urlscan.io logo urlscan.io
SecurityTrails logo

demo.scriptstotrade.com Open in urlscan Pro
162.241.24.110  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u8196845.ct.sendgrid.net/ls/click?upn=K7V-2FwJVP2P0bwM2l-2Bqt69S2Tl8SdIxnW3-2FPomIqBfNpHHVJPQRMSEXGQHJIlsvQqO-hP_U8-2FzRM...
Effective URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b27...
Submission: On September 07 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 13 HTTP transactions. The main IP is 162.241.24.110, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is demo.scriptstotrade.com.
TLS certificate: Issued by R3 on September 6th 2021. Valid for: 3 months.
This is the only time demo.scriptstotrade.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.121 11377 (SENDGRID)
1 1 192.185.224.85 46606 (UNIFIEDLA...)
1 12 162.241.24.110 46606 (UNIFIEDLA...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
13 3
1    167.89.115.121 (Herndon, United States)

ASN11377 (SENDGRID, US)
PTR: o16789115x121.outbound-mail.sendgrid.net
u8196845.ct.sendgrid.net
1    192.185.224.85 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: mail.bestbodybuildingroutines.com
wwww.juansaez.cl
12    162.241.24.110 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5866.bluehost.com
demo.scriptstotrade.com
1    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)
code.jquery.com
Apex Domain
Subdomains		 Transfer
12 scriptstotrade.com
demo.scriptstotrade.com
318 KB
1 jquery.com
code.jquery.com
30 KB
1 cloudflare.com
cdnjs.cloudflare.com
6 KB
1 juansaez.cl
wwww.juansaez.cl
217 B
1 sendgrid.net
u8196845.ct.sendgrid.net
227 B
13 5
Domain Requested by
12 demo.scriptstotrade.com 1 redirects demo.scriptstotrade.com
1 code.jquery.com demo.scriptstotrade.com
1 cdnjs.cloudflare.com demo.scriptstotrade.com
1 wwww.juansaez.cl 1 redirects
1 u8196845.ct.sendgrid.net 1 redirects
13 5

This site contains no links.

Subject Issuer Validity Valid
demo.scriptstotrade.com
R3		 2021-09-06 -
2021-12-05		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-21 -
2021-10-20		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Frame ID: 6C0534D23D33B7A98109AE0056E71BAD
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to Outlook

Page URL History Show full URLs

  1. https://demo.scriptstotrade.com/backup/?product=cream HTTP 302
    https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d9... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

354 kB
Transfer

518 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://demo.scriptstotrade.com/backup/?product=cream HTTP 302
    https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u8196845.ct.sendgrid.net/ls/click?upn=K7V-2FwJVP2P0bwM2l-2Bqt69S2Tl8SdIxnW3-2FPomIqBfNpHHVJPQRMSEXGQHJIlsvQqO-hP_U8-2FzRMA8pwK6BcKXi4HrKu69uEfPl16mIhChDht-2FQONzdu-2FzYZEPoDtD7ro0ZNqmeT7P6mIrFvU-2FPSi-2Bg1-2Fw8ijsd6Tk7STjUBjkiSpuJB8-2FE79nak1OoqefKfp5wgnpTUcVzciFd3UyAn9TrVE4B746iQNLxvoPvBJKQMk56UiYLdFVesA6HwmgjZOHma6cDfOr0ruDSy-2BpRJj7nt5TMS8sUI8Dw6ZeAp6-2FqZq7ndA-3D HTTP 302
  • https://wwww.juansaez.cl/ HTTP 302
  • https://demo.scriptstotrade.com/backup/?product=cream

