webdemonstration.bid Open in urlscan Pro
198.57.150.190  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://bareilly.jigsawabacus.com/.well-known/redirect.php Page URL
2. https://webdemonstration.bid/bizcms/.quarantine/C_Update.htm?email= Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	redirect.php bareilly.jigsawabacus.com/.well-known/	418 B 547 B	1229ms 223ms	Document text/html	43.231.127.174 EVERDATA-DATACENT...
General Check archive.org Show headers Download Go to Full URL https://bareilly.jigsawabacus.com/.well-known/redirect.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 43.231.127.174 , India, ASN56110 (EVERDATA-DATACENTERS Everdata Technologies Pvt Ltd, IN), Reverse DNS Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 22 Jan 2024 08:42:54 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	Primary Request C_Update.htm Show response webdemonstration.bid/bizcms/.quarantine/	1 KB 781 B	1011ms 259ms	Document text/html	198.57.150.190 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://webdemonstration.bid/bizcms/.quarantine/C_Update.htm?email= Requested by Host: bareilly.jigsawabacus.com URL: https://bareilly.jigsawabacus.com/.well-known/redirect.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.57.150.190 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS absch.cl Software nginx/1.21.6 / Resource Hash 1295c6368240c8e063a0812161e0a65fd421eb07ee6a4c0c76c194a890a6fe5f Request headers Referer https://bareilly.jigsawabacus.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers accept-ranges bytes content-encoding gzip content-length 644 content-type text/html date Mon, 22 Jan 2024 08:42:55 GMT last-modified Fri, 19 Jan 2024 12:39:47 GMT server nginx/1.21.6 vary Accept-Encoding x-server-cache false
GET H2	200	jquery.js Show response elim.impressionstechnology.com/.quarantine/	28 KB 7 KB	944ms 207ms	Script text/javascript	192.254.236.206 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://elim.impressionstechnology.com/.quarantine/jquery.js Requested by Host: webdemonstration.bid URL: https://webdemonstration.bid/bizcms/.quarantine/C_Update.htm?email= Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.254.236.206 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS peoplemattersupport.co.uk Software Apache / Resource Hash 2d714b6b7c293da07bedd2dbda91cfe3db8c31a666fe8e0b340772dabd3ed800 Request headers Referer https://webdemonstration.bid/ accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 22 Jan 2024 08:42:56 GMT content-encoding gzip last-modified Wed, 17 Jan 2024 11:13:15 GMT server Apache vary Accept-Encoding content-type text/javascript accept-ranges bytes content-length 7477
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	147ms 43ms	Script application/javascript	2a04:4e42:200::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: elim.impressionstechnology.com URL: https://elim.impressionstechnology.com/.quarantine/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://webdemonstration.bid/ Origin https://webdemonstration.bid accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 22 Jan 2024 08:42:56 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 5310359 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-lcy-eglc8600056-LCY last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1705912976.409689,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 5, 890498
GET H2	200	ffTjWfv.png i.imgur.com/	1 KB 2 KB	166ms 54ms	Image image/png	146.75.120.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/ffTjWfv.png Requested by Host: elim.impressionstechnology.com URL: https://elim.impressionstechnology.com/.quarantine/jquery.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 09a2748730d6feb7a146d76c6cdfedd2d5394d63f908058fa8adaf29810bf849 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://webdemonstration.bid/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 08:42:56 GMT strict-transport-security max-age=300 x-content-type-options nosniff x-amz-cf-pop JFK50-P6 age 4134983 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront, HIT, HIT content-length 1425 x-served-by cache-iad-kjyo7100117-IAD, cache-fra-etou8220070-FRA last-modified Sun, 03 Dec 2023 02:45:29 GMT server cat factory 1.0 x-timer S1705912976.423110,VS0,VE1 etag "9b61cfa60e3a5813c2e5312142dacb37" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-amz-cf-id yyI07Ds5I_WbTU4w4_dM0bXcEQp6O-g2zt33lW6MvWJphqSChH7EfQ== x-cache-hits 796, 1
GET H2	200	4R3ihSa.png i.imgur.com/	135 KB 136 KB	54ms 54ms	Image image/png	146.75.120.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/4R3ihSa.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash ffdf9b07597e8a8b26abaa3574ce1fc102e6f9e26ddb0afba7a117ed78fc14f9 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://webdemonstration.bid/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36 Response headers date Mon, 22 Jan 2024 08:42:56 GMT strict-transport-security max-age=300 x-content-type-options nosniff x-amz-cf-pop JFK50-P6 age 1551527 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront, HIT, HIT content-length 138577 x-served-by cache-iad-kcgs7200114-IAD, cache-fra-etou8220070-FRA last-modified Sun, 03 Dec 2023 02:50:05 GMT server cat factory 1.0 x-timer S1705912976.486687,VS0,VE2 etag "b8c8b56f2a2a026a4213e230a02ab134" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-amz-cf-id yUzUvLD4SlkDJ6PsXlrwIkKnrQSxpFhXTAtaQHmkdR8gGPNLHdkh1A== x-cache-hits 298, 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: TSB Bank (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x2ecb function| _0x4b388b function| _0x1195 string| btokenbot string| chatidchat string| queryControlBase64 function| _0x32d4 function| _0x20e3 function| $ function| jQuery function| _0x3868 function| _0x29c4 function| _0x3eb682

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://webdemonstration.bid/bizcms/.quarantine/C_Update.htm?email=(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://elim.impressionstechnology.com/.quarantine/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://webdemonstration.bid/bizcms/.quarantine/C_Update.htm?email=(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://elim.impressionstechnology.com/.quarantine/jquery.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://elim.impressionstechnology.com/.quarantine/jquery.js(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://elim.impressionstechnology.com/.quarantine/jquery.js(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bareilly.jigsawabacus.com
code.jquery.com
elim.impressionstechnology.com
i.imgur.com
webdemonstration.bid
146.75.120.193
192.254.236.206
198.57.150.190
2a04:4e42:200::649
43.231.127.174
09a2748730d6feb7a146d76c6cdfedd2d5394d63f908058fa8adaf29810bf849
1295c6368240c8e063a0812161e0a65fd421eb07ee6a4c0c76c194a890a6fe5f
2d714b6b7c293da07bedd2dbda91cfe3db8c31a666fe8e0b340772dabd3ed800
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ffdf9b07597e8a8b26abaa3574ce1fc102e6f9e26ddb0afba7a117ed78fc14f9