nuctects.ga Open in urlscan Pro
91.244.181.13 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://nuctects.ga/
Effective URL:
http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&ses...
Submission: On August 09 via manual (August 9th 2018, 3:06:06 pm UTC) from US

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 91.244.181.13, located in Bulgaria and belongs to NEXTPOINTHOST-AS, BG. The main domain is nuctects.ga.

This is the only time nuctects.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 13	91.244.181.13 91.244.181.13		199129 (NEXTPOINT...) (NEXTPOINTHOST-AS)
13	2

13 91.244.181.13 (Bulgaria) 1 redirects

ASN199129 (NEXTPOINTHOST-AS, BG)
PTR: svm1-vps.nextpointhost.com

nuctects.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	nuctects.ga 1 redirects nuctects.ga	347 KB
0	phishingscripts.com Failed phishingscripts.com Failed
13	2

	Domain	Requested by
13	nuctects.ga	1 redirects nuctects.ga
0	phishingscripts.com Failed	nuctects.ga
13	2

This site contains links to these domains. Also see Links.

Domain
protonmail.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39
Frame ID: 301E4F7382628A7972424D602B7B462E
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://nuctects.ga/ HTTP 302
http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

13
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

347 kB
Transfer

665 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://protonmail.com/blog/protonmail-v3-8-release-notes/
Title: 3.8.4

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://nuctects.ga/ HTTP 302
http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request new.php Show response nuctects.ga/ Redirect Chain http://nuctects.ga/ http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39	12 KB 4 KB	11ms 10ms	Document text/html	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Full URL http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / PHP/5.6.36 Resource Hash `5a41d51578c0fed6a5bde3d468bf23a32b029319e19837fc156cf450d3d8eb20` Request headers Host nuctects.ga Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 301E4F7382628A7972424D602B7B462E Response headers Server nginx Date Thu, 09 Aug 2018 15:03:57 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 X-Powered-By PHP/5.6.36 Content-Encoding gzip Redirect headers Server nginx Date Thu, 09 Aug 2018 15:03:57 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive Keep-Alive timeout=60 X-Powered-By PHP/5.6.36 location new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39
GET H/1.1	200 OK	jquery.min.js Show response nuctects.ga/images/	56 KB 20 KB	10ms 9ms	Script application/javascript	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Full URL http://nuctects.ga/images/jquery.min.js Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Content-Encoding gzip Last-Modified Wed, 08 Aug 2018 13:21:33 GMT Server nginx ETag W/"5b6aee5d-dfa6" Transfer-Encoding chunked Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	script.js Show response nuctects.ga/images/	1005 B 554 B	14ms 7ms	Script application/javascript	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Full URL http://nuctects.ga/images/script.js Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `0add3cfbb9ff0300e80a331e71a9ffea3c842f0dac8c8596d99d2b0f0534d841` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Content-Encoding gzip Last-Modified Wed, 08 Aug 2018 13:21:36 GMT Server nginx ETag W/"5b6aee60-3ed" Transfer-Encoding chunked Content-Type application/javascript Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	combined.css nuctects.ga/images/	25 KB 5 KB	14ms 7ms	Stylesheet text/css	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Full URL http://nuctects.ga/images/combined.css Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `a2896f9f9b7bc254dacabce651f102c661edfab00f2636799c6d23bc6df76d6b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Content-Encoding gzip Last-Modified Wed, 08 Aug 2018 13:21:26 GMT Server nginx ETag W/"5b6aee56-6306" Transfer-Encoding chunked Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	app.css nuctects.ga/index_files/	323 KB 68 KB	30ms 24ms	Stylesheet text/css	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Full URL http://nuctects.ga/index_files/app.css Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `40a96af49dd371dad4b3e875aa31bf5a2604e1ae02a589e273ecd5038ac50775` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Content-Encoding gzip Last-Modified Wed, 08 Aug 2018 13:21:43 GMT Server nginx ETag W/"5b6aee67-50de9" Transfer-Encoding chunked Content-Type text/css Cache-Control max-age=315360000 Connection keep-alive Keep-Alive timeout=60 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	gmail1.png nuctects.ga/index_files/	24 KB 24 KB	6ms 6ms	Image image/png	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/index_files/gmail1.png Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `0d1733d3a3f7ea701f4cb0ab9fa0236d2f71546b489a298db1a0914beeecd975` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:21:57 GMT Server nginx ETag "5b6aee75-5f4a" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 24394 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	yahoo1.png nuctects.ga/index_files/	22 KB 22 KB	7ms 6ms	Image image/png	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/index_files/yahoo1.png Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `acd156930bd2525e6b8c7adff2da83c67c3f8febb85c912392c8ec4c50869ed8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:22:04 GMT Server nginx ETag "5b6aee7c-5893" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 22675 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	hotmail1.png nuctects.ga/index_files/	20 KB 21 KB	7ms 7ms	Image image/png	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/index_files/hotmail1.png Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `b5f46af78715eae110d5bc768ce94799414a30003fadbbbc41f54cac3e36bc11` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:21:59 GMT Server nginx ETag "5b6aee77-51a1" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 20897 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	aol1.png nuctects.ga/index_files/	18 KB 19 KB	7ms 7ms	Image image/png	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/index_files/aol1.png Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `55b07317bd5d5e3f05fac7b12b74b16cde292d94abb3d6ef62b77892960a02e4` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:21:41 GMT Server nginx ETag "5b6aee65-49c5" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 18885 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	other.png nuctects.ga/index_files/	19 KB 19 KB	15ms 7ms	Image image/png	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/index_files/other.png Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `c1f166ef87e837bf77a5f72b99c2729f58f315df99dd838d71060460234806ce` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:22:02 GMT Server nginx ETag "5b6aee7a-4a0e" Content-Type image/png Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 18958 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	office.jpg nuctects.ga/images/	58 KB 58 KB	15ms 7ms	Image image/jpeg	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/images/office.jpg Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `64907bac65b3d6080557dbc26e2cc1ec94433cce8a4b7ad63dcf7ba4b959f948` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:21:34 GMT Server nginx ETag "5b6aee5e-e6ca" Content-Type image/jpeg Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 59082 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET		style.php phishingscripts.com/	0 0

