costumersigninon.myvnc.com
Open in
urlscan Pro
116.12.50.224
Malicious Activity!
Public Scan
Effective URL: https://costumersigninon.myvnc.com/?loading
Submission: On December 12 via api from BE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on December 11th 2019. Valid for: 3 months.
This is the only time costumersigninon.myvnc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: 16Shop (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 222.122.205.147 222.122.205.147 | 4766 (KIXS-AS-K...) (KIXS-AS-KR Korea Telecom) | |
1 1 | 87.98.227.251 87.98.227.251 | 16276 (OVH) (OVH) | |
1 | 116.12.50.224 116.12.50.224 | 38532 (USONYX-AS...) (USONYX-AS-AP USONYX PTE LTD) | |
1 | 2a01:4f9:2a:f... 2a01:4f9:2a:f67::2 | 24940 (HETZNER-AS) (HETZNER-AS) | |
4 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
po.do
1 redirects
po.do |
10 KB |
1 |
freeiconspng.com
www.freeiconspng.com |
9 KB |
1 |
myvnc.com
costumersigninon.myvnc.com |
673 B |
1 |
pili.la
1 redirects
pili.la |
696 B |
4 | 4 |
Domain | Requested by | |
---|---|---|
3 | po.do |
1 redirects
po.do
|
1 | www.freeiconspng.com |
costumersigninon.myvnc.com
|
1 | costumersigninon.myvnc.com |
po.do
|
1 | pili.la | 1 redirects |
4 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
manage-primeaccnt.myvnc.com Let's Encrypt Authority X3 |
2019-12-11 - 2020-03-10 |
3 months | crt.sh |
freeiconspng.com COMODO RSA Domain Validation Secure Server CA |
2018-12-06 - 2019-12-24 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://costumersigninon.myvnc.com/?loading
Frame ID: A1E06B140E721D7BE1E686BF7BFF27B1
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://po.do/8J Page URL
-
http://po.do/8J?ckattempt=1
HTTP 301
http://pili.la/7jhtf HTTP 301
https://costumersigninon.myvnc.com/?loading Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://po.do/8J Page URL
-
http://po.do/8J?ckattempt=1
HTTP 301
http://pili.la/7jhtf HTTP 301
https://costumersigninon.myvnc.com/?loading Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
8J
po.do/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cupid.js
po.do/ |
30 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
/
costumersigninon.myvnc.com/ Redirect Chain
|
375 B 673 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
error-icon-4.png
www.freeiconspng.com/uploads/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: 16Shop (Consumer)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
costumersigninon.myvnc.com/ | Name: PHPSESSID Value: d70650cb315eea382375dc093af60bd2 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
costumersigninon.myvnc.com
pili.la
po.do
www.freeiconspng.com
116.12.50.224
222.122.205.147
2a01:4f9:2a:f67::2
87.98.227.251
63ae0113d05677d47e0c6cdd274b8667c5ce233fac4dcac0d4b8ea964207ac3f
76323f7dedaeb82ee226748f7d66c909942f76619c71059dbe3dbd0f49314287
abde06ab5b40e44bbd6dc2842d61420e0e54b2d24705760402b7675d2668d1e8
b7852a72787dea90410e8d7ec37f8b3937d5a9fd053315dda38956ca39d83106