ankasfashion4kids.com Open in urlscan Pro
31.14.23.89  Malicious Activity! Public Scan

Submitted URL: https://ankasfashion4kids.com/wp-content/red/
Effective URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuE...
Submission: On May 18 via manual from ES

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 31.14.23.89, located in Romania and belongs to GTSCE GTS Central Europe / Antel Germany, CZ. The main domain is ankasfashion4kids.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 15th 2020. Valid for: 3 months.
This is the only time ankasfashion4kids.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

IP Address AS Autonomous System
10 31.14.23.89 5588 (GTSCE GTS...)
10 2
Apex Domain
Subdomains
Transfer
10 ankasfashion4kids.com
ankasfashion4kids.com
83 KB
10 1
Domain Requested by
10 ankasfashion4kids.com ankasfashion4kids.com
10 1

This site contains no links.

Subject Issuer Validity Valid
ankasfashion4kids.com
cPanel, Inc. Certification Authority
2020-05-15 -
2020-08-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Frame ID: 77A82B1A916BA2C669B8304D4C98174D
Requests: 11 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://ankasfashion4kids.com/wp-content/red/ Page URL
  2. https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

83 kB
Transfer

216 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ankasfashion4kids.com/wp-content/red/ Page URL
  2. https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
ankasfashion4kids.com/wp-content/red/
229 B
461 B
Document
General
Full URL
https://ankasfashion4kids.com/wp-content/red/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash

Request headers

:method
GET
:authority
ankasfashion4kids.com
:scheme
https
:path
/wp-content/red/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
set-cookie
PHPSESSID=2bgv01umpqahmolfuhbuhk8bu4; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
content-length
216
content-encoding
gzip
date
Mon, 18 May 2020 00:04:58 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
Primary Request Login.php
ankasfashion4kids.com/wp-content/red/
41 KB
27 KB
Document
General
Full URL
https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
100d144549d59dfea16ae7378c93a3ad753976d43de43ec356910e66b6171891

Request headers

:method
GET
:authority
ankasfashion4kids.com
:scheme
https
:path
/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://ankasfashion4kids.com/wp-content/red/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
PHPSESSID=2bgv01umpqahmolfuhbuhk8bu4
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ankasfashion4kids.com/wp-content/red/

Response headers

status
200
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
content-encoding
gzip
date
Mon, 18 May 2020 00:04:58 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
main.css
ankasfashion4kids.com/wp-content/red/assets/css/
104 KB
15 KB
Stylesheet
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/css/main.css
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
b55a0911869a37b7d28b80dab20ccc3ff25fa11c4b42259f30ea75a1641a5ee4

Request headers

Referer
https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
content-encoding
br
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
15706
expires
Tue, 18 May 2021 06:04:58 GMT
hw0
ankasfashion4kids.com/wp-content/red/Login_files/
0
0
Script
General
Full URL
https://ankasfashion4kids.com/wp-content/red/Login_files/hw0
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash

Request headers

Referer
https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 18 May 2020 00:04:58 GMT
content-encoding
br
server
LiteSpeed
link
<https://ankasfashion4kids.com/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache
hit
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
404
cache-control
no-transform, no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
22969
expires
Wed, 11 Jan 1984 05:00:00 GMT
ico_help.gif
ankasfashion4kids.com/wp-content/red/assets/img/
834 B
883 B
Image
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/img/ico_help.gif
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
555c7c69be583638ac6885e8245cc9a3bcc14b131636180833954d7b997b9aa4

Request headers

Referer
https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
content-type
image/gif
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
834
expires
Tue, 18 May 2021 06:04:58 GMT
truncated
/
26 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19d199821490b6ebd7245be0d4b3fe3c5f65657b6a934a54de2504c77a6261f5

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/png
ico_lockSmallWhite.svg
ankasfashion4kids.com/wp-content/red/assets/img/
1 KB
763 B
Image
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/img/ico_lockSmallWhite.svg
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
3ccf95af185c5424f2712eb833f77bbc7b34113e520cb8114d3beb28b8e6eebc

Request headers

Referer
https://ankasfashion4kids.com/wp-content/red/assets/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
content-encoding
br
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
708
expires
Tue, 18 May 2021 06:04:58 GMT
logo.svg
ankasfashion4kids.com/wp-content/red/assets/img/
6 KB
2 KB
Image
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/img/logo.svg
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
2d2e43923f37779a866c3f4769511065163657761f8d0bfb55a9101473c9de9c

Request headers

Referer
https://ankasfashion4kids.com/wp-content/red/assets/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
content-encoding
br
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
2249
expires
Tue, 18 May 2021 06:04:58 GMT
001.woff
ankasfashion4kids.com/wp-content/red/assets/fonts/
20 KB
20 KB
Font
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/fonts/001.woff
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
f7c3c00549fdb20fa48e7b87575ad272f0bf2aeb5165158fc5a7e4a7a628e0f5

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ankasfashion4kids.com/wp-content/red/assets/css/main.css
Origin
https://ankasfashion4kids.com

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
content-type
font/woff
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
20900
expires
Tue, 18 May 2021 06:04:58 GMT
ico_help.svg
ankasfashion4kids.com/wp-content/red/assets/img/
2 KB
1011 B
Image
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/img/ico_help.svg
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
b4eb8dbf6c22c2aab173ffd8303bdcc9435558b1ba182cee3aff8e56007f70a1

Request headers

Referer
https://ankasfashion4kids.com/wp-content/red/assets/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
content-encoding
br
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
968
expires
Tue, 18 May 2021 06:04:58 GMT
002.woff
ankasfashion4kids.com/wp-content/red/assets/fonts/
14 KB
14 KB
Font
General
Full URL
https://ankasfashion4kids.com/wp-content/red/assets/fonts/002.woff
Requested by
Host: ankasfashion4kids.com
URL: https://ankasfashion4kids.com/wp-content/red/Login.php?sslchannel=true&form=AccountVerification&sessionid=K01ufar0JFUsRxtARxuEAHzsO9flOaPzaQ3p1vqLbld2THDLe7pPOZiD9xYXHOxSEAiG6Jrh4EjYlWJA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
31.14.23.89 , Romania, ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ),
Reverse DNS
frontiersistem.ro
Software
LiteSpeed /
Resource Hash
d0e4af782fbda59555e0477a23be08bac76f32490724128b5ec80272a640daf1

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://ankasfashion4kids.com/wp-content/red/assets/css/main.css
Origin
https://ankasfashion4kids.com

Response headers

date
Mon, 18 May 2020 00:04:58 GMT
last-modified
Sat, 23 Jan 2016 11:33:00 GMT
server
LiteSpeed
content-type
font/woff
status
200
cache-control
public, max-age=31557600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
14516
expires
Tue, 18 May 2021 06:04:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Domain/Path Name / Value
ankasfashion4kids.com/ Name: PHPSESSID
Value: 2bgv01umpqahmolfuhbuhk8bu4