margieiafeta.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 23.254.240.28, located in Tulsa, United States and belongs to HOSTWINDS - Hostwinds LLC., US. The main domain is margieiafeta.com.

This is the only time margieiafeta.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Universities (Education)

Domain & IP information

	IP Address	AS Autonomous System
6	23.254.240.28 23.254.240.28	54290 (HOSTWINDS) (HOSTWINDS - Hostwinds LLC.)
1	34.200.30.249 34.200.30.249	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
7	2

6 23.254.240.28 (Tulsa, United States)

ASN54290 (HOSTWINDS - Hostwinds LLC., US)
PTR: client-23-254-240-28.hostwindsdns.com

margieiafeta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.200.30.249 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-200-30-249.compute-1.amazonaws.com

www.wright.edu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	margieiafeta.com margieiafeta.com	17 KB
1	wright.edu www.wright.edu	4 KB
7	2

	Domain	Requested by
6	margieiafeta.com	margieiafeta.com
1	www.wright.edu
7	2

This site contains links to these domains. Also see Links.

Domain
www.wright.edu

Subject Issuer	Validity	Valid
www.wright.edu InCommon RSA Server CA	`2017-02-16` - `2020-02-16`	3 years	crt.sh

This page contains 1 frames:

Primary Page: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Frame ID: 9245.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

7
Requests

14 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

21 kB
Transfer

40 kB
Size

0
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wright.edu/

Search URL Search Domain Scan URL

URL: https://www.wright.edu/go/reset-password
Title: Password Management

Search URL Search Domain Scan URL

URL: https://www.wright.edu/information-technology
Title: CaTS Help Desk

Search URL Search Domain Scan URL

URL: https://www.wright.edu/accounts
Title: Wright State Accounts

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/policies/web-copyright-statement
Title: Copyright © 2016

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/policies/web-accessibility-statement
Title: Accessibility

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/accreditation
Title: Accreditation

Search URL Search Domain Scan URL

URL: http://www.wright.edu/about/privacy-policy
Title: Privacy

Search URL Search Domain Scan URL

URL: http://www.wright.edu/title-ix
Title: Title IX

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Sign_one.html Show response
margieiafeta.com/cg1-bin/Wright/ 6 KB
2 KB 408ms
129ms Document
text/html 23.254.240.28
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Protocol: HTTP/1.1
Server: 23.254.240.28 Tulsa, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: client-23-254-240-28.hostwindsdns.com
Software: LiteSpeed /
Resource Hash: 871a25d0d2a597c48e500dad69bfc972e5a4251dbbdc539dd5366f69a516636a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: margieiafeta.com
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 05 May 2017 04:03:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 04 May 2017 01:14:41 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/html
Connection: close
Accept-Ranges: bytes
Content-Length: 2202

GET
H/1.1 200
OK main.css
margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/ 14 KB
4 KB 128ms
127ms Stylesheet
text/css 23.254.240.28
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/main.css
Requested by: Host: margieiafeta.com
URL: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Protocol: HTTP/1.1
Server: 23.254.240.28 Tulsa, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: client-23-254-240-28.hostwindsdns.com
Software: LiteSpeed /
Resource Hash: a39d8d4d614571c10ceb4f457fdb72fc0960107c31bda004383e165684cbc6eb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: margieiafeta.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 05 May 2017 04:03:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 04 May 2017 01:14:41 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3939
Expires: Fri, 12 May 2017 04:03:58 GMT

GET
H/1.1 200
OK wsu.css
margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/ 5 KB
1 KB 255ms
127ms Stylesheet
text/css 23.254.240.28
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to

Full URL: http://margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/wsu.css
Requested by: Host: margieiafeta.com
URL: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Protocol: HTTP/1.1
Server: 23.254.240.28 Tulsa, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: client-23-254-240-28.hostwindsdns.com
Software: LiteSpeed /
Resource Hash: fc0a24ebac66fe5f5f499c6956540fd25f5db5b7de0aae06e928e297f4c7d1cf

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: margieiafeta.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 05 May 2017 04:03:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 04 May 2017 01:14:41 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1326
Expires: Fri, 12 May 2017 04:03:58 GMT

