ctyschools.com.ng Open in urlscan Pro
2606:4700:30::6818:65cd Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bit.do/e3FQm
Effective URL:
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/...
Submission: On August 05 via manual (August 5th 2019, 2:58:15 pm UTC) from US

Summary HTTP 56 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 56 HTTP transactions. The main IP is 2606:4700:30::6818:65cd, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ctyschools.com.ng.

This is the only time ctyschools.com.ng was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lion's Den Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.83.52.76 54.83.52.76	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	2606:4700:30:... 2606:4700:30::6818:65cd	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
12	110.232.140.104 110.232.140.104	45638 (SYNERGYWH...) (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD)
56	3

1 54.83.52.76 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-83-52-76.compute-1.amazonaws.com

bit.do	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:30::6818:65cd (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ctyschools.com.ng	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 110.232.140.104 (Sydney, Australia)

ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU)
PTR: b1s2-3b-syd.hosting-services.net.au

www.alfredimaging.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	alfredimaging.com www.alfredimaging.com	228 KB
2	ctyschools.com.ng ctyschools.com.ng	12 KB
1	bit.do 1 redirects bit.do	337 B
56	3

	Domain	Requested by
12	www.alfredimaging.com	ctyschools.com.ng
2	ctyschools.com.ng	ctyschools.com.ng
1	bit.do	1 redirects
56	3

This site contains links to these domains. Also see Links.

Domain
wetrack.top

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Frame ID: B6C97B010CABDD1F6C24F6B4D35ECCD7
Requests: 56 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bit.do/e3FQm HTTP 301
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/red... Page URL
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/red... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

56
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

240 kB
Transfer

418 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://wetrack.top/PwZQp7jC
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.do/e3FQm HTTP 301
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5 Page URL
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://bit.do/e3FQm HTTP 301
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5

56 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Cookie set / Show response
ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/
Redirect Chain

http://bit.do/e3FQm
http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5

3 KB
2 KB

599ms
584ms

Document
text/html

2606:4700:30::6818:65cd
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5

Protocol

HTTP/1.1

Server

2606:4700:30::6818:65cd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

58cae49141c03d420b68472a15fedca61aab1798db732f90fc97f5eddf9a9732

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: ctyschools.com.ng
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:00 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d853be20e0c5d756c8441ece32e81bab01565017079; expires=Tue, 04-Aug-20 14:57:59 GMT; path=/; domain=.ctyschools.com.ng; HttpOnly
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 5019a06b2c94c2f9-FRA
Content-Encoding: gzip

Redirect headers

Server: nginx/1.14.1
Date: Mon, 05 Aug 2019 14:57:59 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 422
Connection: keep-alive
Location: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5

GET
H/1.1 200
OK Primary Request Cookie set / Show response
ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/ 55 KB
10 KB 815ms
814ms Document
text/html 2606:4700:30::6818:65cd
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3

Requested by

Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5

Protocol

HTTP/1.1

Server

2606:4700:30::6818:65cd , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2da2fcffc9c259dc117a19845d99dee22287fa30cf4ee7f9f85eabb69a4ed9b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: ctyschools.com.ng
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/bddgd/fdked/?spent=e1kbuu05u5w5

Response headers

Date: Mon, 05 Aug 2019 14:58:01 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d0c54f4d8c8283b289d9410dc46a348801565017080; expires=Tue, 04-Aug-20 14:58:00 GMT; path=/; domain=.ctyschools.com.ng; HttpOnly
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 5019a0741a20c2f9-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK ouibounce.css
www.alfredimaging.com/administrator/templates/html/css/ 4 KB
1 KB 3674ms
325ms Stylesheet
text/css 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.alfredimaging.com/administrator/templates/html/css/ouibounce.css
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 9af171df04c5d2ec5c97b490453a6beec46da794810c24cc4e0862aed0a57b7d

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:05 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Nov 2018 11:46:46 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 864
Expires: Mon, 12 Aug 2019 14:58:05 GMT

GET
H/1.1 200
OK bootstrap.css
www.alfredimaging.com/administrator/templates/html/css/ 147 KB
21 KB 4001ms
324ms Stylesheet
text/css 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.alfredimaging.com/administrator/templates/html/css/bootstrap.css
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 6a4dd42a51d139daba9631c26daab8a8d4a1e238704caa78f7920a316a218e5b

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:05 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Nov 2018 11:46:44 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 21389
Expires: Mon, 12 Aug 2019 14:58:05 GMT