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
demo.scriptstotrade.com/backup/
Redirect Chain
  • https://u8196845.ct.sendgrid.net/ls/click?upn=K7V-2FwJVP2P0bwM2l-2Bqt69S2Tl8SdIxnW3-2FPomIqBfNpHHVJPQRMSEXGQHJIlsvQqO-hP_U8-2FzRMA8pwK6BcKXi4HrKu69uEfPl16mIhChDht-2FQONzdu-2FzYZEPoDtD7ro0ZNqmeT7P6m...
  • https://wwww.juansaez.cl/
  • https://demo.scriptstotrade.com/backup/?product=cream
0
282 B 		Document
General
Check archive.org
Download Go to
Full URL
https://demo.scriptstotrade.com/backup/?product=cream
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:method
GET
:authority
demo.scriptstotrade.com
:scheme
https
:path
/backup/?product=cream
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:17 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
refresh
0
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-endurance-cache-level
2
x-nginx-cache
WordPress
x-server-cache
false
set-cookie
PHPSESSID=d5f23d18b2bd7b657b2a98931e8993c4; path=/

Redirect headers

date
Tue, 07 Sep 2021 19:15:13 GMT
server
Apache
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=d1e9c4e82a638c3c3e92fe8a7831cb48; path=/
location
https://demo.scriptstotrade.com/backup/?product=cream
content-length
0
content-type
text/html; charset=UTF-8
Primary Request retpp5arun4k1bsun5stpqdj.php
demo.scriptstotrade.com/backup/
Redirect Chain
  • https://demo.scriptstotrade.com/backup/?product=cream
  • https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d5...
12 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
3d9dcab6e3512c25867fbc491f1225c9a0c135f8b5dadfc88306b7d3b9ddb6c9

Request headers

:method
GET
:authority
demo.scriptstotrade.com
:scheme
https
:path
/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://demo.scriptstotrade.com/backup/?product=cream
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer
https://demo.scriptstotrade.com/backup/?product=cream

Response headers

date
Tue, 07 Sep 2021 19:15:21 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
3664
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-encoding
gzip
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-endurance-cache-level
2
x-nginx-cache
WordPress
x-server-cache
false
set-cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1; path=/

Redirect headers

date
Tue, 07 Sep 2021 19:15:18 GMT
server
nginx/1.19.10
content-type
text/html; charset=UTF-8
content-length
0
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
location
retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
x-endurance-cache-level
2
x-nginx-cache
WordPress
x-server-cache
false
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 		37 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://demo.scriptstotrade.com
Referer
https://demo.scriptstotrade.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:21 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
9670
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
5884
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-9226"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a7MfMJmpEs%2BZtH8hhJC1SHpIJt1rKI%2FcU1Qoo61XuDDxQYU0ha1866nvaq3iy9yM%2BGKftI85Gi3IBSR3ddjUYxvkf9HM3rE0YhJflAmFuPcWLitViB1ST2Y70%2F5RxJF3dOp8%2F7hIci%2FJmUFO5Y5H46Cv"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
68b243ecdc784a74-FRA
expires
Sun, 28 Aug 2022 19:15:21 GMT
login.css
demo.scriptstotrade.com/backup/lib/css/ 		100 KB
27 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://demo.scriptstotrade.com/backup/lib/css/login.css
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
f4195cc24b823ff3704e6501788245537de7c8f75e0c4b5efd874b1053f9807f

Request headers

:path
/backup/lib/css/login.css
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:23 GMT
content-encoding
gzip
x-nginx-cache
WordPress
last-modified
Sun, 22 Sep 2019 04:41:58 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
vary
Accept-Encoding
x-endurance-cache-level
2
content-type
text/css
cache-control
max-age=2592000
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
expires
Thu, 07 Oct 2021 19:15:22 GMT
logo3.png
demo.scriptstotrade.com/backup/lib/img/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/logo3.png
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

:path
/backup/lib/img/logo3.png
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:23 GMT
x-nginx-cache
WordPress
last-modified
Thu, 19 Sep 2019 13:30:02 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/png
cache-control
max-age=31536000
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
1750
expires
Wed, 07 Sep 2022 19:15:22 GMT
logo2.svg
demo.scriptstotrade.com/backup/lib/img/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/logo2.svg
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

