squarestoreaddress.com

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 162.241.85.194, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is squarestoreaddress.com.
TLS certificate: Issued by R3 on November 15th 2021. Valid for: 3 months.

This is the only time squarestoreaddress.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Squarespace (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:215... 2600:9000:2156:de00:15:1199:2d80:93a1	16509 (AMAZON-02) (AMAZON-02)
2 7	162.241.85.194 162.241.85.194	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
5	1

1 2600:9000:2156:de00:15:1199:2d80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

trk.klclick2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 162.241.85.194 (United States) 2 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-85-194.unifiedlayer.com

squarestoreaddress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	squarestoreaddress.com 2 redirects squarestoreaddress.com	141 KB
1	klclick2.com 1 redirects trk.klclick2.com	327 B
5	2

	Domain	Requested by
7	squarestoreaddress.com	2 redirects squarestoreaddress.com
1	trk.klclick2.com	1 redirects
5	2

This site contains links to these domains. Also see Links.

Domain
squareup.com

Subject Issuer	Validity	Valid
squarestoreaddress.com R3	`2021-11-15` - `2022-02-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1
Frame ID: CB099BC731677FFB1EEAC448CDEACB6A
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

https://trk.klclick2.com/ls/click?upn=SiuO0LZu69IQMfhoQovgox8VS9ZEyA3e91d8msZOq1S-2BNGoLUqW1k-2B0Vozn... HTTP 302
https://squarestoreaddress.com/?_kx=S6R98EYFg4IMFxT2o5u60ljgyx7cZNMDGk1gHda2YrY%3D.WqJyL5 HTTP 302
https://squarestoreaddress.com/login?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13... HTTP 301
https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca1... Page URL

Page Statistics

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

141 kB
Transfer

231 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://squareup.com/signup?lang_code=en-US
Title: Sign up

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/article/5245-square-dashboard-troubleshooting#Enable-Cookies
Title: Learn how to enable cookies >

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/article/3798-square-s-information-collection-policies
Title: Learn more about Square's Information Collection Policies >

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/article/5593-2-step-verification
Title: Learn More >

Search URL Search Domain Scan URL

URL: https://squareup.com/help/us/en/contact?panel=36405A439AFD
Title: I don't remember my email address

