nghereviewer.com Open in urlscan Pro
103.130.216.91  Malicious Activity! Public Scan

URL: https://nghereviewer.com/
Submission: On September 19 via manual from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 103.130.216.91, located in Viet Nam and belongs to WEBICO-AS-VN Webico Company Limited, VN. The main domain is nghereviewer.com.
TLS certificate: Issued by R3 on July 28th 2023. Valid for: 3 months.
This is the only time nghereviewer.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Industrial (Banking)

Domain & IP information

IP Address AS Autonomous System
1 103.130.216.91 135951 (WEBICO-AS...)
1 2
Apex Domain
Subdomains
Transfer
1 nghereviewer.com
nghereviewer.com
74 KB
1 1
Domain Requested by
1 nghereviewer.com
1 1

This site contains no links.

Subject Issuer Validity Valid
webmail.nghereviewer.com
R3
2023-07-28 -
2023-10-26
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nghereviewer.com/
Frame ID: F48E6148EF3C7ACFBC6E05D11F6FD33A
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Personas

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

74 kB
Transfer

351 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
nghereviewer.com/
274 KB
74 KB
Document
General
Full URL
https://nghereviewer.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.130.216.91 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),
Reverse DNS
h21691.hosthub.vn
Software
LiteSpeed / PHP/7.4.33
Resource Hash
c9ce70c124c592c1e0dd121d5b2dab9f78e6570da36ae7925d28dcf2b5bf7ffa
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control
no-store, no-cache, must-revalidate
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 19 Sep 2023 19:09:52 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
LiteSpeed
vary
Accept-Encoding,Accept-Encoding
x-frame-options
SAMEORIGIN
x-powered-by
PHP/7.4.33
truncated
/
5 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d6fb8d92d5dddf6cee5444c711c3c95c82bfbe5706cd5cc22f9ccda90f0bb8ed

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
13 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01482b67187d42fce4fab2a659e410ba772dadec51b6abfd60f32ef8c687af85

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
59 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
28c73a1e2f206689c589dbf37b54598505193389a091dca638b18e2e408084ae

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

Content-Type
image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Industrial (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| gtfrms

1 Cookies

Domain/Path Name / Value
nghereviewer.com/ Name: PHPSESSID
Value: 26bcfd058eb855d72403aea832a02db2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN