saifislam.info
Open in
urlscan Pro
31.207.34.194
Malicious Activity!
Public Scan
Submitted URL: https://e-kursybhp.pl/wp-content/m
Effective URL: https://saifislam.info/soft/nabshiffundings/login.php?cmd=login_submit&id=8639ef929f4349cf478aba65152b89c48639ef929f434...
Submission: On July 25 via api from US
Effective URL: https://saifislam.info/soft/nabshiffundings/login.php?cmd=login_submit&id=8639ef929f4349cf478aba65152b89c48639ef929f434...
Submission: On July 25 via api from US
Summary
This website contacted 4 IPs
in 4 countries
across 4 domains to perform 16 HTTP transactions.
The main IP is 31.207.34.194, located in
Montluel, France and
belongs to RMI-FITECH, FR.
The main domain is saifislam.info.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 24th 2019. Valid for: 3 months.
This is the only time saifislam.info was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 24th 2019. Valid for: 3 months.
This is the only time saifislam.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NAB Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 2 | 54.37.137.33 54.37.137.33 | 16276 (OVH) (OVH) | |
| 1 14 | 31.207.34.194 31.207.34.194 | 16347 (RMI-FITECH) (RMI-FITECH) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:819::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 | 69.89.31.230 69.89.31.230 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
| 16 | 4 |
14
31.207.34.194
(Montluel, France)
ASN16347 (RMI-FITECH, FR)
PTR: vps62859.lws-hosting.com
ASN16347 (RMI-FITECH, FR)
PTR: vps62859.lws-hosting.com
| saifislam.info |
1
2a00:1450:4001:819::200a
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| ajax.googleapis.com |
1
69.89.31.230
(Provo, United States)
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box430.bluehost.com
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box430.bluehost.com
| smallenvelop.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
saifislam.info
1 redirects
saifislam.info |
211 KB |
| 2 |
e-kursybhp.pl
1 redirects
e-kursybhp.pl |
671 B |
| 1 |
smallenvelop.com
smallenvelop.com |
|
| 1 |
googleapis.com
ajax.googleapis.com |
29 KB |
| 16 | 4 |
| Domain | Requested by | |
|---|---|---|
| 14 | saifislam.info |
1 redirects
saifislam.info
|
| 2 | e-kursybhp.pl | 1 redirects |
| 1 | smallenvelop.com |
saifislam.info
|
| 1 | ajax.googleapis.com |
saifislam.info
|
| 16 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| e-kursybhp.pl Let's Encrypt Authority X3 |
2019-07-13 - 2019-10-11 |
3 months | crt.sh |
| saifislam.info cPanel, Inc. Certification Authority |
2019-07-24 - 2019-10-22 |
3 months | crt.sh |
| *.googleapis.com Google Internet Authority G3 |
2019-06-18 - 2019-09-10 |
3 months | crt.sh |
| smallenvelop.com Let's Encrypt Authority X3 |
2019-06-22 - 2019-09-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://saifislam.info/soft/nabshiffundings/login.php?cmd=login_submit&id=8639ef929f4349cf478aba65152b89c48639ef929f4349cf478aba65152b89c4&session=8639ef929f4349cf478aba65152b89c48639ef929f4349cf478aba65152b89c4
Frame ID: 505A1EFC799EBC9CE5103DF2A0256BA9
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://e-kursybhp.pl/wp-content/m
HTTP 301
https://e-kursybhp.pl/wp-content/m/ Page URL
-
https://saifislam.info/soft/nabshiffundings/index.php
HTTP 302
https://saifislam.info/soft/nabshiffundings/login.php?cmd=login_submit&id=8639ef929f4349cf478aba651... Page URL
Detected technologies
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://e-kursybhp.pl/wp-content/m
HTTP 301
https://e-kursybhp.pl/wp-content/m/ Page URL
-
https://saifislam.info/soft/nabshiffundings/index.php
HTTP 302
https://saifislam.info/soft/nabshiffundings/login.php?cmd=login_submit&id=8639ef929f4349cf478aba65152b89c48639ef929f4349cf478aba65152b89c4&session=8639ef929f4349cf478aba65152b89c48639ef929f4349cf478aba65152b89c4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://e-kursybhp.pl/wp-content/m HTTP 301
- https://e-kursybhp.pl/wp-content/m/
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
e-kursybhp.pl/wp-content/m/ Redirect Chain
|
156 B 399 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
login.php
saifislam.info/soft/nabshiffundings/ Redirect Chain
|
4 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n1.png
saifislam.info/soft/nabshiffundings/images/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n2.png
saifislam.info/soft/nabshiffundings/images/ |
56 KB 56 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n3.png
saifislam.info/soft/nabshiffundings/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n4.png
saifislam.info/soft/nabshiffundings/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n5.png
saifislam.info/soft/nabshiffundings/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n6.png
saifislam.info/soft/nabshiffundings/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n7.png
saifislam.info/soft/nabshiffundings/images/ |
109 KB 109 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n9.png
saifislam.info/soft/nabshiffundings/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n8.png
saifislam.info/soft/nabshiffundings/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n10.png
saifislam.info/soft/nabshiffundings/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
n11.png
saifislam.info/soft/nabshiffundings/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bton.png
saifislam.info/soft/nabshiffundings/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Preloader_11.gif
smallenvelop.com/wp-content/uploads/2014/08/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NAB Bank (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
e-kursybhp.pl
saifislam.info
smallenvelop.com
2a00:1450:4001:819::200a
31.207.34.194
54.37.137.33
69.89.31.230
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
40abe0c27842b39a166b43f8a09790187b9c68f9eade92f12e6512dc9c55c3d8
40cf9d10b98a729dfd9a5424a4e1d4833e87629a725adefe43688b740f52e22b
551a70e79672b809870de7308846d638a5974a1ae8caf6b2b3ec0ca1f80ab7b8
72cca699b7a743fb832bdadfcd2b32011d11ebc326f4fe08018ab28021a11346
8dc5e7a1073255c305f6ac789adb1b325781f7ca720a31a88c0b8491aba51e66
9337de3bc48107e0884ef9b897f2808254d9524765add4119f7b37d2d8c81cef
9884ff5f705198880878c8488439682eb44bbcf16260007ecc68b13adf595499
a730768dad1aded97eb46cedf3b634e20aa5110981d04036d6ed2689ecf0589f
b568285b7189e334b4d0d444e8352c9b31528b7a957338b0f7b7a7527c81ea91
c7c84e946442bc5b89c1cfbdbb57914930e018c49a72231a8c7f500fbc07186f
d58a1da778beb2f7b946e5095b6bd94bc1d8c8746db65df8646d4e7f3280cc72
dcd55c10542330fadc10c7cd9cb1b924697b7598960163fe92f8bb58549986b6
df3004785f5c0ede6ddb6deed0aa6d27300d3851e40d2fec12e92570c86e934d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed67bd8960eb35c8a7a921f59993afbdd4d8bb15a7d542b96baf64c78b91b774