URL: http://atsihomeschooling.atsinj.com.au/components/com_foxcontact/css/done.html
Submission: On January 11 via manual from US

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions.
The main IP is 100.42.49.117, located in Austin, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is atsihomeschooling.atsinj.com.au.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 100/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against Generic (Online) Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
1 100.42.49.117 46606 (UNIFIEDLA...)
1 6 210.16.102.73 40676 (AS40676)
6 2
Domain
Subdomains
Transfer
6 emaildonatimi.icu
94 KB
1 atsinj.com.au
682 B
6 2
Domain Requested by
6 emaildonatimi.icu 1 redirects atsihomeschooling.atsinj.com.au
emaildonatimi.icu
1 atsihomeschooling.atsinj.com.au
6 2

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
emaildonatimi.icu
cPanel, Inc. Certification Authority
2019-01-10 -
2019-04-10
3 months

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Web
Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
done.html
/components/com_foxcontact/css
623 B
682 B
Document
General
Full URL
http://atsihomeschooling.atsinj.com.au/components/com_foxcontact/css/done.html
Protocol
HTTP/1.1
Server
100.42.49.117 Austin, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
100.42.49.117-static.reverse.mysitehosted.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
a29a90359aad92d9db51ed3096175f73131144bb847919481f8325ccfe3572db

Request headers

Host
atsihomeschooling.atsinj.com.au
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
text/html
Content-Encoding
gzip
Last-Modified
Fri, 11 Jan 2019 00:12:53 GMT
Accept-Ranges
bytes
ETag
"80301e6542a9d41:0"
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
X-Powered-By-Plesk
PleskWin
Date
Fri, 11 Jan 2019 19:20:11 GMT
Content-Length
357
index.php?country.x=-&lang.x=en
emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29
Redirect Chain
  • https://emaildonatimi.icu/Chase/chase/
  • https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
1 KB
1 KB
Document
General
Full URL
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Requested by
Host: atsihomeschooling.atsinj.com.au
URL: http://atsihomeschooling.atsinj.com.au/components/com_foxcontact/css/done.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.16.102.73 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
b457c2e5da90340959c8cf1379512bef49f24705a42a2fbe5090db4702cf2ded

Request headers

Host
emaildonatimi.icu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://atsihomeschooling.atsinj.com.au/components/com_foxcontact/css/done.html
Accept-Encoding
gzip, deflate, br
Cookie
PHPSESSID=mpfrho3gpb2fl16p5sj0a1ut97
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://atsihomeschooling.atsinj.com.au/components/com_foxcontact/css/done.html

Response headers

Date
Fri, 11 Jan 2019 19:20:12 GMT
Server
Apache
Keep-Alive
timeout=5
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Fri, 11 Jan 2019 19:20:12 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=mpfrho3gpb2fl16p5sj0a1ut97; path=/
location
./verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Keep-Alive
timeout=5
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Untitled1.css
emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/css
2 KB
2 KB
Stylesheet
General
Full URL
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/css/Untitled1.css
Requested by
Host: emaildonatimi.icu
URL: https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.16.102.73 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
4dbf2e4f3fa2fd8ac6e90c25c45cd0140f4909a3949311de51cdbebea4e98ef2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
emaildonatimi.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Cookie
PHPSESSID=mpfrho3gpb2fl16p5sj0a1ut97
Connection
keep-alive
Cache-Control
no-cache
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 11 Jan 2019 19:20:12 GMT
Last-Modified
Fri, 11 Jan 2019 19:20:12 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
1995
index.css
emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/css
2 KB
2 KB
Stylesheet
General
Full URL
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/css/index.css
Requested by
Host: emaildonatimi.icu
URL: https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.16.102.73 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
137d94fdbac5b8074dbd90f0f64ebcbacb0764f819f27595841226af2c5bf5d1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
emaildonatimi.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Cookie
PHPSESSID=mpfrho3gpb2fl16p5sj0a1ut97
Connection
keep-alive
Cache-Control
no-cache
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 11 Jan 2019 19:20:12 GMT
Last-Modified
Fri, 11 Jan 2019 19:20:12 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
2170
2.GIF
emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/images
18 KB
18 KB
Image
General
Full URL
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/images/2.GIF
Requested by
Host: emaildonatimi.icu
URL: https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.16.102.73 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
2d20a1045302baad19bafab344d39dac2ff7db72019507fad4e11f03a16a6327

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
emaildonatimi.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Cookie
PHPSESSID=mpfrho3gpb2fl16p5sj0a1ut97
Connection
keep-alive
Cache-Control
no-cache
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 11 Jan 2019 19:20:12 GMT
Last-Modified
Fri, 11 Jan 2019 19:20:12 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
17962
1.GIF
emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/images
70 KB
70 KB
Image
General
Full URL
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/images/1.GIF
Requested by
Host: emaildonatimi.icu
URL: https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
210.16.102.73 , India, ASN40676 (AS40676 - Psychz Networks, US),
Reverse DNS
Software
Apache /
Resource Hash
605b40adf1865d3404c0a1c978829e697387d46f6cd7cc38acac3ffe6978d44d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
emaildonatimi.icu
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/css/index.css
Cookie
PHPSESSID=mpfrho3gpb2fl16p5sj0a1ut97
Connection
keep-alive
Cache-Control
no-cache
Referer
https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/css/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 11 Jan 2019 19:20:12 GMT
Last-Modified
Fri, 11 Jan 2019 19:20:12 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5
Content-Length
71342

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 1
  • https://emaildonatimi.icu/Chase/chase/
  • https://emaildonatimi.icu/Chase/chase/verification/EMEME21958N855AM3B29/index.php?country.x=-&lang.x=en

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: Generic (Online) Chase (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Domain/Path Name / Value
emaildonatimi.icu/ Name: PHPSESSID
Value: mpfrho3gpb2fl16p5sj0a1ut97