GET
H/1.1 200
OK style.css
www.alfredimaging.com/administrator/templates/html/css/ 8 KB
2 KB 4648ms
324ms Stylesheet
text/css 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.alfredimaging.com/administrator/templates/html/css/style.css
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: dc3e40a283a2e359ac6ec65e207c6264ff06246576bd0bed924a9658537537c5

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:06 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Nov 2018 11:46:49 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1942
Expires: Mon, 12 Aug 2019 14:58:06 GMT

GET
H/1.1 200
OK backDay-de.js Show response
www.alfredimaging.com/administrator/templates/html/lib/ 741 B
704 B 5297ms
324ms Script
application/javascript 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.alfredimaging.com/administrator/templates/html/lib/backDay-de.js
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: a3770b0519974c3b9d09384c1ed062800cb71ee1642e3fdd2ab5b4e2e04e1f1f

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:06 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Nov 2018 11:47:53 GMT
Server: LiteSpeed
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 352
Expires: Mon, 12 Aug 2019 14:58:06 GMT

GET
H/1.1 200
OK theme_c3b2nq.css
www.alfredimaging.com/administrator/templates/html/css/ 21 B
311 B 4973ms
324ms Stylesheet
text/css 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to

Full URL: http://www.alfredimaging.com/administrator/templates/html/css/theme_c3b2nq.css
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 4e0f2cb203e4cbd5c7433d348c079f8e08f305de9b8fc88ae19ff4c57974962f

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:06 GMT
Last-Modified: Sun, 11 Nov 2018 11:46:38 GMT
Server: LiteSpeed
Content-Type: text/css
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 21
Expires: Mon, 12 Aug 2019 14:58:06 GMT

GET
H/1.1 200
OK news-top.png
www.alfredimaging.com/administrator/templates/html/images/ 8 KB
8 KB 5622ms
324ms Image
image/png 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/news-top.png
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:07 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:32 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 7742
Expires: Mon, 12 Aug 2019 14:58:07 GMT

GET
H/1.1 200
OK asseenin.jpg
www.alfredimaging.com/administrator/templates/html/images/ 24 KB
24 KB 4868ms
324ms Image
image/jpeg 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/asseenin.jpg
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:10 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:00 GMT
Server: LiteSpeed
Content-Type: image/jpeg
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 24761
Expires: Mon, 12 Aug 2019 14:58:10 GMT

GET top-banner.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET janie.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET 2.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET mid-image.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET code-step3.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET t1.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET t2.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET t3.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET t4.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET t5.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET
H/1.1 200
OK side1.png
www.alfredimaging.com/administrator/templates/html/images/ 34 KB
34 KB 2889ms
324ms Image
image/png 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/side1.png
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 5adbed9d75481c04641b70a78519079b1aa08150757ee14f7c84327356e73b1f

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:09 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:36 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 34888
Expires: Mon, 12 Aug 2019 14:58:09 GMT

GET
H/1.1 200
OK side2.png
www.alfredimaging.com/administrator/templates/html/images/ 34 KB
35 KB 1917ms
324ms Image
image/png 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/side2.png
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 3dde975bef15653e64134deee5e1dd5220720f5ecb8fc26adc38f63b6cb57226

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:08 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:36 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 35141
Expires: Mon, 12 Aug 2019 14:58:08 GMT

GET
H/1.1 200
OK side3.png
www.alfredimaging.com/administrator/templates/html/images/ 38 KB
38 KB 1268ms
324ms Image
image/png 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/side3.png
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: e5f99941f717ee56ec795c58e4c73d8f72d15494deb92d94894e2f0ea0f47b7e

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:08 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:39 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 38902
Expires: Mon, 12 Aug 2019 14:58:08 GMT

GET
H/1.1 200
OK side4.png
www.alfredimaging.com/administrator/templates/html/images/ 25 KB
25 KB 2564ms
324ms Image
image/png 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/side4.png
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 1b7e0a2736aeb5f656f8b9cc2fda4b3eb2ea212d2f344dae9b7792136c9c5562

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:09 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:39 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 25718
Expires: Mon, 12 Aug 2019 14:58:09 GMT

