![](/screenshots/e32ee7e8-0c70-4940-b630-a80d77bb7d74.png)
terrorismsum.gb.net
Open in
urlscan Pro
104.18.54.86
Malicious Activity!
Public Scan
Effective URL: https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13Inbox...
Submission: On June 14 via manual from GB
Summary
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on June 5th 2018. Valid for: 6 months.
This is the only time terrorismsum.gb.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Office 365 (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 50.3.70.53 50.3.70.53 | 49532 (SERVERHUB-) (SERVERHUB-) | |
3 11 | 104.18.54.86 104.18.54.86 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 1 | 104.18.55.86 104.18.55.86 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 172.217.18.170 172.217.18.170 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 91.198.174.208 91.198.174.208 | 14907 (WIKIMEDIA) (WIKIMEDIA - Wikimedia Foundation Inc.) | |
4 | 172.217.21.195 172.217.21.195 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
14 | 4 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
terrorismsum.gb.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
terrorismsum.gb.net |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s29-in-f10.1e100.net
fonts.googleapis.com |
ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US)
PTR: upload-lb.esams.wikimedia.org
upload.wikimedia.org |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s12-in-f195.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
gb.net
4 redirects
terrorismsum.gb.net |
212 KB |
4 |
gstatic.com
fonts.gstatic.com |
113 KB |
1 |
wikimedia.org
upload.wikimedia.org |
25 KB |
1 |
googleapis.com
fonts.googleapis.com |
450 B |
1 |
maisonduchien.ga
1 redirects
maisonduchien.ga |
254 B |
14 | 5 |
Domain | Requested by | |
---|---|---|
12 | terrorismsum.gb.net |
4 redirects
terrorismsum.gb.net
|
4 | fonts.gstatic.com |
terrorismsum.gb.net
|
1 | upload.wikimedia.org |
terrorismsum.gb.net
|
1 | fonts.googleapis.com |
terrorismsum.gb.net
|
1 | maisonduchien.ga | 1 redirects |
14 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni233499.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-06-05 - 2018-12-12 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email=
Frame ID: 63C54C034E34897F0C6FE4EC76AB524C
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/e32ee7e8-0c70-4940-b630-a80d77bb7d74.png)
Page URL History Show full URLs
-
http://maisonduchien.ga/pkl/
HTTP 301
https://terrorismsum.gb.net/nexa/ HTTP 302
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec HTTP 301
http://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/ HTTP 301
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/ HTTP 302
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw17... Page URL
Detected technologies
Detected patterns
- headers server /cloudflare/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://maisonduchien.ga/pkl/
HTTP 301
https://terrorismsum.gb.net/nexa/ HTTP 302
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec HTTP 301
http://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/ HTTP 301
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/ HTTP 302
https://terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/index2.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-email&email= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index2.php
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theDocs.all.min.css
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/css/ |
203 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.css
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/css/ |
2 KB 782 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
1 KB 450 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/img/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
word.png
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/img/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
Office_365_logo.png
upload.wikimedia.org/wikipedia/commons/7/74/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
theDocs.all.min.js
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/js/ |
222 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.js
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
S6uyw4BMUTPHjx4wWw.ttf
fonts.gstatic.com/s/lato/v14/ |
59 KB 29 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1Ptrg8zYS_SKggPNwIYqWqZPBQ.ttf
fonts.gstatic.com/s/raleway/v12/ |
54 KB 25 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1Ptug8zYS_SKggPNyC0ISg.ttf
fonts.gstatic.com/s/raleway/v12/ |
52 KB 25 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont5b62.html
terrorismsum.gb.net/nexa/9fb3ce22847429dba639bc77b3838cec/assets/fonts/ |
70 KB 70 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
S6u9w4BMUTPHh7USSwiPHA.ttf
fonts.gstatic.com/s/lato/v14/ |
62 KB 33 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Office 365 (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _self object| Prism object| httpLanguages object| options string| contentType function| $ function| jQuery function| lity function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.terrorismsum.gb.net/ | Name: __cfduid Value: d0ad8ce6f687ca01c3e73696a9e7866991528973339 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
maisonduchien.ga
terrorismsum.gb.net
upload.wikimedia.org
104.18.54.86
104.18.55.86
172.217.18.170
172.217.21.195
50.3.70.53
91.198.174.208
29ec7032bb825dd2ca18a8b223d81f5a1cafc3076c98c2d754c467817a753e06
2cbcd235e7bd37011920b82ef900a4c2e87a048faa7345a1af59c1f28bce7188
2cc68b94666feb1fdd89122bf25fe10b0089cd51abbeec09913026d20f085dd5
3ae10ed925ca3203f6f4907da618fa90061d565b0b38af565b2fc5396477361a
4977f8d8f865c43ee26dc31409cd4fe8945048d5800719133d79ab053527d859
679290044ff37088379121c3590f0c580a94c679f97064d6e1739ab2b56ffda5
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8178c795d51417ec3e73ea0be8fcd1d051cfbf684b83e782d7b05644762b968f
8ae79a4d18eea420af0fd562d43879b569bbd2c622da6deba79f6c202e385361
9c4590446dbf83edae05be4ca28ef789ee50a01ef2cb8f1b51c5937d029cac76
a04d617e96e95a2fc781b68205e1c8ee0f99e07a6e3507653341b4a4d2ea0cae
c9242c9e38a8f38f4a58d73b3fbeeee4737b123bfe0ec8bfc554b340e2310c52
e0c9499972b4a1810e3a7b0c2ddbdbb4ede59b9a0666459c6570ada53322a004
f81e12f67f4c6f10ed89f3be4a9f7f4685c1e746cae88373f1e5f823980601fb