clickmetertracking.com Open in urlscan Pro
54.243.97.116 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://clickmetertracking.com/bk3p
Submission: On December 16 via api (December 16th 2021, 8:17:19 pm UTC) from US — Scanned from DE

Summary HTTP 26 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 26 HTTP transactions. The main IP is 54.243.97.116, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is clickmetertracking.com.
TLS certificate: Issued by Amazon on May 30th 2021. Valid for: a year.

This is the only time clickmetertracking.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
2	54.243.97.116 54.243.97.116		14618 (AMAZON-AES) (AMAZON-AES)
2	143.204.101.75 143.204.101.75		16509 (AMAZON-02) (AMAZON-02)
21	198.252.102.191 198.252.102.191		20068 (HAWKHOST) (HAWKHOST)
26	4

2 54.243.97.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-243-97-116.compute-1.amazonaws.com

clickmetertracking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.101.75 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-101-75.fra50.r.cloudfront.net

d19nyn3hrzs6lg.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 198.252.102.191 (Little Washington, United States)

ASN20068 (HAWKHOST, CA)
PTR: 198.252.102.191-static.reverse.arandomserver.com

dominategmbnow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	dominategmbnow.com dominategmbnow.com	170 KB
2	cloudfront.net d19nyn3hrzs6lg.cloudfront.net	16 KB
2	clickmetertracking.com clickmetertracking.com	4 KB
0	cloudflare.com Failed cdnjs.cloudflare.com Failed
26	4

	Domain	Requested by
21	dominategmbnow.com	clickmetertracking.com dominategmbnow.com
2	d19nyn3hrzs6lg.cloudfront.net	clickmetertracking.com
2	clickmetertracking.com	clickmetertracking.com
0	cdnjs.cloudflare.com Failed	dominategmbnow.com
26	4

This site contains no links.

Subject Issuer	Validity	Valid
9nl.com Amazon	`2021-05-30` - `2022-06-28`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
dominategmbnow.com R3	`2021-12-03` - `2022-03-03`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://clickmetertracking.com/bk3p
Frame ID: 1F21C700FF5779EBBC9B1345FA4C1085
Requests: 4 HTTP requests in this frame

Frame: https://dominategmbnow.com/purpose/msfauth.php?office=logged
Frame ID: E47C4BBCDDDC7B887DD9C0AE967BF798
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PennyMac Loan Services - National Home Mortgage Lender

