fevreka.com
Open in
urlscan Pro
176.98.40.88
Malicious Activity!
Public Scan
Submitted URL: https://fevreka.com/QPWO/new.php
Effective URL: https://fevreka.com/QPWO/2.php?session=65cc5e0a96903
Submission: On February 14 via manual from NL — Scanned from NL
Effective URL: https://fevreka.com/QPWO/2.php?session=65cc5e0a96903
Submission: On February 14 via manual from NL — Scanned from NL
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 11 HTTP transactions.
The main IP is 176.98.40.88, located in
Turkey and
belongs to .
The main domain is fevreka.com.
TLS certificate: Issued by R3 on December 29th 2023. Valid for: 3 months.
This is the only time fevreka.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 29th 2023. Valid for: 3 months.
This is the only time fevreka.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: International Card Services (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 176.98.40.88 176.98.40.88 | () () | |
| 1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
| 11 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
fevreka.com
fevreka.com |
119 KB |
| 1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 434 |
31 KB |
| 1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 257 |
5 KB |
| 11 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | fevreka.com |
fevreka.com
|
| 1 | ajax.googleapis.com |
fevreka.com
|
| 1 | cdnjs.cloudflare.com |
fevreka.com
|
| 11 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| fevreka.com R3 |
2023-12-29 - 2024-03-28 |
3 months | crt.sh |
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
| upload.video.google.com GTS CA 1C3 |
2024-01-29 - 2024-04-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fevreka.com/QPWO/2.php?session=65cc5e0a96903
Frame ID: 51CE3A9F8944783E0608D5C87D5D6DB2
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://fevreka.com/QPWO/new.php Page URL
- https://fevreka.com/QPWO/2.php?session=65cc5e0a96903 Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Axios
(JavaScript libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://fevreka.com/QPWO/new.php Page URL
- https://fevreka.com/QPWO/2.php?session=65cc5e0a96903 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
new.php
fevreka.com/QPWO/ |
91 B 441 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
2.php
fevreka.com/QPWO/ |
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bootstrap.min.css
fevreka.com/QPWO/css2/ |
159 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.css
fevreka.com/QPWO/css2/ |
3 KB 933 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
logo.svg
fevreka.com/QPWO/img/ |
12 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SunOT-Regular.woff2
fevreka.com/QPWO/css2/fonts/ |
27 KB 27 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icons.woff
fevreka.com/QPWO/css2/fonts/ |
11 KB 11 KB |
Font
x-font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SunOT-Light.woff2
fevreka.com/QPWO/css2/fonts/ |
27 KB 27 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
SunOT-SemiBold.woff2
fevreka.com/QPWO/css2/fonts/ |
27 KB 27 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: International Card Services (Financial)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| axios function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| fevreka.com/ | Name: PHPSESSID Value: 828dc510f5864e09edebc88119f073bd |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
fevreka.com
176.98.40.88
2606:4700::6811:180e
2a00:1450:4001:811::200a
0c1a127d9d0097a2459b13c9b28c764baf2453925b9272e0dd866bc5982aed4b
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
33614fb78d209168a3a4cd90bcc0af25e3982e9ef5c2aa192daeb02812ed4137
4954682d5d7c93b356e5999ec80baa32b9f59eb1f0c61c4834a4c1efa46640ed
5d5843756588d13ca7dc96d8a53b72476126756dbae2f58e446f609bf9308d02
910897ec77032d0a11794e948e064a7987ec4f82b1230de7cc29c3c6e55880e3
9c0c1ee6fe664464f2702f3ece60682252d922da056ecc4d240079be8a37a711
b0071cd7ccef32768966b353e2ff09d13e07ab31148944e5545803232c2341e9
c1f3874cc3f5467a309962d1f127dc7c0f5bfdba58e6084a779d4dacefcefb8d
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d