Domain > geocities.ws

More information on this domain is in AlienVault OTX

Reports

https://techhelplist.com/pastes/1073-phishing-site...

Files that talk to geocities.ws

MD5	A/V
4912c0fe672fcfd330d52c5d7f81b91f	[Trojan.JS.Iframe.BBK] [Trojan.Script.Click.trmyk] [Trojan.Malscript!html] [Iframe.PT] [HEUR:Trojan.Script.Iframer] [TrojWare.JS.Iframe.mh] [JS.IFrame.312] [JS/iFrame.bbk] [Trojan:JS/Iframeinject.Y] [JS/Iframe.IA] [Trojan.IframeRef] [JS/Iframe.CQO!tr] [HTML/Framer] [adware.js.crx.50]
d89ae481b9bc0a23c3ac74f5f184ca45

DNS Resolutions

Date	IP Address
2009-12-31	190.0.162.113 (ClassC)
2013-04-01	190.183.254.194 (ClassC)
2013-10-17	142.4.211.102 (ClassC)
2024-09-19	104.26.7.14 (ClassC)
2025-02-27	172.67.68.152 (ClassC)
2025-06-03	104.26.6.14 (ClassC)

HTTP/1.1 403 ForbiddenDate: Sun, 27 Aug 2023 15:08:41 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: closeCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-P

!DOCTYPE html>html langen-US>head>title>Just a moment.../title>meta http-equivContent-Type contenttext/html; charsetUTF-8>meta http-equivX-UA-Compatible contentIEEdge>meta namerobots contentnoindex,nofollow>meta nameviewport contentwidthdevice-width,initial-scale1>link href/cdn-cgi/styles/challenges.css relstylesheet>/head>body classno-js>div classmain-wrapper rolemain>div classmain-content>noscript>div idchallenge-error-title>div classh2>span classicon-wrapper>div classheading-icon warning-icon>/div>/span>span idchallenge-error-text>Enable JavaScript and cookies to continue/span>/div>/div>/noscript>/div>/div>script>(function(){window._cf_chl_opt{cvId: 2,cZone: geocities.ws,cType: managed,cNounce: 7133,cRay: 7fd53b3a692febf2,cHash: 9fe014a34cb905b,cUPMDTk: /?__cf_chl_tkz91q5_NL_E9B7nXhnNy8lUXLX1ZqmBiqpPr0M4PL9pY-1693148921-0-gaNycGzNBZA,cFPWv: g,cTTimeMs: 1000,cMTimeMs: 0,cTplV: 5,cTplB: cf,cK: ,fa: /?__cf_chl_f_tkz91q5_NL_E9B7nXhnNy8lUXLX1ZqmBiqpPr0M4PL9pY-1693148921-0-gaNycGzNBZA,md: eRDiUCF8lCVgYa1JzixDKGtHHbLPZURymoNSFGGbAfk-1693148921-0-Aa0AgbIIHCiQFYwC2F4NX8z_0ENn9vPR_aTb-10jQaV-3JPx6cZAESp6f5dCmFEbPCJLs5sXvrpVUJ7hFhIiJFFjo8TFDDPe0iecENUT8KtKhp2D0WqljHG2KF0u8IAVrbqE6VsP42gdK60Jw3jzOg-LMKOs8JA8g7EJ-4M-M1h1ztmEGpVDw_uMN0TDMw7YcrITPEEDGeqJT3G0WImDMxdPU0JnZkb7K6z6vWyx5Zf0pQKFp_mILxl24yqp3TtXBikIZP8pkfDkcqkEDfvJ9fAaeQ3duOKDtHH77Xh770_WVJsTSn_HgBhhNgPoz-BCX8sO0Fh5crSrmd1VmJEyXWAhEyhqyNsi9TIkh4NdKc4T-s17WWTBBzLKVssNSTZB_nU9E4oz0WZbEa79J6iLEr08lQuNI_hEc0g_w5mz4cRRoq8z0Navpy6f7bkHCZQVS_ynM_NpqAYjjd_33Lc5Rq_Idk-JqqjBnn7G35Umg5UMpm7jVlzP4zy_FuYDIgQmNzpcWvuIQXimry8D0cJmIbD94G4g-1N2yX2uPbI9nqMsGQX8ZLD0xotKjEqr4PMEumh6tEGrzUubwmEm3t2KHaAejnyMpn7fIu7biMcdunReZmFusRI4THHt1ekWSJNBUGVj27WgXzCxWPhs_Tj4e6QzAwknpFZiLh9jY1KeukncHvePnEtq0pc6pJA4UbduUT4aJjbUB2yBNXxnG0YSqJLaWV8RBro_oMOrkoduLOUSAOlSdFRdDne2VmxGLRwuJqxmeJKH5sF6OQO1_YiKkXa6XRx9hGubGlpCNyWheHRZ76PzmCEfDsH77oNtfQDxJR-MFZWGGIVABeWtK_i3LC7l_qMwwOrgiR8QZCgE3Vy4glJH3Rz-_OOHUqvr0mI4yf8KU91kpS8SfCZlKr2eswAiZdhUCRYsAGDZM7x9ypW36yyQJS61dGdjz8rxB9zGqSksocntra_MAgKg3kB-VOEkY6TZWD