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

moment(?:\.min)?\.js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

26
Requests

96 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

189 kB
Transfer

847 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request bk3p Show response clickmetertracking.com/	1 KB 2 KB	403ms 99ms	Document text/html	54.243.97.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://clickmetertracking.com/bk3p Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.243.97.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-243-97-116.compute-1.amazonaws.com Software / Resource Hash `ce49a50ea096c99928ac65f00910f21a0718b2ee287d77a9649bb963286288f7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Content-Type text/html; charset=utf-8 Date Thu, 16 Dec 2021 20:17:14 GMT Engine clickmeter.redirect, version 2.0 X-Rate-Limit-Limit 20s X-Rate-Limit-Remaining 299 X-Rate-Limit-Reset 2021-12-16T20:17:34.8837700Z Content-Length 1510 Connection keep-alive
GET H2	200	nprogress.css d19nyn3hrzs6lg.cloudfront.net/redirect-cm/v1/content/styles/	1 KB 2 KB	42ms 10ms	Stylesheet text/css	143.204.101.75 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d19nyn3hrzs6lg.cloudfront.net/redirect-cm/v1/content/styles/nprogress.css Requested by Host: clickmetertracking.com URL: https://clickmetertracking.com/bk3p Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.101.75 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-101-75.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `3abb974f9f5abf3d4dd05851811cc2b6c88605ae6cd1cb4662751159f2611c80` Request headers Accept-Language de-DE,de;q=0.9 Referer https://clickmetertracking.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 07:55:16 GMT via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) last-modified Tue, 09 Aug 2016 14:27:00 GMT server AmazonS3 age 44519 etag "b860fa714a808e442b01396841a89622" x-cache Hit from cloudfront content-type text/css x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 1531 x-amz-cf-id v6xEfxKRDJT3PldUgEGJI4vuD4WDBbgGK1I-4iatrmPITUeX2EfHdg==
GET H2	200	nprogress.js Show response d19nyn3hrzs6lg.cloudfront.net/redirect-cm/v1/content/scripts/	14 KB 14 KB	45ms 14ms	Script application/x-javascript	143.204.101.75 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d19nyn3hrzs6lg.cloudfront.net/redirect-cm/v1/content/scripts/nprogress.js Requested by Host: clickmetertracking.com URL: https://clickmetertracking.com/bk3p Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.101.75 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-101-75.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `72c2a50f7a1bd6d3c3c79dae35dfebe49a993a10eeab04202e29654c92f66bdc` Request headers Accept-Language de-DE,de;q=0.9 Referer https://clickmetertracking.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 05:00:35 GMT via 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront) last-modified Tue, 09 Aug 2016 14:26:59 GMT server AmazonS3 age 55000 etag "becc90ab00d3bb994ff072c30c4735c0" x-cache Hit from cloudfront content-type application/x-javascript x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 14234 x-amz-cf-id g8fmISKDUjmNEugblguvEaPLlvPVEHf99vzk1JQvdDjkG3LJEdbhag==
GET H/1.1	200 OK	nprogress.css clickmetertracking.com/lib/nprogress/	1 KB 2 KB	98ms 98ms	Stylesheet text/css	54.243.97.116 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://clickmetertracking.com/lib/nprogress/nprogress.css Requested by Host: clickmetertracking.com URL: https://clickmetertracking.com/bk3p Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.243.97.116 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-243-97-116.compute-1.amazonaws.com Software / Resource Hash `4a39ac43a1612a5a1e3ff1cafaebefa77f314ec9bbd2d51f719a278f419c894a` Request headers Accept-Language de-DE,de;q=0.9 Referer https://clickmetertracking.com/bk3p User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Thu, 16 Dec 2021 20:17:14 GMT X-Rate-Limit-Limit 20s Last-Modified Mon, 15 Aug 2016 20:42:58 GMT X-Rate-Limit-Remaining 299 ETag "1d1f7359b3930fc" Content-Type text/css X-Rate-Limit-Reset 2021-12-16T20:17:35.0466210Z Connection keep-alive Accept-Ranges bytes Content-Length 1532
GET H2	200	msfauth.php Show response dominategmbnow.com/purpose/ Frame E47C	5 KB 1 KB	414ms 133ms	Document text/html	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/msfauth.php?office=logged Requested by Host: clickmetertracking.com URL: https://clickmetertracking.com/bk3p Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / PHP/7.4.26 Resource Hash `a8f969c97ef1b7ba88d11dd96582d591c4a9aab7183c800b0459d453a4b02b71` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://clickmetertracking.com/ Response headers x-powered-by PHP/7.4.26 content-type text/html; charset=UTF-8 content-length 864 content-encoding br vary Accept-Encoding date Thu, 16 Dec 2021 20:17:15 GMT server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
GET		font-awesome.min.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ Frame E47C	0 0

