apprackspaceauth.ddns.net
Open in
urlscan Pro
68.65.120.94
Malicious Activity!
Public Scan
Effective URL: https://apprackspaceauth.ddns.net/validate/
Submission: On August 07 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on August 6th 2019. Valid for: 3 months.
This is the only time apprackspaceauth.ddns.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rackspace (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.89.118.35 167.89.118.35 | 11377 (SENDGRID) (SENDGRID - SendGrid) | |
1 | 148.66.138.166 148.66.138.166 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
3 | 68.65.120.94 68.65.120.94 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
1 | 2606:4700::68... 2606:4700::6813:c497 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
3 | 2001:4802:7a0... 2001:4802:7a01:10::7 | 27357 (RACKSPACE) (RACKSPACE - Rackspace Hosting) | |
8 | 4 |
ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789118x35.outbound-mail.sendgrid.net
u11858140.ct.sendgrid.net |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
fervordesigns.com |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: host73.registrar-servers.com
apprackspaceauth.ddns.net |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
ASN27357 (RACKSPACE - Rackspace Hosting, US)
cp.rackspace.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
rackspace.com
cp.rackspace.com |
4 KB |
3 |
ddns.net
apprackspaceauth.ddns.net |
35 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
29 KB |
1 |
fervordesigns.com
fervordesigns.com |
401 B |
1 |
sendgrid.net
1 redirects
u11858140.ct.sendgrid.net |
244 B |
8 | 5 |
Domain | Requested by | |
---|---|---|
3 | cp.rackspace.com |
apprackspaceauth.ddns.net
|
3 | apprackspaceauth.ddns.net |
apprackspaceauth.ddns.net
|
1 | cdnjs.cloudflare.com |
apprackspaceauth.ddns.net
|
1 | fervordesigns.com | |
1 | u11858140.ct.sendgrid.net | 1 redirects |
8 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
apprackspaceauth.ddns.net Let's Encrypt Authority X3 |
2019-08-06 - 2019-11-04 |
3 months | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-03-02 - 2019-09-08 |
6 months | crt.sh |
cp.rackspace.com Thawte TLS RSA CA G1 |
2018-06-08 - 2020-07-07 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://apprackspaceauth.ddns.net/validate/
Frame ID: 64BC5A8002C975F5146430712B313AF8
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://u11858140.ct.sendgrid.net/wf/click?upn=BBUdzTS8uPVtX3-2Fywdwr4u-2BSuHQ6-2BGU2SaAoRt6zM7mcFW7tNg5KI6QFM...
HTTP 302
http://fervordesigns.com/plugins/ Page URL
- https://apprackspaceauth.ddns.net/validate/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://u11858140.ct.sendgrid.net/wf/click?upn=BBUdzTS8uPVtX3-2Fywdwr4u-2BSuHQ6-2BGU2SaAoRt6zM7mcFW7tNg5KI6QFMJpe-2FgnI_-2BPPYzd87qq10IXJQDD0DU9SIOmdaNVQdZk0fC-2B-2B3OgzIaGLRBcYLY2RE2VpYu0PMwzRqtSQTj5Hb-2BeWUBW71TABHe4WpRf-2BEt7hlduHG-2FsqRscdEsbdYbdAtpYSxXD3OZT7Om0qYU4gOEPHTVSK4a322JwkDD2XWFcZofNVn9Tj9pR-2Fpzbmt4zS-2Bsqmj9dwHNTp-2BiXIn8qgnMVcvvYHQFogu-2BABXJvSDclmcu5cDdGU-3D
HTTP 302
http://fervordesigns.com/plugins/ Page URL
- https://apprackspaceauth.ddns.net/validate/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://u11858140.ct.sendgrid.net/wf/click?upn=BBUdzTS8uPVtX3-2Fywdwr4u-2BSuHQ6-2BGU2SaAoRt6zM7mcFW7tNg5KI6QFMJpe-2FgnI_-2BPPYzd87qq10IXJQDD0DU9SIOmdaNVQdZk0fC-2B-2B3OgzIaGLRBcYLY2RE2VpYu0PMwzRqtSQTj5Hb-2BeWUBW71TABHe4WpRf-2BEt7hlduHG-2FsqRscdEsbdYbdAtpYSxXD3OZT7Om0qYU4gOEPHTVSK4a322JwkDD2XWFcZofNVn9Tj9pR-2Fpzbmt4zS-2Bsqmj9dwHNTp-2BiXIn8qgnMVcvvYHQFogu-2BABXJvSDclmcu5cDdGU-3D HTTP 302
- http://fervordesigns.com/plugins/
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
fervordesigns.com/plugins/ Redirect Chain
|
103 B 401 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
apprackspaceauth.ddns.net/validate/ |
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
apprackspaceauth.ddns.net/validate/assets/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
43 B 313 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_20141002.png
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Suspicious-Email-Banner.jpg
apprackspaceauth.ddns.net/validate/assets/images/ |
31 KB 31 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ssllogo.gif
cp.rackspace.com/clients/webmail/apps_rackspace_com/images/ |
1023 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rackspace (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
apprackspaceauth.ddns.net/ | Name: PHPSESSID Value: 01cbf2ea3ed1f788768699dd19a35ff0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
apprackspaceauth.ddns.net
cdnjs.cloudflare.com
cp.rackspace.com
fervordesigns.com
u11858140.ct.sendgrid.net
148.66.138.166
167.89.118.35
2001:4802:7a01:10::7
2606:4700::6813:c497
68.65.120.94
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2894fa1d1ebe2f99a165317c3c46ea23a7de28590a1c3965508acaf802e9c9a8
55818e01d1a356af86d3a5c32d5758f2c0f9aed6f99a69d034e61e1f1938f6a8
70e04af2c17fefa133d5bfbf2e757a898f35f0d62105e60bfcc63c7931552885
7c302caed6291f0798053eb54b2fae69c8842996e5d5f9c52fcd0d1a1582375f
bdad796e4ae503ca04d1227dbdc8e4934802aa9f828b0c81ca7f1588b7b04ade
ee608b4a41a47f8df45dd1d505afb39cb7293e7a33c094b756764a85d67fca47
f167dfd881b45166119fce39b1fa639e925f80e4e7391e3cbe83f843490b7b19