wangal.org Open in urlscan Pro
104.143.10.117 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1...
Submission: On August 17 via automatic, source openphish (August 17th 2017, 5:34:12 am UTC)

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 104.143.10.117, located in Las Vegas, United States and belongs to VERSAWEB-ASN - Versaweb, LLC, US. The main domain is wangal.org.

This is the only time wangal.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online) Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
9	104.143.10.117 104.143.10.117	36114 (VERSAWEB-ASN) (VERSAWEB-ASN - Versaweb)
2	2a02:26f0:122... 2a02:26f0:122:387::fb1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	2

9 104.143.10.117 (Las Vegas, United States)

ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US)

wangal.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:122:387::fb1 (European Union)

ASN20940 (AKAMAI-ASN1, US)

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	wangal.org wangal.org	581 KB
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	4 KB
11	2

	Domain	Requested by
9	wangal.org	wangal.org
2	secure.aadcdn.microsoftonline-p.com	wangal.org
11	2

This site contains links to these domains. Also see Links.

Domain
login.live.com

Subject Issuer	Validity	Valid
secure.aadcdn.microsoftonline-p.com Symantec Class 3 Secure Server CA - G4	`2016-09-01` - `2017-09-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 4071.1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

11
Requests

18 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

585 kB
Transfer

590 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://login.live.com/login.srf?wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=estsredirect%3d2%26estsrequest%3drQIIAdNiNtQztFIxgAAjXRCpa5CWZqibnApiIYEiIS6B3HmzC6TX33Dd03tIYPmJcN9VjEoZJSUFxVb6-vmlJTn5-dl6-Wlpmcmpxmamesn5ufr55Yn6OxgZLzAyrmIyNzM2M7I0N7AwNrC0MDUwMjYw1zNItLQ0S0xK1jUxNTPVNTGzNNJNMrFI0k22NDQ2TjExMU1KTLrFxO_vWFqSYQQi8osyq1I_MXGm5RflxhfkF5fMYmYF27KKmShfbGJmA7orNz_vFDNbfkFqXmbKBRbGVyw8BsxWHBxsAowSDAoMP1gYF7ECfctwfEPjS94mt91vln1ljdVnOMWqn17kHlWZ6aUd6m4YmOThHJpZ7hNslOKSpZ9WbmzmVelobpQdYGliEZXl62trbGU4gY1xAhvbLk4iQgkA0&id=&uaid=709b9e6daf1b45d8bc8dc210a7c8574d&pcexp=false&popupui=
Title: Sign in with a Microsoft account

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Sign-in.php Show response
wangal.org/wp-includes/js/office/ 29 KB
29 KB 732ms
197ms Document
text/html 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to

Full URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: ea66d01bcec187149de1e5e7ec80fe423819460484efc95150efd36bbcf963ec

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:33:57 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK login.css
wangal.org/wp-includes/js/office/files/ 21 KB
21 KB 162ms
162ms Stylesheet
text/css 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to

Full URL: http://wangal.org/wp-includes/js/office/files/login.css
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: b849c8da2fb4163b99fb3e45081f8622cba52359d9d68749aa0a6a1db7d7e97f

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:33:57 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:00 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 21886

GET
H/1.1 200
OK login_hover.css
wangal.org/wp-includes/js/office/files/ 89 B
89 B 305ms
154ms Stylesheet
text/css 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to

Full URL: http://wangal.org/wp-includes/js/office/files/login_hover.css
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:33:57 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:00 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 89

GET
H/1.1 200
OK jquery.js Show response
wangal.org/wp-includes/js/office/files/ 108 KB
108 KB 313ms
157ms Script
application/javascript 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to

Full URL: http://wangal.org/wp-includes/js/office/files/jquery.js
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36
Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin: http://wangal.org

Response headers

Date: Thu, 17 Aug 2017 05:33:57 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:00 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 110256

GET
H/1.1 200
OK aad.js Show response
wangal.org/wp-includes/js/office/files/ 174 KB
174 KB 313ms
157ms Script
application/javascript 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to

Full URL: http://wangal.org/wp-includes/js/office/files/aad.js
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 784272794b86d17613d2311fa54eab23d223252eebe139ce8113eaca26a03f86

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36
Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Origin: http://wangal.org

Response headers

Date: Thu, 17 Aug 2017 05:33:57 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:00 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 178334

GET
H/1.1 200
OK heroillustration.jpg
wangal.org/wp-includes/js/office/files/ 199 KB
199 KB 157ms
157ms Image
image/jpeg 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://wangal.org/wp-includes/js/office/files/heroillustration.jpg
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: 7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:33:58 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:00 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 203294

