ghanagas.com.gh
Open in
urlscan Pro
41.191.97.196
Malicious Activity!
Public Scan
Effective URL: https://ghanagas.com.gh/root/dropb-fud/index.html
Submission: On June 08 via api from CH
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 26th 2019. Valid for: 3 months.
This is the only time ghanagas.com.gh was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 46.101.68.132 46.101.68.132 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
13 | 41.191.97.196 41.191.97.196 | 37087 (STLGHANA) (STLGHANA) | |
1 | 2606:4700::68... 2606:4700::6810:641d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
15 | 3 |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
geni.us |
ASN37087 (STLGHANA, GH)
PTR: webserver1.stlghana.com
ghanagas.com.gh |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cfl.dropboxstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
ghanagas.com.gh
ghanagas.com.gh |
148 KB |
1 |
dropboxstatic.com
cfl.dropboxstatic.com |
24 KB |
1 |
geni.us
1 redirects
geni.us |
278 B |
0 |
aspnetcdn.com
Failed
ajax.aspnetcdn.com Failed |
|
15 | 4 |
Domain | Requested by | |
---|---|---|
13 | ghanagas.com.gh |
ghanagas.com.gh
|
1 | cfl.dropboxstatic.com |
ghanagas.com.gh
|
1 | geni.us | 1 redirects |
0 | ajax.aspnetcdn.com Failed |
ghanagas.com.gh
|
15 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ghanagas.com.gh cPanel, Inc. Certification Authority |
2019-05-26 - 2019-08-24 |
3 months | crt.sh |
cfl.dropboxstatic.com DigiCert SHA2 High Assurance Server CA |
2019-01-30 - 2021-04-09 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://ghanagas.com.gh/root/dropb-fud/index.html
Frame ID: 977418A83D0823FF0BD3BA37F41736B7
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://geni.us/securelogin
HTTP 302
https://ghanagas.com.gh/root/dropb-fud/index.html Page URL
Detected technologies
OpenSSL (Web Server Extensions) ExpandDetected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://geni.us/securelogin
HTTP 302
https://ghanagas.com.gh/root/dropb-fud/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
ghanagas.com.gh/root/dropb-fud/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
ghanagas.com.gh/root/dropb-fud/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mss.js
ghanagas.com.gh/root/dropb-fud/images/ |
873 B 806 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dbdg.js
ghanagas.com.gh/root/dropb-fud/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header.png
ghanagas.com.gh/root/dropb-fud/images/ |
67 KB 67 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prf.png
ghanagas.com.gh/root/dropb-fud/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select_gif.png
ghanagas.com.gh/root/dropb-fud/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
but2_2.png
ghanagas.com.gh/root/dropb-fud/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.js
ghanagas.com.gh/root/dropb-fud/js/ |
623 B 767 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ps.js
ghanagas.com.gh/root/dropb-fud/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vj.js
ghanagas.com.gh/root/dropb-fud/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2nd.png
ghanagas.com.gh/root/dropb-fud/images/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
create_small_2x-vflRCZOr1.jpg
cfl.dropboxstatic.com/static/images/productivity/ |
24 KB 24 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3rd.png
ghanagas.com.gh/root/dropb-fud/images/ |
33 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jquery-1.12.2.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
715 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ajax.aspnetcdn.com
- URL
- http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.2.min.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| PopupCenterDual function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cfl.dropboxstatic.com
geni.us
ghanagas.com.gh
ajax.aspnetcdn.com
2606:4700::6810:641d
41.191.97.196
46.101.68.132
06c8967abd3d5cbf1628a5080a8380f1e609c93c4f176353299eeef063cbd0c9
1274e2a204ce01b495bc70f1e22f71355c8c22f7d079e51651c426577ca2a60f
4661dd14224e0564b07c8cafb4302d166983b53d46f5a2bb763fda6c68eff647
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
6255aadc9a807417c8701fb0ce1da2d70640a358170a7bb7b54b2209df4bcc9f
8f0538245cd10735d3528dc46828580755b1a3525e40216619c00c28c3136457
9bdc316558363addd5876f5695b92da52c4e507aae24336474626132050fb067
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
aea8b01d83dfd5f2f65c164b0ef1f033a3fb275935bb51e504d7651ebb17d288
b11b0add6ca98cf5224b66d81ea911b5700f3822dad9c497e5960c89487255b7
cbe4833a5e29077f25ea81e2068df23b20bde5b72e2a7028462707cbc012887a
d92af9df111dc685d9d0863e1e554325ed042a59a4c65867417bd549aa741f59
e71454253add82a146e0841cb19260034b28835de01aab49ec5c1b025947b11b