GET H2	200	bootstrap.min.css dominategmbnow.com/purpose/vendor/bootstrap/css/ Frame E47C	122 KB 17 KB	257ms 255ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/bootstrap/css/bootstrap.min.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `9bf87f7140c085febf881462c536ee73cf9183670811342d3dc1fd0f7a762a0d` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Thu, 10 Aug 2017 21:52:12 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 16859 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	font-awesome.min.css dominategmbnow.com/purpose/fonts/font-awesome-4.7.0/css/ Frame E47C	30 KB 7 KB	258ms 257ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/fonts/font-awesome-4.7.0/css/font-awesome.min.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Tue, 23 May 2017 17:43:54 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 6658 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	material-design-iconic-font.min.css dominategmbnow.com/purpose/fonts/iconic/css/ Frame E47C	69 KB 7 KB	259ms 257ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/fonts/iconic/css/material-design-iconic-font.min.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Sun, 08 Nov 2015 11:50:30 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 6912 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	animate.css dominategmbnow.com/purpose/vendor/animate/ Frame E47C	23 KB 3 KB	259ms 258ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/animate/animate.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `80aa5497ff31b2c001474d9432f0853c11d200a67ea4f9852ab2f7ee2fedd9c2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Thu, 31 Aug 2017 13:02:26 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 2770 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	hamburgers.min.css dominategmbnow.com/purpose/vendor/css-hamburgers/ Frame E47C	19 KB 2 KB	381ms 379ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/css-hamburgers/hamburgers.min.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `3149a74d701ee7dd476f83694f8962062a456b5abbdea234101d30aff2738bcd` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Wed, 16 Aug 2017 22:45:52 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1930 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	animsition.min.css dominategmbnow.com/purpose/vendor/animsition/css/ Frame E47C	27 KB 2 KB	381ms 380ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/animsition/css/animsition.min.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `14020e649186932b88a7f815ad52ff939db3e2ba4228cad195831d1825acb54a` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Sat, 12 Aug 2017 09:56:10 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 2063 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	select2.min.css dominategmbnow.com/purpose/vendor/select2/ Frame E47C	15 KB 2 KB	381ms 380ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/select2/select2.min.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `c493991dfa712d1fee861d41c18152e5f8663807484506a23ae97917f6fbbf7b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Wed, 23 Aug 2017 21:52:38 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1790 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	daterangepicker.css dominategmbnow.com/purpose/vendor/daterangepicker/ Frame E47C	8 KB 1 KB	381ms 380ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/daterangepicker/daterangepicker.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `9e4450a60b4d6d5b4a8304ade07576767dc3f64f7653b0f95bce43bf11d854b2` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Tue, 08 Aug 2017 22:09:34 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1461 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	util.css dominategmbnow.com/purpose/css/ Frame E47C	85 KB 6 KB	381ms 381ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/css/util.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `27751cc48fb8c009d013ffb85f0f2b1db36530791eca74d317aec90d34f09b39` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Wed, 13 Dec 2017 15:44:00 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 6199 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	main.css dominategmbnow.com/purpose/css/ Frame E47C	10 KB 2 KB	382ms 381ms	Stylesheet text/css	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/css/main.css Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `40f364c472edf31d36603e2e7e2d596ef4d2b448f7bb2e32d801717c13207b9e` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Thu, 27 May 2021 11:53:08 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1753 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	ms.png dominategmbnow.com/purpose/js/ Frame E47C	13 KB 13 KB	509ms 509ms	Image image/png	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Show image Full URL https://dominategmbnow.com/purpose/js/ms.png Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `7f9833bef86862b5e24f291eaccfe803e7a9a515e4932e26dc644f4cc37e5af4` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT last-modified Wed, 19 May 2021 23:46:30 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 13653 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	jquery-3.2.1.min.js Show response dominategmbnow.com/purpose/vendor/jquery/ Frame E47C	85 KB 29 KB	382ms 381ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/jquery/jquery-3.2.1.min.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Fri, 28 Jul 2017 12:24:16 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 29485 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	animsition.min.js Show response dominategmbnow.com/purpose/vendor/animsition/js/ Frame E47C	5 KB 2 KB	385ms 383ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/animsition/js/animsition.min.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `f32da6bf81134c664b32582076b8260b3b614d508d5c651d0907b581df2a9323` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Sat, 12 Aug 2017 09:56:10 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 1818 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	popper.js Show response dominategmbnow.com/purpose/vendor/bootstrap/js/ Frame E47C	80 KB 20 KB	385ms 384ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/bootstrap/js/popper.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `a93f37c5c32d030a1d831b5023b6b29bc93290f5423debaf47c83b6444528059` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Wed, 27 Sep 2017 18:59:16 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 20358 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	bootstrap.min.js Show response dominategmbnow.com/purpose/vendor/bootstrap/js/ Frame E47C	50 KB 12 KB	386ms 385ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/bootstrap/js/bootstrap.min.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `0e25895d7caaf355a53d19c37c69a06198f668e5422b211d27597ed93983b80b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Thu, 10 Aug 2017 21:51:22 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 12421 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	select2.min.js Show response dominategmbnow.com/purpose/vendor/select2/ Frame E47C	65 KB 17 KB	386ms 385ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/select2/select2.min.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `fa659dfc6ebd4b8aad80fa304842c879502fefe16e2fcef55976a89605e7af04` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Wed, 23 Aug 2017 21:52:52 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 17604 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	moment.min.js Show response dominategmbnow.com/purpose/vendor/daterangepicker/ Frame E47C	46 KB 15 KB	503ms 502ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/daterangepicker/moment.min.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `4e411c99fe4a486db34e801a53392ae86f8659eccc438944b5a062c9aaba25be` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Tue, 08 Aug 2017 22:09:34 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 14971 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	daterangepicker.js Show response dominategmbnow.com/purpose/vendor/daterangepicker/ Frame E47C	68 KB 11 KB	503ms 503ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/daterangepicker/daterangepicker.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `2c3836208d9d0a3f9dab8ef05dda493c6e98c175155e7e7abba3575207ad0244` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Thu, 24 Aug 2017 14:30:14 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 11607 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	countdowntime.js Show response dominategmbnow.com/purpose/vendor/countdowntime/ Frame E47C	1 KB 486 B	504ms 503ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/vendor/countdowntime/countdowntime.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `4cff184248850f8767575963eb504ee95bbfabff946cdbfb4271474442b80ecd` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Thu, 09 Nov 2017 15:34:12 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 430 expires Thu, 23 Dec 2021 20:17:15 GMT
GET H2	200	main.js Show response dominategmbnow.com/purpose/js/ Frame E47C	2 KB 684 B	504ms 504ms	Script application/javascript	198.252.102.191 HAWKHOST
General Check archive.org Show headers Download Go to Full URL https://dominategmbnow.com/purpose/js/main.js Requested by Host: dominategmbnow.com URL: https://dominategmbnow.com/purpose/msfauth.php?office=logged Protocol H2 Security TLS 1.3, , AES_128_GCM Server 198.252.102.191 Little Washington, United States, ASN20068 (HAWKHOST, CA), Reverse DNS 198.252.102.191-static.reverse.arandomserver.com Software LiteSpeed / Resource Hash `d418f1a383157e6d013cc08376bfad645f6b8a5a7e4310798ec0a5c8b389eccb` Request headers Accept-Language de-DE,de;q=0.9 Referer https://dominategmbnow.com/purpose/msfauth.php?office=logged User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 16 Dec 2021 20:17:15 GMT content-encoding br last-modified Wed, 20 Dec 2017 10:02:40 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 628 expires Thu, 23 Dec 2021 20:17:15 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| NProgress

