praavahealth.com
Open in
urlscan Pro
209.97.169.230
Malicious Activity!
Public Scan
URL:
https://praavahealth.com/attendance/build/less/skins/sec/1/index.php
Submission: On July 25 via automatic, source phishtank
Submission: On July 25 via automatic, source phishtank
Summary
This website contacted 1 IPs
in 1 countries
across 1 domains to perform 7 HTTP transactions.
The main IP is 209.97.169.230, located in
Singapore, Singapore and
belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US.
The main domain is praavahealth.com.
TLS certificate: Issued by GeoTrust RSA CA 2018 on July 22nd 2019. Valid for: a year.
This is the only time praavahealth.com was scanned on urlscan.io!
TLS certificate: Issued by GeoTrust RSA CA 2018 on July 22nd 2019. Valid for: a year.
This is the only time praavahealth.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 7 | 209.97.169.230 209.97.169.230 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
| 7 | 1 |
7
209.97.169.230
(Singapore, Singapore)
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: srv.sparkitbd.com
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
PTR: srv.sparkitbd.com
| praavahealth.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 7 |
praavahealth.com
praavahealth.com |
893 KB |
| 7 | 1 |
| Domain | Requested by | |
|---|---|---|
| 7 | praavahealth.com |
praavahealth.com
|
| 7 | 1 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| praavahealth.com GeoTrust RSA CA 2018 |
2019-07-22 - 2020-07-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://praavahealth.com/attendance/build/less/skins/sec/1/index.php
Frame ID: 9677732CE7AAB585256ADF30AD007F5C
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.php
praavahealth.com/attendance/build/less/skins/sec/1/ |
4 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hok.js
praavahealth.com/attendance/build/less/skins/sec/1/imagess/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
01.png
praavahealth.com/attendance/build/less/skins/sec/1/images/ |
653 KB 654 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
baz64.PNG
praavahealth.com/attendance/build/less/skins/sec/1/images/ |
33 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hex.PNG
praavahealth.com/attendance/build/less/skins/sec/1/images/ |
93 KB 93 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jagoeihgoea.PNG
praavahealth.com/attendance/build/less/skins/sec/1/images/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jnladnjageg.PNG
praavahealth.com/attendance/build/less/skins/sec/1/images/ |
66 KB 66 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
praavahealth.com
209.97.169.230
124c9f8ac2f21d4fa788907ba637025d99ea6f1a402ba6368ef49ff344c86e1e
1722feb14b8ea1f9d5632ab4d66fb3cfd1a6b117d87f63b2ddceb714498ba432
4787525a5e4549278e142c3b5f73c44f15edaeecc344e42a6e89168357d91005
79ba5d277b2a401978b7e69e5d3f753c06765d7be4648f24bb268339066bc14c
ae0f696ddb15be488434eca79da639011938866d46d3fe79a16afb1b4fc70063
b54ea2e3e198b734fda79e265a4e15ef119ee6b3d4bced96b99239dddbb4c13f
cc18edcf98595fea95da9cfb1165aeda05c93f0f30c70b61ac428e79249c9617