GET
H/1.1 200
OK bannerlogo.png
wangal.org/wp-includes/js/office/files/ 4 KB
4 KB 157ms
157ms Image
image/png 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://wangal.org/wp-includes/js/office/files/bannerlogo.png
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:33:58 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:02 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4585

GET
H/1.1 200
OK microsoft_logo.png
wangal.org/wp-includes/js/office/files/ 1 KB
1 KB 163ms
163ms Image
image/png 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://wangal.org/wp-includes/js/office/files/microsoft_logo.png
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:33:58 GMT
Last-Modified: Tue, 15 Aug 2017 02:16:00 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1057

GET
H/1.1 200
OK login_hover.min.css
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ 89 B
82 B 128ms
6ms Stylesheet
text/css 2a02:26f0:122:387::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/login_hover.min.css

Requested by

Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:122:387::fb1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:34:00 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Apr 2017 19:35:35 GMT
Content-MD5: k+LdzPr5J17LuCAOBMVTBQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=51272
Strict-Transport-Security: max-age=31536000
Content-Length: 82

GET
H/1.1 200
OK watson.min.js Show response
secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/ 10 KB
4 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:122:387::fb1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.aadcdn.microsoftonline-p.com/ests/2.1.5898.9/content/cdnbundles/watson.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:122:387::fb1 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

ca5896e71cda62c2be576048f73ca40094592f9fd2a62f7c2b4d8c94b03191e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36

Response headers

Date: Thu, 17 Aug 2017 05:34:00 GMT
Content-Encoding: gzip
Last-Modified: Thu, 27 Apr 2017 19:35:38 GMT
Content-MD5: lHRm5RF8WrsErKEDEGrsaQ==
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=458498
Strict-Transport-Security: max-age=31536000
Content-Length: 4155

POST
H/1.1 404
Not Found watson Show response
wangal.org/common/handlers/ 44 KB
45 KB 726ms
726ms XHR
text/html 104.143.10.117
Versaweb

General

Check archive.org

Show headers Download Go to

Full URL: http://wangal.org/common/handlers/watson
Requested by: Host: wangal.org
URL: http://wangal.org/wp-includes/js/office/files/jquery.js
Protocol: HTTP/1.1
Server: 104.143.10.117 Las Vegas, United States, ASN36114 (VERSAWEB-ASN - Versaweb, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: c30d787135a944e2e921e185df8a0be5f1fd25183d7db959af732f95e733a3ed

Request headers

Origin: http://wangal.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36
client-request-id: 709b9e6d-af1b-45d8-bc8d-c210a7c8574d
canary: AQABAAAAAABnfiG-mA6NTae7CdWW7QfdIvisIZTKrlzexJxUZIyvWU6djUDBmL2cFLnOuC0FTO2-fLXMPoP1cpVqzfcgl2ghAsWPsIETuS80xCJcWu9KyrCMf5xQh-47oH18j1hUUDGMNUvRya5Zn9aUb_tPoE4i5b6JDl8f3P7cgTNpurC8eqvVlhDHO9ivUwSH1SGO4d4_j_US6Ep6fIC5ALiLMFWRlpKOywI8grRLvHA3oTv0ACAA
Content-Type: application/json; charset=UTF-8
hpgid: 1002
Accept: application/json
Referer: http://wangal.org/wp-includes/js/office/Sign-in.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=YWx5c29uQGRlYWxtYWtlcnMubmV0&.rand=13InboxLight.aspx?n=1774256418&fid=4
X-Requested-With: XMLHttpRequest
hpgact: 1800

Response headers

Date: Thu, 17 Aug 2017 05:33:58 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <http://www.wangal.org/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=98
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online) Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wangal.org/wp-includes/js/office	1970-01-01 00:00:00	Name: testcookie Value: testcookie

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

secure.aadcdn.microsoftonline-p.com
wangal.org
104.143.10.117
2a02:26f0:122:387::fb1
080ff245615e719959bc5537e164ac4495c4b8036462dfee2076dd92f22c8491
784272794b86d17613d2311fa54eab23d223252eebe139ce8113eaca26a03f86
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
91c2b74542e11d0278e02715a980b39582eae2e3b519ddd2d4f9ca939e58109c
b849c8da2fb4163b99fb3e45081f8622cba52359d9d68749aa0a6a1db7d7e97f
c30d787135a944e2e921e185df8a0be5f1fd25183d7db959af732f95e733a3ed
ca5896e71cda62c2be576048f73ca40094592f9fd2a62f7c2b4d8c94b03191e3
ea66d01bcec187149de1e5e7ec80fe423819460484efc95150efd36bbcf963ec
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

wangal.org Open in urlscan Pro 104.143.10.117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

11 Requests

18 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

585 kBTransfer

590 kBSize

1 Cookies

1 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

wangal.org Open in urlscan Pro
104.143.10.117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

18 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

585 kB
Transfer

590 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!