GET H/1.1	200 OK	login.jpg nuctects.ga/index_files/	86 KB 87 KB	6ms 6ms	Image image/jpeg	91.244.181.13 NEXTPOINTHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL http://nuctects.ga/index_files/login.jpg Requested by Host: nuctects.ga URL: http://nuctects.ga/new.php?cmd=login_submit&id=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39&session=c67ba53c240ba612e308678898aadb39c67ba53c240ba612e308678898aadb39 Protocol HTTP/1.1 Server 91.244.181.13 , Bulgaria, ASN199129 (NEXTPOINTHOST-AS, BG), Reverse DNS svm1-vps.nextpointhost.com Software nginx / Resource Hash `dc54162fea475940b906d56bedc3d8f466e2105e7a908c868468c51328ddc10c` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host nuctects.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://nuctects.ga/index_files/app.css Connection keep-alive Cache-Control no-cache Referer http://nuctects.ga/index_files/app.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 09 Aug 2018 15:03:57 GMT Last-Modified Wed, 08 Aug 2018 13:22:00 GMT Server nginx ETag "5b6aee78-15964" Content-Type image/jpeg Cache-Control max-age=315360000 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=60 Content-Length 88420 Expires Thu, 31 Dec 2037 23:55:55 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: phishingscripts.com
URL: http://phishingscripts.com/style.php

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nuctects.ga
phishingscripts.com
phishingscripts.com
91.244.181.13
0add3cfbb9ff0300e80a331e71a9ffea3c842f0dac8c8596d99d2b0f0534d841
0d1733d3a3f7ea701f4cb0ab9fa0236d2f71546b489a298db1a0914beeecd975
40a96af49dd371dad4b3e875aa31bf5a2604e1ae02a589e273ecd5038ac50775
55b07317bd5d5e3f05fac7b12b74b16cde292d94abb3d6ef62b77892960a02e4
5a41d51578c0fed6a5bde3d468bf23a32b029319e19837fc156cf450d3d8eb20
64907bac65b3d6080557dbc26e2cc1ec94433cce8a4b7ad63dcf7ba4b959f948
a2896f9f9b7bc254dacabce651f102c661edfab00f2636799c6d23bc6df76d6b
acd156930bd2525e6b8c7adff2da83c67c3f8febb85c912392c8ec4c50869ed8
b5f46af78715eae110d5bc768ce94799414a30003fadbbbc41f54cac3e36bc11
c1f166ef87e837bf77a5f72b99c2729f58f315df99dd838d71060460234806ce
c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899
dc54162fea475940b906d56bedc3d8f466e2105e7a908c868468c51328ddc10c

nuctects.ga Open in urlscan Pro 91.244.181.13 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

347 kBTransfer

665 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

nuctects.ga Open in urlscan Pro
91.244.181.13 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

347 kB
Transfer

665 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!