demo.locusmag.com Open in urlscan Pro
64.182.17.92 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adf...
Submission: On May 05 via automatic, source openphish (May 5th 2018, 7:47:13 am UTC)

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 64.182.17.92, located in Dallas, United States and belongs to CORESPACE-DAL - CoreSpace, Inc., US. The main domain is demo.locusmag.com.

This is the only time demo.locusmag.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CapitalOne (Financial)

Domain & IP information

	IP Address	AS Autonomous System
10	64.182.17.92 64.182.17.92	54489 (CORESPACE...) (CORESPACE-DAL - CoreSpace)
1	205.185.208.52 205.185.208.52	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	104.16.87.20 104.16.87.20	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
13	3

10 64.182.17.92 (Dallas, United States)

ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US)
PTR: 92-17-182-64.cust.dal01.corespace.com

demo.locusmag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.87.20 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	locusmag.com demo.locusmag.com	223 KB
2	jsdelivr.net cdn.jsdelivr.net	13 KB
1	jquery.com code.jquery.com	38 KB
13	3

	Domain	Requested by
10	demo.locusmag.com	demo.locusmag.com code.jquery.com
2	cdn.jsdelivr.net	demo.locusmag.com
1	code.jquery.com	demo.locusmag.com
13	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Frame ID: 92DD8A26D02781E4C09274E60F5D84A1
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

13
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

275 kB
Transfer

354 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request step3.php Show response
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/ 6 KB
7 KB 358ms
224ms Document
text/html 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache / PHP/5.5.38

Resource Hash

177379d346f3bfce7ec40748f6e431ad306569243cd8c8ab2a4829b1109c50e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: demo.locusmag.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 92DD8A26D02781E4C09274E60F5D84A1

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
Server: Apache
X-Powered-By: PHP/5.5.38
X-Content-Type-Options: nosniff
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK app-3f627e3dc2.css
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/ 115 KB
116 KB 151ms
137ms Stylesheet
text/css 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css

Requested by

Host: demo.locusmag.com
URL: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

b59f61eeaeea3400b0c27424ea1074ac4b2d9130d66e7c218fc2b8b94e7e227a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Connection: keep-alive
Cache-Control: no-cache
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: text/css
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 118204
Expires: Sat, 19 May 2018 07:47:01 GMT

GET
H/1.1 200
OK capitalone-logo.png
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/ 7 KB
7 KB 271ms
137ms Image
image/png 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/capitalone-logo.png

Requested by

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

da7c29ad433fe646e6d22a47b186fe112a7eb9b9200cd26ea917e0a6c05c1c4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Connection: keep-alive
Cache-Control: no-cache
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7132
Expires: Sat, 19 May 2018 07:47:01 GMT

GET
H/1.1 200
OK 9.gif
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/ 13 KB
14 KB 137ms
137ms Image
image/gif 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/9.gif

Requested by

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

ce8aa7f6a453f00f303e63b5f0d81dc9983994cc85bb8be36315f5f0a6e71751

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Connection: keep-alive
Cache-Control: no-cache
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 13795
Expires: Sat, 19 May 2018 07:47:01 GMT

GET
H/1.1 200
OK 8.gif
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/ 14 KB
14 KB 137ms
137ms Image
image/gif 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/8.gif

Requested by

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

30d15e1284d2ec3fc9ce2b5fa43f9e89d9106a45677a24c0bb529cba1ae2f7a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Connection: keep-alive
Cache-Control: no-cache
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 13829
Expires: Sat, 19 May 2018 07:47:01 GMT

GET
H/1.1 200
OK 7.gif
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/ 21 KB
21 KB 138ms
138ms Image
image/gif 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/7.gif

Requested by

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

9e4d2744ae75b0cbe321261c8517fe4fd16a0314f08b2931cf4f0833803dbaa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Connection: keep-alive
Cache-Control: no-cache
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: image/gif
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 21600
Expires: Sat, 19 May 2018 07:47:01 GMT

GET
H/1.1 200
OK jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
38 KB 36ms
8ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: demo.locusmag.com
URL: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Protocol: HTTP/1.1
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:07 GMT
Server: nginx
ETag: W/"54499a47-1762a"
Vary
X-HW: 1525506421.dop001.fr8.t,1525506421.cds012.fr8.shn,1525506421.dop001.fr8.t,1525506421.cds014.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 38821

GET
S 200 jquery.validate.min.js Show response
cdn.jsdelivr.net/jquery.validation/1.16.0/ 23 KB
8 KB 33ms
13ms Script
application/javascript 104.16.87.20
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jsdelivr.net/jquery.validation/1.16.0/jquery.validate.min.js
Requested by: Host: demo.locusmag.com
URL: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Protocol: SPDY
Server: 104.16.87.20 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898

Request headers

Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sat, 05 May 2018 07:47:01 GMT
content-encoding: gzip
cf-cache-status: HIT
x-cache: HIT
status: 200
content-length: 7446
x-served-by: cache-hhn1530-HHN
timing-allow-origin: *
server: cloudflare
etag: "5a1e-IUhhlLqiLrEVX+mL969jFOd3PMc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
cf-ray: 416198bf0dbb6499-FRA

