:26:20 GMT ETag "4515-56b57350e2700" Vary X-Forwarded-Host Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 17685
GET H/1.1	200 OK	count.js Show response count.carrierzone.com/app/count_server/	35 KB 35 KB	734ms 129ms	Script text/javascript	66.175.41.113 INFB2-AS
General Check archive.org Show headers Download Go to Full URL https://count.carrierzone.com/app/count_server/count.js Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 66.175.41.113 , United States, ASN30447 (INFB2-AS, US), Reverse DNS wiredminds.carrierzone.com Software Apache/2.2.15 (CentOS) / Resource Hash f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e Request headers Referer http://gwenet.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 05 Jun 2021 10:12:42 GMT Last-Modified Fri, 08 Jun 2012 10:17:02 GMT Server Apache/2.2.15 (CentOS) Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 36029
GET H/1.1	200 OK	subomi.png gwenet.org/oneee/signin_files/	643 B 888 B	259ms 248ms	Image image/png	66.175.58.9 INFB2-AS
General Check archive.org Show headers Download Go to Show image Full URL http://gwenet.org/oneee/signin_files/subomi.png Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Protocol HTTP/1.1 Server 66.175.58.9 , United States, ASN30447 (INFB2-AS, US), Reverse DNS hostedc38.carrierzone.com Software / Resource Hash 9d4cb3339de1260a949342d669c5d6506c2bd7d02a60f04920c2f409e4a12e7d Request headers Pragma no-cache Accept-Encoding gzip, deflate Host gwenet.org Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Connection keep-alive Cache-Control no-cache Referer http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 05 Jun 2021 10:12:42 GMT Last-Modified Fri, 04 May 2018 01:26:20 GMT ETag "283-56b57350e2700" Vary X-Forwarded-Host Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 643
GET H/1.1	200 OK	ctin.php count.carrierzone.com/track/	42 B 610 B	288ms 277ms	Image image/gif	66.175.41.113 INFB2-AS
General Check archive.org Show headers Download Go to Show image Full URL http://count.carrierzone.com/track/ctin.php?t=1622887963013&custnum=88d8c7091eaea901&sname=gwenet.org&pagename=0ffice365.php&group=%2Fservices%2Fwebpages%2Fg%2Fw%2Fgwenet.org%2Fpublic%2Foneee&version=%24Rev%3A%207840%20%24&js=1&jv=0&resolution=1600x1200&color_depth=24&campaign=&referrer=&page_url=http%253A%252F%252Fgwenet.org%252Foneee%252F0ffice365.php%253Fl%253D_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418%2526amp%253Bfid.123InboxLight.aspxn.1774256418%2526amp%253Bfid.1252899645289964213InboxLight_Product-userid%2526amp%253Buse&plugins= Requested by Host: gwenet.org URL: http://gwenet.org/oneee/0ffice365.php?l=_JeHFUq_VJOXK0QWHtoGYDw177425fgfdfgrtui6418&fid.123InboxLight.aspxn.1774256418&fid.1252899645289964213InboxLight_Product-userid&use Protocol HTTP/1.1 Server 66.175.41.113 , United States, ASN30447 (INFB2-AS, US), Reverse DNS wiredminds.carrierzone.com Software Apache/2.2.15 (CentOS) / PHP/5.2.17 Resource Hash 5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947 Request headers Referer http://gwenet.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Sat, 05 Jun 2021 10:12:41 GMT Last-Modified Sat, 05 Jun 2021 10:12:41 GMT Server Apache/2.2.15 (CentOS) X-Powered-By PHP/5.2.17 P3P CP="NOI NID ADMa OUR IND UNI COM NAV" Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Type image/gif Keep-Alive timeout=10, max=100 Content-Length 42 Expires Thu, 01 Jan 1970 01:23:45 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| click_track function| getClick object| wm_indiv_stats object| wiredminds string| wm_custnum string| wm_page_name string| wm_group_name string| wm_campaign_key string| wm_track_alt

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

count.carrierzone.com
gwenet.org
66.175.41.113
66.175.58.9
3a015de4750b7b43fe1b0f4e3798bffb689e4834f0788ae9e81e397d40b1f394
3a9a616b2f069b5b7f028b360ecc555041e4540d43cb586c6115e67b5d8a37d5
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947
9d4cb3339de1260a949342d669c5d6506c2bd7d02a60f04920c2f409e4a12e7d
f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e