greentechnepal.com.np
Open in
urlscan Pro
5.189.149.179
Malicious Activity!
Public Scan
Effective URL: https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/?sslchannel=true&sessionid=L7Ds4...
Submission: On June 17 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 23rd 2019. Valid for: 3 months.
This is the only time greentechnepal.com.np was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online) Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 12 | 5.189.149.179 5.189.149.179 | 51167 (CONTABO) (CONTABO) | |
1 | 64.111.118.105 64.111.118.105 | 26347 (DREAMHOST-AS) (DREAMHOST-AS - New Dream Network) | |
1 | 54.85.186.118 54.85.186.118 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
12 | 3 |
ASN51167 (CONTABO, DE)
PTR: web-server.onlinebyapar.com
greentechnepal.com.np |
ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: sepusa.com
www.sepusa.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-85-186-118.compute-1.amazonaws.com
auth.mycase.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
greentechnepal.com.np
2 redirects
greentechnepal.com.np |
145 KB |
1 |
mycase.com
auth.mycase.com |
9 KB |
1 |
sepusa.com
www.sepusa.com |
20 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
12 | greentechnepal.com.np |
2 redirects
greentechnepal.com.np
|
1 | auth.mycase.com |
greentechnepal.com.np
|
1 | www.sepusa.com |
greentechnepal.com.np
|
12 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
greentechnepal.com.np cPanel, Inc. Certification Authority |
2019-04-23 - 2019-07-22 |
3 months | crt.sh |
www.sepusa.com Go Daddy Secure Certificate Authority - G2 |
2018-06-22 - 2020-06-22 |
2 years | crt.sh |
*.mycase.com COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-11-12 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/?sslchannel=true&sessionid=L7Ds4zRVngXwdVrzQLsYOyGnC0lfzXck4PN9pE4MV2j9XKJNvbMkKtHmt3B21On6Eaf4OkRKmaTjVC7r
Frame ID: 76F7FF45DEF309CE24AD01890B3CE97E
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://greentechnepal.com.np/bondwaves/
HTTP 302
https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669 HTTP 301
https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/ Page URL
- https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/?sslchannel=... Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- meta csrf-param /^authenticity_token$/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://greentechnepal.com.np/bondwaves/
HTTP 302
https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669 HTTP 301
https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/ Page URL
- https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/?sslchannel=true&sessionid=L7Ds4zRVngXwdVrzQLsYOyGnC0lfzXck4PN9pE4MV2j9XKJNvbMkKtHmt3B21On6Eaf4OkRKmaTjVC7r Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://greentechnepal.com.np/bondwaves/ HTTP 302
- https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669 HTTP 301
- https://greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/ Redirect Chain
|
211 B 417 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
7118777056
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nr-1123.min.js.t%C3%A9l%C3%A9chargement
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
analytics.js.t%C3%A9l%C3%A9chargement
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font-awesome.min.css
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
28 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
application-c65b39075e2d8157df63.css
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
103 KB 104 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft_logo.png
www.sepusa.com/wp-content/uploads/2018/05/ |
24 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
comodo_secure_seal_100x85_transp.png
auth.mycase.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365.png
greentechnepal.com.np/bondwaves/UKJCIAOSJDJkksdMMS/customer-IDPP00C669/login_sessions/login_source/ |
8 KB 8 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online) Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.mycase.com
greentechnepal.com.np
www.sepusa.com
5.189.149.179
54.85.186.118
64.111.118.105
008a1d103902f15fdb1c191fcb1ce8954330e7b8de43d09abb08555ba609f420
133f96ceac619d2317cd9e4e3e9f40f30929fb612c170231cb400953d3546602
28d63cf80fa9d782dde5025cd3633b61b5d41f1cc19465293b7f681c3dcba09f
2a5e03afd498f5c5dc365358c3c6a73b5134c3a858b3036a6ecdda9a2c703c3f
39e352f10b3f1ee293a316ccc391e26bc8b1bd215d3a04c8e796ee6f4a7635a4
b96774b4e3fcd079ad151707d1c05b52ddddc95660c60cd0bd8fffd0fc4a8d35
c046edf5f7d4d563b701a5c5e3cd215f53167db88c7dab4d601daf039cd7f1df