GET
S 200 additional-methods.min.js Show response
cdn.jsdelivr.net/jquery.validation/1.16.0/ 17 KB
5 KB 12ms
11ms Script
application/javascript 104.16.87.20
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.jsdelivr.net/jquery.validation/1.16.0/additional-methods.min.js
Requested by: Host: demo.locusmag.com
URL: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
Protocol: SPDY
Server: 104.16.87.20 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8

Request headers

Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/step3.php?cmd=login_submit&id=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce&session=8e8a0952c35fe74f3148fc3441b46bce8e8a0952c35fe74f3148fc3441b46bce
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Sat, 05 May 2018 07:47:01 GMT
content-encoding: gzip
cf-cache-status: HIT
x-cache: HIT
status: 200
content-length: 5297
x-served-by: cache-hhn1548-HHN
timing-allow-origin: *
server: cloudflare
etag: "4587-uIBUYLV1S+ixaiI99zfZV32kwYI"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
cf-ray: 416198bf2dca6499-FRA

GET
H/1.1 404
Not Found drop-icon.png
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/ 405 B
405 B 952ms
820ms Image
text/html 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/images/drop-icon.png

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache / PHP/5.5.38

Resource Hash

ef96e9f7d13f3eb1e30a06a72267f544afa9af646ed21bcdc8f0b290f540ddd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Powered-By: PHP/5.5.38
X-Frame-Options: SAMEORIGIN
Content-Language: en
Cache-Control: no-cache, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Keep-Alive: timeout=5, max=100
Expires: Sun, 19 Nov 1978 05:00:00 GMT

GET
H/1.1 404
Not Found ProximaNovaRegular.woff2
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/fonts/ 0
0 1030ms
1018ms Font
text/html 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/fonts/ProximaNovaRegular.woff2

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache / PHP/5.5.38

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Pragma: no-cache
Origin: http://demo.locusmag.com
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Origin: http://demo.locusmag.com

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Server: Apache
X-Powered-By: PHP/5.5.38
X-Frame-Options: SAMEORIGIN
Content-Language: en
X-Generator: Drupal 7 (http://drupal.org)
Cache-Control: no-cache, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
Keep-Alive: timeout=5, max=98
Expires: Sun, 19 Nov 1978 05:00:00 GMT

GET
H/1.1 200
OK ProximaNovaSemiBold.woff2
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/fonts/ 20 KB
20 KB 252ms
137ms Font
font/woff2 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/fonts/ProximaNovaSemiBold.woff2

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

76680efd61dc1f00144c9af7adb317cc0642fe53282525e7e35806a12e74a084

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Origin: http://demo.locusmag.com
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Origin: http://demo.locusmag.com

Response headers

Date: Sat, 05 May 2018 07:47:01 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: font/woff2
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 20400
Expires: Sat, 19 May 2018 07:47:01 GMT

GET
H/1.1 200
OK ProximaNovaRegular.woff
demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/fonts/ 24 KB
24 KB 137ms
137ms Font
font/woff 64.182.17.92
CoreSpace

General

Check archive.org

Show headers Download Go to

Full URL

http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/fonts/ProximaNovaRegular.woff

Requested by

Protocol

HTTP/1.1

Server

64.182.17.92 Dallas, United States, ASN54489 (CORESPACE-DAL - CoreSpace, Inc., US),

Reverse DNS

92-17-182-64.cust.dal01.corespace.com

Software

Apache /

Resource Hash

3db577869cbe9e2e300e6575965aa1c63ae1054fbbd66aa166c8efb04d5c706f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Origin: http://demo.locusmag.com
Accept-Encoding: gzip, deflate
Host: demo.locusmag.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: http://demo.locusmag.com/profiles/testing/modules/drupal_system_listing_compatible_test/login/7a3d993a928a4df22d4445d1adffcd03/index_files/app-3f627e3dc2.css
Origin: http://demo.locusmag.com

Response headers

Date: Sat, 05 May 2018 07:47:02 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 05 May 2018 05:52:24 GMT
Server: Apache
Content-Type: font/woff
Cache-Control: max-age=1209600
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 24172
Expires: Sat, 19 May 2018 07:47:02 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CapitalOne (Financial)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| cc_number_saved function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
demo.locusmag.com
104.16.87.20
205.185.208.52
64.182.17.92
177379d346f3bfce7ec40748f6e431ad306569243cd8c8ab2a4829b1109c50e8
30d15e1284d2ec3fc9ce2b5fa43f9e89d9106a45677a24c0bb529cba1ae2f7a0
3db577869cbe9e2e300e6575965aa1c63ae1054fbbd66aa166c8efb04d5c706f
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
76680efd61dc1f00144c9af7adb317cc0642fe53282525e7e35806a12e74a084
8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8
9e4d2744ae75b0cbe321261c8517fe4fd16a0314f08b2931cf4f0833803dbaa4
b59f61eeaeea3400b0c27424ea1074ac4b2d9130d66e7c218fc2b8b94e7e227a
ce8aa7f6a453f00f303e63b5f0d81dc9983994cc85bb8be36315f5f0a6e71751
da7c29ad433fe646e6d22a47b186fe112a7eb9b9200cd26ea917e0a6c05c1c4e
ef96e9f7d13f3eb1e30a06a72267f544afa9af646ed21bcdc8f0b290f540ddd8

demo.locusmag.com Open in urlscan Pro 64.182.17.92 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

13 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

275 kBTransfer

354 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

demo.locusmag.com Open in urlscan Pro
64.182.17.92 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

275 kB
Transfer

354 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!