GET
H/1.1 200
OK side5.png
www.alfredimaging.com/administrator/templates/html/images/ 37 KB
37 KB 620ms
323ms Image
image/png 110.232.140.104
SYNERGYWHOLESALE-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.alfredimaging.com/administrator/templates/html/images/side5.png
Requested by: Host: ctyschools.com.ng
URL: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
Protocol: HTTP/1.1
Security: , ,
Server: 110.232.140.104 Sydney, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS: b1s2-3b-syd.hosting-services.net.au
Software: LiteSpeed /
Resource Hash: 494a3efdafd5407a5a88d922f5a4a72d71ac2f3ad8f3f9fe607f8cf89314dfa1

Request headers

Referer: http://ctyschools.com.ng/secpot/vendor/fzaninotto/faker/test/Faker/Provider/uk_UA/cproductbotbase/redirect.php/rruqc/zmh/?9nt9ec9u9h3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 05 Aug 2019 14:58:07 GMT
Last-Modified: Sun, 11 Nov 2018 11:47:41 GMT
Server: LiteSpeed
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 37859
Expires: Mon, 12 Aug 2019 14:58:07 GMT

GET side6.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET side7.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET checkmark.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET codeside-step1.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET codeside-step2.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET codeside-step3.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET code-step1.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET code-step2.png
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET lewis.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET tanya.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET jenni.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET cash.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET katy.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET amanda.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET julie.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET sarah.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET kirs.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET celia.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET alanna.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET alice.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET mark.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET ashley.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET hick.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET brit.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET shel.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET jill.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET molly.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET jenna.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET laura.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET sara.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET silver.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

GET got.jpg
www.alfredimaging.com/administrator/templates/html/images/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/top-banner.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/janie.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/2.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/mid-image.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/code-step3.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/t1.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/t2.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/t3.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/t4.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/t5.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/side6.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/side7.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/checkmark.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/codeside-step1.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/codeside-step2.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/codeside-step3.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/code-step1.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/code-step2.png

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/lewis.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/tanya.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/jenni.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/cash.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/katy.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/amanda.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/julie.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/sarah.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/kirs.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/celia.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/alanna.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/alice.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/mark.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/ashley.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/hick.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/brit.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/shel.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/jill.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/molly.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/jenna.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/laura.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/sara.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/silver.jpg

Domain: www.alfredimaging.com
URL: http://www.alfredimaging.com/administrator/templates/html/images/got.jpg

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lion's Den Scam (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| backDay

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.do
ctyschools.com.ng
www.alfredimaging.com
www.alfredimaging.com
110.232.140.104
2606:4700:30::6818:65cd
54.83.52.76
1b7e0a2736aeb5f656f8b9cc2fda4b3eb2ea212d2f344dae9b7792136c9c5562
2da2fcffc9c259dc117a19845d99dee22287fa30cf4ee7f9f85eabb69a4ed9b6
3dde975bef15653e64134deee5e1dd5220720f5ecb8fc26adc38f63b6cb57226
494a3efdafd5407a5a88d922f5a4a72d71ac2f3ad8f3f9fe607f8cf89314dfa1
4e0f2cb203e4cbd5c7433d348c079f8e08f305de9b8fc88ae19ff4c57974962f
58cae49141c03d420b68472a15fedca61aab1798db732f90fc97f5eddf9a9732
5adbed9d75481c04641b70a78519079b1aa08150757ee14f7c84327356e73b1f
6a4dd42a51d139daba9631c26daab8a8d4a1e238704caa78f7920a316a218e5b
6d1c61c97d0d24827499d8b1d4b963e70e689d0eda84dc688a7e4e01256233fa
739316d522834ada80b44c074610c183b02b962f01f405a73e9f00945e1f648e
9af171df04c5d2ec5c97b490453a6beec46da794810c24cc4e0862aed0a57b7d
a3770b0519974c3b9d09384c1ed062800cb71ee1642e3fdd2ab5b4e2e04e1f1f
dc3e40a283a2e359ac6ec65e207c6264ff06246576bd0bed924a9658537537c5
e5f99941f717ee56ec795c58e4c73d8f72d15494deb92d94894e2f0ea0f47b7e

ctyschools.com.ng Open in urlscan Pro 2606:4700:30::6818:65cd Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

56 Requests

0 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

240 kBTransfer

418 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

56 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

ctyschools.com.ng Open in urlscan Pro
2606:4700:30::6818:65cd Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

56
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

240 kB
Transfer

418 kB
Size

0
Cookies

56 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!