:path
/backup/lib/img/logo2.svg
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:22 GMT
x-nginx-cache
WordPress
last-modified
Thu, 19 Sep 2019 13:30:10 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/svg+xml
cache-control
max-age=21600
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
3651
expires
Wed, 08 Sep 2021 01:15:22 GMT
picker_account.png
demo.scriptstotrade.com/backup/lib/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/picker_account.png
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05

Request headers

:path
/backup/lib/img/picker_account.png
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:23 GMT
x-nginx-cache
WordPress
last-modified
Sat, 21 Sep 2019 19:55:14 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/png
cache-control
max-age=31536000
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
1082
expires
Wed, 07 Sep 2022 19:15:22 GMT
picker_more.png
demo.scriptstotrade.com/backup/lib/img/ 		192 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/picker_more.png
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
1b8e9869c33c1086478e807f8537b155c84660c631c830d6a83d83accfd1ed18

Request headers

:path
/backup/lib/img/picker_more.png
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:22 GMT
x-nginx-cache
WordPress
last-modified
Sat, 21 Sep 2019 19:56:40 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/png
cache-control
max-age=31536000
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
192
expires
Wed, 07 Sep 2022 19:15:22 GMT
plus.svg
demo.scriptstotrade.com/backup/lib/img/ 		222 B
353 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/plus.svg
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

:path
/backup/lib/img/plus.svg
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:22 GMT
x-nginx-cache
WordPress
last-modified
Sat, 21 Sep 2019 19:55:04 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/svg+xml
cache-control
max-age=21600
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
222
expires
Wed, 08 Sep 2021 01:15:22 GMT
arrow.svg
demo.scriptstotrade.com/backup/lib/img/ 		513 B
595 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/arrow.svg
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

:path
/backup/lib/img/arrow.svg
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:23 GMT
x-nginx-cache
WordPress
last-modified
Thu, 19 Sep 2019 13:31:50 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/svg+xml
cache-control
max-age=21600
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
513
expires
Wed, 08 Sep 2021 01:15:23 GMT
white_ellipsis.svg
demo.scriptstotrade.com/backup/lib/img/ 		915 B
997 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/white_ellipsis.svg
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

:path
/backup/lib/img/white_ellipsis.svg
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:24 GMT
x-nginx-cache
WordPress
last-modified
Thu, 19 Sep 2019 13:31:00 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/svg+xml
cache-control
max-age=21600
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
915
expires
Wed, 08 Sep 2021 01:15:23 GMT
jquery-3.1.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer
https://demo.scriptstotrade.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:21 GMT
content-encoding
gzip
last-modified
Thu, 22 Sep 2016 22:32:34 GMT
server
nginx
etag
W/"57e45c02-152b5"
vary
Accept-Encoding
x-hw
1631042121.dop246.fr8.t,1631042121.cds225.fr8.hc,1631042121.cds012.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30070
background.jpg
demo.scriptstotrade.com/backup/lib/img/ 		277 KB
279 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo.scriptstotrade.com/backup/lib/img/background.jpg
Requested by
Host: demo.scriptstotrade.com
URL: https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.24.110 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
box5866.bluehost.com
Software
nginx/1.19.10 /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

:path
/backup/lib/img/background.jpg
pragma
no-cache
cookie
PHPSESSID=ca4ca65152304d171d9782a3e70135e1
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
demo.scriptstotrade.com
referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://demo.scriptstotrade.com/backup/retpp5arun4k1bsun5stpqdj.php?1083891631042118ec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5daec49ae641b277a6d58ceb3d937bba5da&app=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 19:15:24 GMT
x-nginx-cache
WordPress
last-modified
Thu, 19 Sep 2019 13:33:04 GMT
server
nginx/1.19.10
accept-ranges
bytes
x-server-cache
false
x-endurance-cache-level
2
content-type
image/jpeg
cache-control
max-age=31536000
host-header
c2hhcmVkLmJsdWVob3N0LmNvbQ==
content-length
283351
expires
Wed, 07 Sep 2022 19:15:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| true_email

0 Cookies