reedandco.com.au - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 146.66.91.85, located in Bulgaria and belongs to SOFTLAYER - SoftLayer Technologies Inc., US. The main domain is reedandco.com.au.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 2nd 2018. Valid for: 3 months.

This is the only time reedandco.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	145.14.144.171 145.14.144.171	204915 (AWEX) (AWEX)
2	146.66.91.85 146.66.91.85	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
3	3

1 145.14.144.171 (Netherlands)

ASN204915 (AWEX, US)

colorfultemplate.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 146.66.91.85 (Bulgaria)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: ip-146-66-91-85.siteground.com

reedandco.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	reedandco.com.au reedandco.com.au	100 KB
1	colorfultemplate.tk colorfultemplate.tk	519 B
3	2

	Domain	Requested by
2	reedandco.com.au	reedandco.com.au
1	colorfultemplate.tk
3	2

This site contains no links.

Subject Issuer	Validity	Valid
reedandco.com.au Let's Encrypt Authority X3	`2018-03-02` - `2018-05-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html
Frame ID: 94F6D5E092E3076E29364AF9B79CBFF1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://colorfultemplate.tk/wp-content/uploads/2018/01/indexs.html Page URL
https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

101 kB
Transfer

191 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://colorfultemplate.tk/wp-content/uploads/2018/01/indexs.html Page URL
https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK indexs.html Show response
colorfultemplate.tk/wp-content/uploads/2018/01/ 210 B
519 B 221ms
111ms Document
text/html 145.14.144.171
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://colorfultemplate.tk/wp-content/uploads/2018/01/indexs.html

Protocol

HTTP/1.1

Server

145.14.144.171 , Netherlands, ASN204915 (AWEX, US),

Reverse DNS

Software

awex /

Resource Hash

6702312e09e5038a2d922dce9e29a530d0e1ff30d3d759b399ecefbd2e357d4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: colorfultemplate.tk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 13 Mar 2018 16:38:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: awex
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: ff72184eaf92ec83f1b745b99c8d8bb9

GET
H2 200 Primary Request quote.xls.html Show response
reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/ 84 KB
53 KB 1558ms
1163ms Document
text/html 146.66.91.85
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to

Full URL: https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.66.91.85 , Bulgaria, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: ip-146-66-91-85.siteground.com
Software: nginx /
Resource Hash: 6ad762fe0d949ed15508532394a867773a04f1a86e69643403fcc99e47aa6c81

Request headers

:path: /wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: reedandco.com.au
referer: http://colorfultemplate.tk/wp-content/uploads/2018/01/indexs.html
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
Referer: http://colorfultemplate.tk/wp-content/uploads/2018/01/indexs.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Tue, 13 Mar 2018 16:38:49 GMT
content-encoding: gzip
last-modified: Sat, 20 Feb 2016 02:43:14 GMT
server: nginx
etag: "14e03-52c2a8fa8b480-gzip"
vary: X-Forwarded-Proto,Accept-Encoding,User-Agent
content-type: text/html
status: 200
host-header: 192fc2e7e50945beb8231a492d6a8024
x-proxy-cache: MISS

GET
DATA 200
OK truncated
/ 49 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2202d40e45d69a4efd1f5fc6c8d603d3e849cdcdd39460029589b9119a2949d9

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H2 404 294.gif
reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/files/ 47 KB
47 KB 1161ms
1161ms Image
text/html 146.66.91.85
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/files/294.gif
Requested by: Host: reedandco.com.au
URL: https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.66.91.85 , Bulgaria, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: ip-146-66-91-85.siteground.com
Software: nginx /
Resource Hash: 87c73f8237df52595ec20395a5507ab6cca3bceee835af750a9834c27a4aea5c

Request headers

:path: /wp-content/plugins/wordfence/js/ExcelOrder/files/294.gif
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: reedandco.com.au
referer: https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html
:scheme: https
:method: GET
Referer: https://reedandco.com.au/wp-content/plugins/wordfence/js/ExcelOrder/quote.xls.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 13 Mar 2018 16:38:51 GMT
server: nginx
vary: X-Forwarded-Proto,Accept-Encoding,User-Agent
content-type: text/html; charset=UTF-8
status: 404
cache-control: no-cache, must-revalidate, max-age=0
set-cookie: PHPSESSID=gv5fk5ceo8cfo6pg7cfr6bbmv4; path=/ wfvt_478986554=5aa7fe9b1276c; expires=Tue, 13-Mar-2018 17:08:51 GMT; Max-Age=1800; path=/; secure; HttpOnly
host-header: 192fc2e7e50945beb8231a492d6a8024
link: <https://reedandco.com.au/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			reedandco.com.au/	1970-01-18 14:29:20	Name: wfvt_478986554 Value: 5aa7fe9b1276c
			reedandco.com.au/	1969-12-31 23:59:59	Name: PHPSESSID Value: gv5fk5ceo8cfo6pg7cfr6bbmv4

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

colorfultemplate.tk
reedandco.com.au
145.14.144.171
146.66.91.85
2202d40e45d69a4efd1f5fc6c8d603d3e849cdcdd39460029589b9119a2949d9
6702312e09e5038a2d922dce9e29a530d0e1ff30d3d759b399ecefbd2e357d4f
6ad762fe0d949ed15508532394a867773a04f1a86e69643403fcc99e47aa6c81
7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798
87c73f8237df52595ec20395a5507ab6cca3bceee835af750a9834c27a4aea5c

reedandco.com.au Open in urlscan Pro 146.66.91.85 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

101 kBTransfer

191 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

reedandco.com.au Open in urlscan Pro
146.66.91.85 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

101 kB
Transfer

191 kB
Size

2
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!