Search URL Search Domain Scan URL

URL: https://squareup.com/help/article/6212
Title: Learn More >

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trk.klclick2.com/ls/click?upn=SiuO0LZu69IQMfhoQovgox8VS9ZEyA3e91d8msZOq1S-2BNGoLUqW1k-2B0Vozn9QoSG21e02DcB8hgMjWtj7Q1eIrawZDZFdawl5IMMiXScCN55CtHB0yQxagonZZGsbxvI-2Fu5fDP-2F6cUarZpyNQQUe-2Fg-3D-3DOkE5_WZKfuClp4lezFLEDJlHQCMzXX7w8MRaTiea4tk6mcbk5UuVQ5IXnuhbkMuxM4MexAxtZCXu812kkddGocCcwfvE6Y0JR8mXP4UtaGUqri7ApdqbBk6esCJEvqwF5ZRdM-2BwY9vS8Ifs19Nc4hovqizyzWGH-2B47EfZ61qELecqPBrLD-2FGr21QPyDIkXCllggugIhFfz1e73fWlq-2BoPnBabTBUe83jVgs-2BxxIgxsbDJzBW0MCXrGR0Q9D-2FPEWGwgrVCKDHVb-2F1CqU0TkbjXUPYWRVbC8pvysAG2iocayN4n9tqCrXytClpbWQE-2FjJR-2FTqB1Rq2jrKZAqBaJ2-2BBLhtj7Qqe1WyxFw-2By9YT-2FjoIKJy0CRflZwYrnI-2FxqPw5GKlIbwROjM7omxItGzTydj6NWfwQ-3D-3D HTTP 302
https://squarestoreaddress.com/?_kx=S6R98EYFg4IMFxT2o5u60ljgyx7cZNMDGk1gHda2YrY%3D.WqJyL5 HTTP 302
https://squarestoreaddress.com/login?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1 HTTP 301
https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response squarestoreaddress.com/login/ Redirect Chain https://trk.klclick2.com/ls/click?upn=SiuO0LZu69IQMfhoQovgox8VS9ZEyA3e91d8msZOq1S-2BNGoLUqW1k-2B0Vozn9QoSG21e02DcB8hgMjWtj7Q1eIrawZDZFdawl5IMMiXScCN55CtHB0yQxagonZZGsbxvI-2Fu5fDP-2F6cUarZpyNQQUe-2F... https://squarestoreaddress.com/?_kx=S6R98EYFg4IMFxT2o5u60ljgyx7cZNMDGk1gHda2YrY%3D.WqJyL5 https://squarestoreaddress.com/login?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa... https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7ea...	54 KB 16 KB	376ms 376ms	Document text/html	162.241.85.194 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.194 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-194.unifiedlayer.com Software Apache / Resource Hash `8023f47261655f47732bfc1bc44ffa65943709415ecfc7b085b3710b328f3452` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers vary Accept-Encoding content-encoding gzip accept-ranges none content-length 16622 content-type text/html; charset=UTF-8 date Mon, 15 Nov 2021 14:12:17 GMT server Apache Redirect headers location https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1 content-length 428 content-type text/html; charset=iso-8859-1 date Mon, 15 Nov 2021 14:12:17 GMT server Apache
GET H2	200	login.css squarestoreaddress.com/login/	71 KB 17 KB	165ms 165ms	Stylesheet text/css	162.241.85.194 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://squarestoreaddress.com/login/login.css Requested by Host: squarestoreaddress.com URL: https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.194 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-194.unifiedlayer.com Software Apache / Resource Hash `1a8f78dcae935b7b42150f3ac41ff507cb58c476a5addf6369caef69fffb930b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://squarestoreaddress.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 15 Nov 2021 14:12:17 GMT content-encoding gzip last-modified Wed, 25 Nov 2020 01:21:36 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges none content-length 17719
GET H2	200	info_gray.svg squarestoreaddress.com/login/	562 B 632 B	155ms 154ms	Image image/svg+xml	162.241.85.194 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://squarestoreaddress.com/login/info_gray.svg Requested by Host: squarestoreaddress.com URL: https://squarestoreaddress.com/login/?cmd=www.squareup.com-auth0_submit&id=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1&session=3f78de8185f18b7eaa56c2d50890eca13f78de8185f18b7eaa56c2d50890eca1 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.194 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-194.unifiedlayer.com Software Apache / Resource Hash `50a7da9ad8921fa90ab51b3c906eb9fa0efbd49345cd216b3678c1b156458175` Request headers Accept-Language de-DE,de;q=0.9 Referer https://squarestoreaddress.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 15 Nov 2021 14:12:17 GMT last-modified Wed, 25 Nov 2020 01:21:38 GMT server Apache accept-ranges bytes content-length 562 content-type image/svg+xml
GET H2	200	sqmarket-regular.otf squarestoreaddress.com/login/	49 KB 49 KB	277ms 276ms	Font font/otf	162.241.85.194 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://squarestoreaddress.com/login/sqmarket-regular.otf Requested by Host: squarestoreaddress.com URL: https://squarestoreaddress.com/login/login.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.194 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-194.unifiedlayer.com Software Apache / Resource Hash `1fc4881cab9110cf5a212890ce46537bb5192d99bc820fb447a7cd708c78e8da` Request headers Referer https://squarestoreaddress.com/login/login.css Origin https://squarestoreaddress.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 15 Nov 2021 14:12:17 GMT last-modified Wed, 25 Nov 2020 01:21:38 GMT server Apache accept-ranges bytes content-length 50160 content-type font/otf
GET H2	200	sqmarket-medium.otf squarestoreaddress.com/login/	56 KB 57 KB	149ms 149ms	Font font/otf	162.241.85.194 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://squarestoreaddress.com/login/sqmarket-medium.otf Requested by Host: squarestoreaddress.com URL: https://squarestoreaddress.com/login/login.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 162.241.85.194 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 162-241-85-194.unifiedlayer.com Software Apache / Resource Hash `550adada1bc65c641da935bced98f7240863cc6ca61f9d38fe0ffdf1a085aeb3` Request headers Referer https://squarestoreaddress.com/login/login.css Origin https://squarestoreaddress.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Response headers date Mon, 15 Nov 2021 14:12:17 GMT last-modified Wed, 25 Nov 2020 01:21:38 GMT server Apache accept-ranges bytes content-length 57680 content-type font/otf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Squarespace (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

squarestoreaddress.com
trk.klclick2.com
162.241.85.194
2600:9000:2156:de00:15:1199:2d80:93a1
1a8f78dcae935b7b42150f3ac41ff507cb58c476a5addf6369caef69fffb930b
1fc4881cab9110cf5a212890ce46537bb5192d99bc820fb447a7cd708c78e8da
50a7da9ad8921fa90ab51b3c906eb9fa0efbd49345cd216b3678c1b156458175
550adada1bc65c641da935bced98f7240863cc6ca61f9d38fe0ffdf1a085aeb3
8023f47261655f47732bfc1bc44ffa65943709415ecfc7b085b3710b328f3452

squarestoreaddress.com Open in urlscan Pro 162.241.85.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

141 kBTransfer

231 kBSize

0 Cookies

6 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

squarestoreaddress.com Open in urlscan Pro
162.241.85.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

141 kB
Transfer

231 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!