marwahstudios.com
Open in
urlscan Pro
198.20.170.44
Malicious Activity!
Public Scan
Effective URL: https://marwahstudios.com/wp-content/i/mnb/bpfile049.php?cmd=login_submit&id=704f334cc95b7c950e448d6aea4a4e53704f334cc95b7...
Submission Tags: falconsandbox
Submission: On September 05 via api from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 17th 2021. Valid for: a year.
This is the only time marwahstudios.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Citrix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 9 | 198.20.170.44 198.20.170.44 | 55286 (SERVER-MANIA) (SERVER-MANIA) | |
7 | 2 |
ASN55286 (SERVER-MANIA, CA)
PTR: 44.170.20.198.in-addr.arpa
marwahstudios.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
marwahstudios.com
4 redirects
marwahstudios.com www.marwahstudios.com Failed |
47 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
9 | marwahstudios.com |
4 redirects
marwahstudios.com
|
0 | www.marwahstudios.com Failed |
marwahstudios.com
|
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
marwahstudios.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-17 - 2022-07-17 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://marwahstudios.com/wp-content/i/mnb/bpfile049.php?cmd=login_submit&id=704f334cc95b7c950e448d6aea4a4e53704f334cc95b7c950e448d6aea4a4e53&session=704f334cc95b7c950e448d6aea4a4e53704f334cc95b7c950e448d6aea4a4e53
Frame ID: 6AADFE82A5B87F8A4A9179903BD3EA45
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
ShareFile LoginPage URL History Show full URLs
-
https://marwahstudios.com/wp-content/i/rccl84909.pdf
HTTP 301
https://marwahstudios.com/wp-content/i/rccl84909.pdf/ HTTP 302
https://marwahstudios.com/wp-content/i/rccl84909.pdf/sharepoint.php?cmd=login_submit&id=59fcdfea5d1bff... Page URL
-
https://marwahstudios.com/wp-content/i/mnb
HTTP 301
https://marwahstudios.com/wp-content/i/mnb/ HTTP 302
https://marwahstudios.com/wp-content/i/mnb/bpfile049.php?cmd=login_submit&id=704f334cc95b7c950e448d6ae... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://marwahstudios.com/wp-content/i/rccl84909.pdf
HTTP 301
https://marwahstudios.com/wp-content/i/rccl84909.pdf/ HTTP 302
https://marwahstudios.com/wp-content/i/rccl84909.pdf/sharepoint.php?cmd=login_submit&id=59fcdfea5d1bffe3060a313ec222102c59fcdfea5d1bffe3060a313ec222102c&session=59fcdfea5d1bffe3060a313ec222102c59fcdfea5d1bffe3060a313ec222102c Page URL
-
https://marwahstudios.com/wp-content/i/mnb
HTTP 301
https://marwahstudios.com/wp-content/i/mnb/ HTTP 302
https://marwahstudios.com/wp-content/i/mnb/bpfile049.php?cmd=login_submit&id=704f334cc95b7c950e448d6aea4a4e53704f334cc95b7c950e448d6aea4a4e53&session=704f334cc95b7c950e448d6aea4a4e53704f334cc95b7c950e448d6aea4a4e53 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://marwahstudios.com/wp-content/i/rccl84909.pdf HTTP 301
- https://marwahstudios.com/wp-content/i/rccl84909.pdf/ HTTP 302
- https://marwahstudios.com/wp-content/i/rccl84909.pdf/sharepoint.php?cmd=login_submit&id=59fcdfea5d1bffe3060a313ec222102c59fcdfea5d1bffe3060a313ec222102c&session=59fcdfea5d1bffe3060a313ec222102c59fcdfea5d1bffe3060a313ec222102c
- https://marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/CitrixSans-Light.woff HTTP 301
- https://www.marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/CitrixSans-Light.woff
- https://marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/CitrixSans-Regular.woff HTTP 301
- https://www.marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/CitrixSans-Regular.woff
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
sharepoint.php
marwahstudios.com/wp-content/i/rccl84909.pdf/ Redirect Chain
|
1 KB 848 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
bpfile049.php
marwahstudios.com/wp-content/i/mnb/ Redirect Chain
|
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
weertopwuiergtgrtgrttopoc8743rg3878934efg9823hhjssk983c.css
marwahstudios.com/wp-content/i/mnb/ |
36 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
999xcsf367dfywf762fd87281234238899xv49949yios.png
marwahstudios.com/wp-content/i/mnb/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
werrr230rrrrrrewctx32r6ew2f8237d92yeuiowopsvssvcbbc73.png
marwahstudios.com/wp-content/i/mnb/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
CitrixSans-Light.woff
www.marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
CitrixSans-Regular.woff
www.marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.marwahstudios.com
- URL
- https://www.marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/CitrixSans-Light.woff
- Domain
- www.marwahstudios.com
- URL
- https://www.marwahstudios.com/cache/d24dac10cccefca3f6f2e85b971f308376655761/_auth/styles/fonts/CitrixSans-Regular.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Citrix (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
marwahstudios.com
www.marwahstudios.com
www.marwahstudios.com
198.20.170.44
29bd5d2df52bdaca911afaf66b06164a6afbcaefe168f81dc8b7bc375b903ff1
316b6da40b69575bb179a0ce5bc2a131ec4982d230bff88a79cf2ea22edc4496
70f31b45301b4850436a1a9d8a1cbb820549e04866dbaad426b4493c07822d55
89f7289aac37c6175b3fab56de66b3942ecb3cce2b9a5f3a5700eed99f542e21
a0bc5f08b3662a08327c8ecc4c5f1cea566d3ba23ea41289be1eec645f0807a1