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
clickmetertracking.com
d19nyn3hrzs6lg.cloudfront.net
dominategmbnow.com
cdnjs.cloudflare.com
143.204.101.75
198.252.102.191
54.243.97.116
0e25895d7caaf355a53d19c37c69a06198f668e5422b211d27597ed93983b80b
14020e649186932b88a7f815ad52ff939db3e2ba4228cad195831d1825acb54a
27751cc48fb8c009d013ffb85f0f2b1db36530791eca74d317aec90d34f09b39
2c3836208d9d0a3f9dab8ef05dda493c6e98c175155e7e7abba3575207ad0244
3149a74d701ee7dd476f83694f8962062a456b5abbdea234101d30aff2738bcd
3abb974f9f5abf3d4dd05851811cc2b6c88605ae6cd1cb4662751159f2611c80
40f364c472edf31d36603e2e7e2d596ef4d2b448f7bb2e32d801717c13207b9e
4a39ac43a1612a5a1e3ff1cafaebefa77f314ec9bbd2d51f719a278f419c894a
4cff184248850f8767575963eb504ee95bbfabff946cdbfb4271474442b80ecd
4e411c99fe4a486db34e801a53392ae86f8659eccc438944b5a062c9aaba25be
72c2a50f7a1bd6d3c3c79dae35dfebe49a993a10eeab04202e29654c92f66bdc
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f9833bef86862b5e24f291eaccfe803e7a9a515e4932e26dc644f4cc37e5af4
80aa5497ff31b2c001474d9432f0853c11d200a67ea4f9852ab2f7ee2fedd9c2
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9bf87f7140c085febf881462c536ee73cf9183670811342d3dc1fd0f7a762a0d
9e4450a60b4d6d5b4a8304ade07576767dc3f64f7653b0f95bce43bf11d854b2
a8f969c97ef1b7ba88d11dd96582d591c4a9aab7183c800b0459d453a4b02b71
a93f37c5c32d030a1d831b5023b6b29bc93290f5423debaf47c83b6444528059
c493991dfa712d1fee861d41c18152e5f8663807484506a23ae97917f6fbbf7b
ce49a50ea096c99928ac65f00910f21a0718b2ee287d77a9649bb963286288f7
d418f1a383157e6d013cc08376bfad645f6b8a5a7e4310798ec0a5c8b389eccb
dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56
f32da6bf81134c664b32582076b8260b3b614d508d5c651d0907b581df2a9323
fa659dfc6ebd4b8aad80fa304842c879502fefe16e2fcef55976a89605e7af04