GET
H/1.1 200
OK ping-wrightstate-wordmark.png
margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/ 3 KB
3 KB 127ms
127ms Image
image/png 23.254.240.28
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/ping-wrightstate-wordmark.png
Requested by: Host: margieiafeta.com
URL: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Protocol: HTTP/1.1
Server: 23.254.240.28 Tulsa, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: client-23-254-240-28.hostwindsdns.com
Software: LiteSpeed /
Resource Hash: 574c734c0df2b98c2399ac70c279a963607ae712ee0c26679f1173d8a87a798a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: margieiafeta.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 05 May 2017 04:03:58 GMT
Last-Modified: Thu, 04 May 2017 01:14:41 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3169
Expires: Fri, 12 May 2017 04:03:58 GMT

GET
H/1.1 200
OK ping-biplane_white.png
margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/ 7 KB
7 KB 128ms
127ms Image
image/png 23.254.240.28
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/ping-biplane_white.png
Requested by: Host: margieiafeta.com
URL: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Protocol: HTTP/1.1
Server: 23.254.240.28 Tulsa, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: client-23-254-240-28.hostwindsdns.com
Software: LiteSpeed /
Resource Hash: 82c1f117b95aa0eb9b744902b6b848cbfd5bde968dce2b8d7e0bc6c1385e9aba

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: margieiafeta.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 05 May 2017 04:03:58 GMT
Last-Modified: Thu, 04 May 2017 01:14:41 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 7119
Expires: Fri, 12 May 2017 04:03:58 GMT

GET
H/1.1 404
Not Found ping-logo.40.png
margieiafeta.com/cg1-bin/Wright/images/ 1 KB
0 127ms
127ms Image
text/html 23.254.240.28
Hostwinds LLC.

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://margieiafeta.com/cg1-bin/Wright/images/ping-logo.40.png
Requested by: Host: margieiafeta.com
URL: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Protocol: HTTP/1.1
Server: 23.254.240.28 Tulsa, United States, ASN54290 (HOSTWINDS - Hostwinds LLC., US),
Reverse DNS: client-23-254-240-28.hostwindsdns.com
Software: LiteSpeed /
Resource Hash: 70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: margieiafeta.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/main.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign%20in%20to%20continue_files/main.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 05 May 2017 04:03:58 GMT
Server: LiteSpeed
Content-Type: text/html
Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1148

GET
H/1.1 200
OK favicon.ico
www.wright.edu/ 4 KB
4 KB 536ms
104ms Other
image/x-icon 34.200.30.249
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.wright.edu/favicon.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.200.30.249 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-200-30-249.compute-1.amazonaws.com

Software

nginx /

Resource Hash

3fa3daff86edb5cd757631278b3916c8127ecf9ecc2557619f15256327296e3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: www.wright.edu
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://margieiafeta.com/cg1-bin/Wright/Sign_one.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Fri, 05 May 2017 04:03:59 GMT
Via: 1.1 varnish
X-Content-Type-Options: nosniff
Age: 150954
X-Cache: HIT
Connection: keep-alive
X-AH-Environment: prod
Content-Length: 3584
X-Request-ID: v-6653818c-2fe8-11e7-8e29-0aff54e17866
Last-Modified: Tue, 21 Mar 2017 14:28:59 GMT
Server: nginx
Vary: X-Forwarded-Proto
X-Varnish: 1291894748 1288857877
Expires: Wed, 17 May 2017 10:08:05 GMT
Cache-Control: max-age=1209600
Accept-Ranges: bytes
Content-Type: image/x-icon
X-Cache-Hits: 12736

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Universities (Education)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

margieiafeta.com
www.wright.edu
23.254.240.28
34.200.30.249
3fa3daff86edb5cd757631278b3916c8127ecf9ecc2557619f15256327296e3b
574c734c0df2b98c2399ac70c279a963607ae712ee0c26679f1173d8a87a798a
70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83
82c1f117b95aa0eb9b744902b6b848cbfd5bde968dce2b8d7e0bc6c1385e9aba
871a25d0d2a597c48e500dad69bfc972e5a4251dbbdc539dd5366f69a516636a
a39d8d4d614571c10ceb4f457fdb72fc0960107c31bda004383e165684cbc6eb
fc0a24ebac66fe5f5f499c6956540fd25f5db5b7de0aae06e928e297f4c7d1cf

margieiafeta.com Open in urlscan Pro 23.254.240.28 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

7 Requests

14 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

21 kBTransfer

40 kBSize

0 Cookies

9 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

margieiafeta.com Open in urlscan Pro
23.254.240.28 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

14 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

21 kB
Transfer

40 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!