acvillages.com.au
Open in
urlscan Pro
203.98.95.5
Malicious Activity!
Public Scan
Effective URL: http://acvillages.com.au/owaa/owa/index?id=b24cd05e85265520a42cae0d6ba5267ab24cd05e85265520a42cae0d6ba5267a&session=b24cd...
Submission: On April 05 via automatic, source openphish — Scanned from AU
Summary
This is the only time acvillages.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 203.98.95.5 203.98.95.5 | 55803 (HOSTOPIA-...) (HOSTOPIA-AU Hostopia Australia Web Pty Ltd) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 4 | 184.31.29.178 184.31.29.178 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
9 | 5 |
ASN55803 (HOSTOPIA-AU Hostopia Australia Web Pty Ltd, AU)
PTR: rs40-eqx3-syd.ha-node.net
acvillages.com.au |
ASN16625 (AKAMAI-AS, US)
PTR: a184-31-29-178.deploy.static.akamaitechnologies.com
c.s-microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
acvillages.com.au
1 redirects
acvillages.com.au |
75 KB |
4 |
s-microsoft.com
2 redirects
c.s-microsoft.com — Cisco Umbrella Rank: 6646 |
63 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 944 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2561 |
28 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
6 | acvillages.com.au |
1 redirects
acvillages.com.au
|
4 | c.s-microsoft.com |
2 redirects
acvillages.com.au
|
1 | stackpath.bootstrapcdn.com |
acvillages.com.au
|
1 | maxcdn.bootstrapcdn.com |
acvillages.com.au
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://acvillages.com.au/owaa/owa/index?id=b24cd05e85265520a42cae0d6ba5267ab24cd05e85265520a42cae0d6ba5267a&session=b24cd05e85265520a42cae0d6ba5267ab24cd05e85265520a42cae0d6ba5267a
Frame ID: 09256AEB0EDD03ABAC133C7F2ADBF1EC
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Signin Outlook WebApp SettingsPage URL History Show full URLs
-
http://acvillages.com.au/owaa/?o=2&ea=c@ahey@yslysso@
HTTP 302
http://acvillages.com.au/owaa/owa/index?id=b24cd05e85265520a42cae0d6ba5267ab24cd05e85265520a42cae0d6b... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://acvillages.com.au/owaa/?o=2&ea=c@ahey@yslysso@
HTTP 302
http://acvillages.com.au/owaa/owa/index?id=b24cd05e85265520a42cae0d6ba5267ab24cd05e85265520a42cae0d6ba5267a&session=b24cd05e85265520a42cae0d6ba5267ab24cd05e85265520a42cae0d6ba5267a Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- http://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2 HTTP 301
- https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
- http://c.s-microsoft.com/static/fonts/segoe-ui/west-european/semibold/latest.woff2 HTTP 301
- https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index
acvillages.com.au/owaa/owa/ Redirect Chain
|
25 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
acvillages.com.au/owaa/owa/js/ |
91 KB 37 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.payment.js
acvillages.com.au/owaa/owa/js/ |
17 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate2.js
acvillages.com.au/owaa/owa/js/ |
40 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
additional-methods.min.js
acvillages.com.au/owaa/owa/js/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ Redirect Chain
|
33 KB 34 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ Redirect Chain
|
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
acvillages.com.au/ | Name: PHPSESSID Value: 5c19376fe72385bb51fdffca357e8a35 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
acvillages.com.au
c.s-microsoft.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
104.18.10.207
104.18.11.207
184.31.29.178
203.98.95.5
190b90b1f62ad6798fca4c93adce6d0205c13b960b609af306f2d87b54885f85
28fc6b9f298e6380de7379b98779253e7604623f5de40d1358014baf7ee94768
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
5757b3e8ec8eb98f7182a998fc44b8410e96a2f4b90a51cd6f15e1e9df564a54
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
9cbefe574531f6e9e515c8ef88dc177b31acdd2f877e0d620f322c4d26ac94f2
ba6eda7945ab8d7e57b34cc5a3dd292fa2e4c60a5ced79236ecf1a9e0f0c2d32
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c