gritabs.tk - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 3 HTTP transactions. The main IP is 172.93.120.160, located in Lenoir, United States and belongs to HOST4GEEKS-LLC, US. The main domain is gritabs.tk.

This is the only time gritabs.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Naver (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	172.93.120.160 172.93.120.160	393960 (HOST4GEEK...) (HOST4GEEKS-LLC)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	199.232.16.193 199.232.16.193	54113 (FASTLY) (FASTLY)
3	3

2 172.93.120.160 (Lenoir, United States) 1 redirects

ASN393960 (HOST4GEEKS-LLC, US)
PTR: schools.onlineteachernews.com

gritabs.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.16.193 (Vienna, Austria)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gritabs.tk 1 redirects gritabs.tk	2 KB
1	imgur.com i.imgur.com — Cisco Umbrella Rank: 6040	14 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 2229	33 KB
3	3

	Domain	Requested by
2	gritabs.tk	1 redirects
1	i.imgur.com	gritabs.tk
1	upload.wikimedia.org	gritabs.tk
3	3

This site contains no links.

Subject Issuer	Validity	Valid
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-10-27` - `2023-11-17`	a year	crt.sh
*.imgur.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-03-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://gritabs.tk/cgi/
Frame ID: D4F4F6151921DB8F7E5C7963D7822F37
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

http://gritabs.tk/cgi HTTP 301
http://gritabs.tk/cgi/ Page URL

Page Statistics

3
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

49 kB
Transfer

47 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gritabs.tk/cgi HTTP 301
http://gritabs.tk/cgi/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
gritabs.tk/cgi/
Redirect Chain

http://gritabs.tk/cgi
http://gritabs.tk/cgi/

1 KB
1 KB

156ms
156ms

Document
text/html

172.93.120.160
HOST4GEEKS-LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://gritabs.tk/cgi/
Protocol: HTTP/1.1
Server: 172.93.120.160 Lenoir, United States, ASN393960 (HOST4GEEKS-LLC, US),
Reverse DNS: schools.onlineteachernews.com
Software: Apache /
Resource Hash: ef3e2074313f498edb05cf57c94f0475cc1f5c1aa9eea3b8f58201bb3612f86a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 1189
Content-Type: text/html
Date: Mon, 20 Feb 2023 13:07:58 GMT
Keep-Alive: timeout=5, max=99
Last-Modified: Tue, 22 Jan 2019 04:01:50 GMT
Server: Apache

Redirect headers

Connection: Keep-Alive
Content-Length: 230
Content-Type: text/html; charset=iso-8859-1
Date: Mon, 20 Feb 2023 13:07:58 GMT
Keep-Alive: timeout=5, max=100
Location: http://gritabs.tk/cgi/
Server: Apache

GET
H2 200 2000px-Naver_Logotype.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/2/23/Naver_Logotype.svg/ 32 KB
33 KB 197ms
83ms Image
image/png 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/2/23/Naver_Logotype.svg/2000px-Naver_Logotype.svg.png

Requested by

Host: gritabs.tk
URL: http://gritabs.tk/cgi/

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/9.1.4 /

Resource Hash

cf0e8e4d417786b102b3b08173c1a5b60d465abace7190cff86cfe4983b17960

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://gritabs.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 01:52:03 GMT
strict-transport-security: max-age=106384710; includeSubDomains; preload
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 40545
x-cache-status: hit-front
x-cache: cp3063 hit, cp3065 hit/1
content-disposition: inline;filename*=UTF-8''Naver_Logotype.svg.png
server-timing: cache;desc="hit-front", host;desc="cp3065"
content-length: 32988
x-client-ip: 2a01:4a0:1338:92::5
last-modified: Tue, 27 Apr 2021 07:00:15 GMT
server: ATS/9.1.4
etag: 700d818d50b217153c8dff374bc5a416
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
permissions-policy: interest-cohort=()
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 U6Px6y7.png
i.imgur.com/ 14 KB
14 KB 152ms
45ms Image
image/png 199.232.16.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/U6Px6y7.png

Requested by

Host: gritabs.tk
URL: http://gritabs.tk/cgi/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.16.193 Vienna, Austria, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

32f31f362f7c3d81b8e2fcab690c9a9d2ef7724c585b49e2aa4da4b348f364d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://gritabs.tk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date: Mon, 20 Feb 2023 13:07:49 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
age: 4393574
x-cache: HIT, HIT
content-length: 14344
x-served-by: cache-iad-kjyo7100176-IAD, cache-vie6326-VIE
last-modified: Mon, 21 Jan 2019 17:00:16 GMT
server: cat factory 1.0
x-timer: S1676898469.242244,VS0,VE0
etag: "5703cc719e312e7bcf093a897a91ec2b"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 35, 19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Naver (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gritabs.tk
i.imgur.com
upload.wikimedia.org
172.93.120.160
199.232.16.193
2620:0:862:ed1a::2:b
32f31f362f7c3d81b8e2fcab690c9a9d2ef7724c585b49e2aa4da4b348f364d4
cf0e8e4d417786b102b3b08173c1a5b60d465abace7190cff86cfe4983b17960
ef3e2074313f498edb05cf57c94f0475cc1f5c1aa9eea3b8f58201bb3612f86a

gritabs.tk Open in urlscan Pro 172.93.120.160 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

49 kBTransfer

47 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

gritabs.tk Open in urlscan Pro
172.93.120.160 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

49 kB
Transfer

47 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!