priyogaan.com
Open in
urlscan Pro
50.87.248.104
Malicious Activity!
Public Scan
URL:
https://priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/conten...
Submission: On September 05 via automatic, source openphish
Submission: On September 05 via automatic, source openphish
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 15 HTTP transactions.
The main IP is 50.87.248.104, located in
Provo, United States and
belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US.
The main domain is priyogaan.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 8th 2018. Valid for: 3 months.
This is the only time priyogaan.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on July 8th 2018. Valid for: 3 months.
This is the only time priyogaan.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Assurance Maladie (Healthcare)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 50.87.248.104 50.87.248.104 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
| 15 | 2 |
9
50.87.248.104
(Provo, United States)
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box1104.bluehost.com
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box1104.bluehost.com
| priyogaan.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
priyogaan.com
priyogaan.com |
92 KB |
| 0 |
gestyy.com
Failed
gestyy.com Failed |
|
| 15 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | priyogaan.com |
priyogaan.com
|
| 0 | gestyy.com Failed |
priyogaan.com
|
| 15 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| demeanour.net Let's Encrypt Authority X3 |
2018-07-08 - 2018-10-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/content-type.php?assure_nfpb=true&_pageLabel=as_login_page&connexioncompte_2actionEvt=afficher&lieu.x=fr_&82213f982cae57c73a255beb01997022
Frame ID: A3B169A6C1A26937A449B50E5C525D27
Requests: 15 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
content-type.php
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scoure.min.css
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/css/ |
139 KB 27 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scoure.smart.css
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scoure.footer.css
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/css/ |
2 KB 946 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-latest.min.js
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/js/ |
94 KB 38 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.mask.min.js
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/js/ |
8 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Acc_Carding.js
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/js/ |
3 KB 790 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scourelogo.png
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/img/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
franceconnect.png
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/img/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
glyphicons-halflings-regular.woff2
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
wJvYsb
gestyy.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
glyphicons-halflings-regular.woff
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
wJvYsb
gestyy.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
glyphicons-halflings-regular.ttf
priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
wJvYsb
gestyy.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- priyogaan.com
- URL
- https://priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/fonts/glyphicons-halflings-regular.woff2
- Domain
- gestyy.com
- URL
- http://gestyy.com/wJvYsb
- Domain
- priyogaan.com
- URL
- https://priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/fonts/glyphicons-halflings-regular.woff
- Domain
- gestyy.com
- URL
- http://gestyy.com/wJvYsb
- Domain
- priyogaan.com
- URL
- https://priyogaan.com/Pagewebs/ameli.fr-acces.groupe.client-e-docs/aspx=information_109A6/maladie/remboursement/lib/fonts/glyphicons-halflings-regular.ttf
- Domain
- gestyy.com
- URL
- http://gestyy.com/wJvYsb
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Assurance Maladie (Healthcare)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| $jscomp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gestyy.com
priyogaan.com
gestyy.com
priyogaan.com
50.87.248.104
1f600cd3d9f20664ca63424e6702682a9b1f17e3e7d4e473102794c26e6f47f7
24929f21b2ea462090f21f4b6e62b6cbd6ae4ea88a7ad52fe51364313a655813
3498297c12089ddc4341fde707d5e94697bc0a435640a726aed5121914609a10
4d39e17853f9f2ba045561faf35e8a7e26b79924a64b634360db02a57fdaca91
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
797eea4e45fca81bf4452aaac4b066278a3307023826afa058ee5dc4cbdc8f08
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
bfd78bdb641eb1ad45d158018a271e00eef3d1a75eb638efa8942e217d50dff6
d1f2c9c4df9ef625fca6bfe497939cc79edf3ae96237d4c0635bc5abc3535beb