sitetralintreaw-b087a8.ingress-earth.easywp.com
Open in
urlscan Pro
63.250.43.128
Malicious Activity!
Public Scan
Effective URL: https://sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/login.php?user
Submission: On May 23 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 16th 2022. Valid for: a year.
This is the only time sitetralintreaw-b087a8.ingress-earth.easywp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a06:98c1:312... 2a06:98c1:3121::a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 63.250.43.128 63.250.43.128 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
13 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-earth.easywp.com
sitetralintreaw-b087a8.ingress-earth.easywp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
easywp.com
sitetralintreaw-b087a8.ingress-earth.easywp.com |
356 KB |
1 |
mr-unique.com
www.mr-unique.com |
679 B |
0 |
googleapis.com
Failed
ajax.googleapis.com Failed |
|
13 | 3 |
Domain | Requested by | |
---|---|---|
10 | sitetralintreaw-b087a8.ingress-earth.easywp.com |
sitetralintreaw-b087a8.ingress-earth.easywp.com
|
1 | www.mr-unique.com | |
0 | ajax.googleapis.com Failed |
sitetralintreaw-b087a8.ingress-earth.easywp.com
|
13 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-08 - 2022-07-07 |
a year | crt.sh |
*.ingress-earth.easywp.com Sectigo RSA Domain Validation Secure Server CA |
2022-03-16 - 2023-04-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/login.php?user
Frame ID: 2C9A5EF5CA19618BB92E6B265E9AB3D4
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Netflix - a08a59db6faf867226d0Page URL History Show full URLs
- https://www.mr-unique.com/salim.php Page URL
- https://sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/login.php?user Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://www.mr-unique.com/salim.php Page URL
- https://sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/login.php?user Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
salim.php
www.mr-unique.com/ |
229 B 679 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.php
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon.ico
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main_en.css
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
disabled.js
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/js/ |
841 B 888 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main_en.js
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/js/ |
6 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.10.2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
back_en.jpg
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
333 KB 334 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check.png
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
548 B 548 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fb.png
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
globe.png
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
drop.png
sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/ |
634 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- sitetralintreaw-b087a8.ingress-earth.easywp.com
- URL
- https://sitetralintreaw-b087a8.ingress-earth.easywp.com/botra/nino/98796d2ea24ba07/assets/img/icon.ico
- Domain
- ajax.googleapis.com
- URL
- http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails boolean| error_username boolean| error_password function| validateEmail function| validatePhoneNumber0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
sitetralintreaw-b087a8.ingress-earth.easywp.com
www.mr-unique.com
ajax.googleapis.com
sitetralintreaw-b087a8.ingress-earth.easywp.com
2a06:98c1:3121::a
63.250.43.128
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4442aacdd8b7f2368c235a92f6559b1d807231cb30c9409abe8a0f744dc9e8c5
4d4054a533373a85d24d65f5290ca306133f3c22f0b2d7b71a742a277d0f7a49
6670c7c25521b9cafafcf3f0fec6073228c3e7c20925b9bee739c085f2143b90
6ac8852a96c7e1a5faecaf42f75e90d295b7b30316c43f41af6cc3397621daf6
76fda49610478440b5b123d15bb4d3510ab771ab27b0b881565887b7bcf6a0c6
7f8f39f235b0c0d93cf599479e822a17008ad65eaa3589d4a1b83802c77bf095
8cd4160bcd3386eab55834c6bcc20561b39e07ea4581b4ceaa11634fe0dc2d3f
d465172175d35d493fb1633e237700022bd849fa123164790b168b8318acb090
f25c9f93cd29e8ec716e459bc1ad727f493db7b757abce133ebe6aa89bf25839
ff3f1d6fdbb0b5ff2dc0ead52702c0cdc618b72180c161c63f2e78166d6d1861