urlscan.io logo urlscan.io
SecurityTrails logo

www.strictlyslots.eu Open in urlscan Pro
51.89.188.198  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Submission Tags: @ipnigh
Submission: On September 10 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 51.89.188.198, located in France and belongs to OVH, FR. The main domain is www.strictlyslots.eu.
This is the only time www.strictlyslots.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Navy Federal Credit Union (Government)

Domain & IP information

IP Address AS Autonomous System
5 51.89.188.198 16276 (OVH)
5 1
Apex Domain
Subdomains		 Transfer
5 strictlyslots.eu
www.strictlyslots.eu
113 KB
5 1
Domain Requested by
5 www.strictlyslots.eu www.strictlyslots.eu
5 1

This site contains no links.

Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh

This page contains 1 frames:

Primary Page: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Frame ID: FF17FE319879C35935D5179AF3E17F1C
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

113 kB
Transfer

112 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request full.php
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Protocol
HTTP/1.1
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
01543f1124b79991b15305f29c78608d200ca3ecb914592a3eae93a103d2278c

Request headers

Host
www.strictlyslots.eu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:37 GMT
Server
Apache
Keep-Alive
timeout=5, max=97
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
header.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/header.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
ac5e930c36d9bd29ecf5728664b92117d713e1effa7e4eefc2dfba9b3783d392

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:37 GMT
Last-Modified
Mon, 16 Apr 2018 18:59:22 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
25863
signins.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/signins.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
1b9ddecbed4a637f7fd2a21d9f818c6931e2d4e4e01d5b2ae9325b4073f3b9bd

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:37 GMT
Last-Modified
Sun, 24 Jun 2018 17:33:24 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
30807
submit2.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/submit2.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
026689cf002276e84232ef3b81b37663fe2504ea4051f6509b7b2eefbadd0006

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:37 GMT
Last-Modified
Sun, 24 Jun 2018 17:36:28 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
1494
end.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/end.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
c2e9b340b890890d30ab7b0d170f0b747827a04ced4e96e726cd5f11ec301976

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/full.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:37 GMT
Last-Modified
Mon, 16 Apr 2018 19:08:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
54350

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Navy Federal Credit Union (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| unhideBody

0 Cookies