alyusraacademy.com Open in urlscan Pro
192.163.205.198 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://alyusraacademy.com/wise/login/0548e/info.html
Submission: On May 15 via automatic, source openphish (May 15th 2022, 1:15:59 am UTC) — Scanned from DE

Summary HTTP 6 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 192.163.205.198, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is alyusraacademy.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on May 11th 2022. Valid for: 3 months.

This is the only time alyusraacademy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wise (Online)

Domain & IP information

	IP Address		AS Autonomous System
3	192.163.205.198 192.163.205.198		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
6	2

3 192.163.205.198 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: server.devronix.com

alyusraacademy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	alyusraacademy.com alyusraacademy.com www.alyusraacademy.com Failed	62 KB
6	1

	Domain	Requested by
3	alyusraacademy.com	alyusraacademy.com
0	www.alyusraacademy.com Failed	alyusraacademy.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
alyusraacademy.com ZeroSSL RSA Domain Secure Site CA	`2022-05-11` - `2022-08-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://alyusraacademy.com/wise/login/0548e/info.html
Frame ID: CD4B04E97C5C07CBF493979472416E98
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

TransferWise - Login

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

62 kB
Transfer

332 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Bold-0ba8a14820a94bbecfeb5c043ddfd409.woff2 HTTP 301
https://www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Bold-0ba8a14820a94bbecfeb5c043ddfd409.woff2

Request Chain 5

https://alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Regular-68f06d694edcfab46fe56aaa33f07cf2.woff2 HTTP 301
https://www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Regular-68f06d694edcfab46fe56aaa33f07cf2.woff2

6 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request info.html Show response alyusraacademy.com/wise/login/0548e/	3 KB 2 KB	477ms 152ms	Document text/html	192.163.205.198 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://alyusraacademy.com/wise/login/0548e/info.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.163.205.198 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.devronix.com Software Apache / Resource Hash `55fee8ba78f06a7776ac9885b630381de87ee9e544adf22d76d1951cb6c5aa86` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Encoding gzip Content-Length 1332 Content-Type text/html Date Sun, 15 May 2022 01:15:55 GMT ETag "dde-5defa73d323b3-gzip" Keep-Alive timeout=5, max=100 Last-Modified Sat, 14 May 2022 15:29:09 GMT Referrer-Policy no-referrer-when-downgrade Server Apache Vary Accept-Encoding
GET H/1.1	200 OK	style.css alyusraacademy.com/wise/login/0548e/css/	248 KB 44 KB	159ms 158ms	Stylesheet text/css	192.163.205.198 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://alyusraacademy.com/wise/login/0548e/css/style.css Requested by Host: alyusraacademy.com URL: https://alyusraacademy.com/wise/login/0548e/info.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.163.205.198 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.devronix.com Software Apache / Resource Hash `0af4cfe38f3225c17047c84f24f9661faea33214db2e984b2ac0ae6384f5e855` Request headers accept-language de-DE,de;q=0.9 Referer https://alyusraacademy.com/wise/login/0548e/info.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Sun, 15 May 2022 01:15:55 GMT Content-Encoding gzip Referrer-Policy no-referrer-when-downgrade Last-Modified Sat, 14 May 2022 15:29:09 GMT Server Apache ETag "3de81-5defa73d31be3-gzip" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 44412 Expires Mon, 15 May 2023 01:15:55 GMT
GET H/1.1	200 OK	another.css alyusraacademy.com/wise/login/0548e/css/	77 KB 17 KB	454ms 153ms	Stylesheet text/css	192.163.205.198 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://alyusraacademy.com/wise/login/0548e/css/another.css Requested by Host: alyusraacademy.com URL: https://alyusraacademy.com/wise/login/0548e/info.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.163.205.198 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS server.devronix.com Software Apache / Resource Hash `dc7d7b639c8a558e06957a008ba8e021da6dd57bff8c895af72a276a21e67bb4` Request headers accept-language de-DE,de;q=0.9 Referer https://alyusraacademy.com/wise/login/0548e/info.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Date Sun, 15 May 2022 01:15:55 GMT Content-Encoding gzip Referrer-Policy no-referrer-when-downgrade Last-Modified Sat, 14 May 2022 15:29:09 GMT Server Apache ETag "133bb-5defa73d31fcb-gzip" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=31536000 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 17000 Expires Mon, 15 May 2023 01:15:55 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a776652f608c53fcbde2ff9f424b5628ed720e285acf4dd152b91d4926368981` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	433 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `90d6281e201564268ac285eb97962fffc8a6d3214791d2e2865c95321057d7ce` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/svg+xml
GET		TW-Averta-Bold-0ba8a14820a94bbecfeb5c043ddfd409.woff2 www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/ Redirect Chain https://alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Bold-0ba8a14820a94bbecfeb5c043ddfd409.woff2 https://www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Bold-0ba8a14820a94bbecfeb5c043ddfd409.woff2	0 0

GET		TW-Averta-Regular-68f06d694edcfab46fe56aaa33f07cf2.woff2 www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/ Redirect Chain https://alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Regular-68f06d694edcfab46fe56aaa33f07cf2.woff2 https://www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Regular-68f06d694edcfab46fe56aaa33f07cf2.woff2	0 0

GET		TW-Averta-Semibold-e0037ebb1d64dbfb4521af1ae0ec656b.woff2 alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.alyusraacademy.com
URL: https://www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Bold-0ba8a14820a94bbecfeb5c043ddfd409.woff2

Domain: www.alyusraacademy.com
URL: https://www.alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Regular-68f06d694edcfab46fe56aaa33f07cf2.woff2

Domain: alyusraacademy.com
URL: https://alyusraacademy.com/static-assets/app/_next/static/chunks/fonts/TW-Averta-Semibold-e0037ebb1d64dbfb4521af1ae0ec656b.woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wise (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alyusraacademy.com
www.alyusraacademy.com
alyusraacademy.com
www.alyusraacademy.com
192.163.205.198
0af4cfe38f3225c17047c84f24f9661faea33214db2e984b2ac0ae6384f5e855
55fee8ba78f06a7776ac9885b630381de87ee9e544adf22d76d1951cb6c5aa86
90d6281e201564268ac285eb97962fffc8a6d3214791d2e2865c95321057d7ce
a776652f608c53fcbde2ff9f424b5628ed720e285acf4dd152b91d4926368981
dc7d7b639c8a558e06957a008ba8e021da6dd57bff8c895af72a276a21e67bb4

alyusraacademy.com Open in urlscan Pro 192.163.205.198 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

50 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

62 kBTransfer

332 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

alyusraacademy.com Open in urlscan Pro
192.163.205.198 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

62 kB
Transfer

332 kB
Size

0
Cookies

6 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!