Port 443

HTTP/1.1 403 ForbiddenDate: Sun, 27 Aug 2023 15:08:42 GMTContent-Type: text/html; charsetUTF-8Transfer-Encoding: chunkedConnection: closeCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-P

!DOCTYPE html>html langen-US>head>title>Just a moment.../title>meta http-equivContent-Type contenttext/html; charsetUTF-8>meta http-equivX-UA-Compatible contentIEEdge>meta namerobots contentnoindex,nofollow>meta nameviewport contentwidthdevice-width,initial-scale1>link href/cdn-cgi/styles/challenges.css relstylesheet>/head>body classno-js>div classmain-wrapper rolemain>div classmain-content>noscript>div idchallenge-error-title>div classh2>span classicon-wrapper>div classheading-icon warning-icon>/div>/span>span idchallenge-error-text>Enable JavaScript and cookies to continue/span>/div>/div>/noscript>/div>/div>script>(function(){window._cf_chl_opt{cvId: 2,cZone: geocities.ws,cType: managed,cNounce: 44878,cRay: 7fd53b3ada95eb43,cHash: 0288b925e4d03f7,cUPMDTk: /?__cf_chl_tkDXTSkey4TtjS2n0TbZM2fmE5h8qnjuJmzxNtlyaQdaQ-1693148922-0-gaNycGzNCNA,cFPWv: g,cTTimeMs: 1000,cMTimeMs: 0,cTplV: 5,cTplB: cf,cK: ,fa: /?__cf_chl_f_tkDXTSkey4TtjS2n0TbZM2fmE5h8qnjuJmzxNtlyaQdaQ-1693148922-0-gaNycGzNCNA,md: jJPcP5KwU0pl5SxbdxpE1Bd.J_v4GKhSs_3ax4fg1GU-1693148922-0-AeGbpb_OMmcGf5DFzlGonWicU7WSFbEExTZsMX5VQQhvqxsuYdGBwZ0oiPmhkDt-wkahCHroFEP1jL6dYFhS6qkPWETO_OsFZqe6QtzbpxyR7wC884B3gQ_TtxsbndAfXJa4X09tPZSi5nxtoeUidnKK5u7KwvmAWTduUcHatm-GOkwNnQ4UX08n4m7UjAd5hB8icIAL6VK9BEcEoqPELsISMac0gEi66zijPjjdrbG3lpWjf_-YATJ1SaH6z9Qlu7oX_erJYXkPZaASZIxJzOYUlzDDbyC2wb3X6Wcc59VYEd3sjXCuSahqYsADXcXB7C0Lt_z7CFel6nEWAG7AwzI7rTQ8NcuydjUBwoSteYluaFN1LwF082RZsVUFEyIDsHU1BcPi-CpoS0a18d0j0kLzaICqPDzBDyusi12OPCvA9qH1zcUytQirun-STJNezCRQ7LRta_kjwIGLXgSd1PLxCrI8KTsYfBHVAcu_HNwiFJ8xHGj-5BUUN3rFsrXBoNwjBAPuZV9JE-HtXh1L3C_QmpbguZgoV6-XoMYRZlslYsar9-797lMQnwVdzHDTU5B8dVr8kUepDfdbTL6Qr4uMorqelmXKirYWNjxcR9LWPrA72_KT9TZopKA2X4UzasnyWWiATiL__TMLWNiC8kKpqZLujNjgVWp4uzPIwuccrAR9-4Ou1ZSKqXCECtsFflvQW-7GOa8asECHPUop1MNQWBCtL_8LkGGvgyk7MwtbFzuoV42sSfKoEOAPlO7aMykvNpwWkszPlG72ALEyjbP_qpj-fHAlWF-i7mukhotw_Zt9nWC1WbNSoeBWkQveAYzHLNXr6wcaDuEFgZLfqc8qbBe287hMkcWnw6CGwN_71vGaA8YI1lgcZc1yWCx4eCqsUaV2xC93-emkXiyboCE0t_FsaJT-q5cPwMVPuZpNHIjytj27yRczGTic1RgfLqIMWPOiilVeynp6Zqmaujrp-Eq7f

Subdomains

Date	Domain	IP
ns3.geocities.ws	2014-09-15	142.4.211.102
arg.geocities.ws	2014-06-19	142.4.211.102
forums.geocities.ws	2015-04-13	37.187.189.2
members.geocities.ws	2015-01-18	37.187.189.2
www.geocities.ws	2014-07-11	142.4.211.102

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]