urlscan.io logo urlscan.io
SecurityTrails logo

theritteragency.com Open in urlscan Pro
173.199.181.132  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Submission Tags: @ipnigh
Submission: On March 23 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 173.199.181.132, located in Lansing, United States and belongs to LIQUIDWEB, US. The main domain is theritteragency.com.
This is the only time theritteragency.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

IP Address AS Autonomous System
9 173.199.181.132 32244 (LIQUIDWEB)
9 1
Apex Domain
Subdomains		 Transfer
9 theritteragency.com
theritteragency.com
246 KB
9 1
Domain Requested by
9 theritteragency.com theritteragency.com
9 1
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Frame ID: EE358170A07965314B32031A69F5C361
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

246 kB
Transfer

244 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set qes.php
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/ 		18 KB
19 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache / PHP/7.0.33
Resource Hash
2e7dc77dcbb19876e8a62110b41f1c1e5c4d07258ca35967ebd160ae8068b238

Request headers

Host
theritteragency.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Server
Apache
X-Powered-By
PHP/7.0.33
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=0qq3js4cg0p5ia8edpo8vq9qn3; path=/
Upgrade
h2
Connection
Upgrade, Keep-Alive
Keep-Alive
timeout=2, max=500
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
bactouch.css
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ 		154 KB
154 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/bactouch.css
Requested by
Host: theritteragency.com
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
dba1b30a312131596f536ca24a3187c94616f453fa147d61a73628441749a197

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Last-Modified
Mon, 23 Mar 2020 08:45:12 GMT
Server
Apache
Upgrade
h2
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=2, max=500
Content-Length
157641
toolbar.css
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ 		5 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/toolbar.css
Requested by
Host: theritteragency.com
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
5f21f3529201d9076a36b9a84063e7b7d860954b29d03373f428a530998ce37b

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Last-Modified
Mon, 23 Mar 2020 08:45:12 GMT
Server
Apache
Upgrade
h2
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=2, max=500
Content-Length
5277
bact_listview.css
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ 		51 KB
51 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/bact_listview.css
Requested by
Host: theritteragency.com
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
5332ac2520c5391aa18cc62948eb39c53a2d93ff9e1581ea4c2cf4b4b4e375b4

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Last-Modified
Mon, 23 Mar 2020 08:45:12 GMT
Server
Apache
Upgrade
h2
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=2, max=500
Content-Length
52459
footer.css
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/footer.css
Requested by
Host: theritteragency.com
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
1675cd002bcba57fe2a36a87457398d6848cdb73061ae4fab14696294aa232fc

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Last-Modified
Mon, 23 Mar 2020 08:45:12 GMT
Server
Apache
Upgrade
h2
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=2, max=500
Content-Length
1148
slidemenu.css
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ 		12 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/slidemenu.css
Requested by
Host: theritteragency.com
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
34fd40bc9b51a134b2161ceac4b3ac2e79cf261dbe49d23917eb50c46a457691

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Last-Modified
Mon, 23 Mar 2020 08:45:12 GMT
Server
Apache
Upgrade
h2
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
text/css
Keep-Alive
timeout=2, max=500
Content-Length
12304
ico_alert@2x.png
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/ico_alert@2x.png
Requested by
Host: theritteragency.com
URL: http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
115dac9e0522a37964cf69e50bc9a9b30edc78aca06ebe3c7f03cc4712b1b357

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/qes.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Last-Modified
Mon, 23 Mar 2020 08:45:12 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=499
Content-Length
1356
header.png
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/images/ 		196 B
196 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/images/header.png
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/toolbar.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=2, max=499
Content-Length
196
Content-Type
text/html; charset=iso-8859-1
EHLbrown@2x.png
theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/images/ 		196 B
196 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/images/EHLbrown@2x.png
Protocol
HTTP/1.1
Server
173.199.181.132 Lansing, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.ponyack.com
Software
Apache /
Resource Hash
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Referer
http://theritteragency.com/master/content/antibing/verification/A50M507748M8B11ED3ED/Sign%20In_files/footer.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 23 Mar 2020 12:23:46 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=2, max=499
Content-Length
196
Content-Type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Domain/Path Name / Value
theritteragency.com/ Name: PHPSESSID
Value: 0qq3js4cg0p5ia8edpo8vq9qn3