www.rugbystore.shop
Open in
urlscan Pro
212.83.190.34
Malicious Activity!
Public Scan
URL:
http://www.rugbystore.shop/wa/homes/billing.php?ip=185.220.101.66
Submission: On November 28 via automatic, source openphish
Submission: On November 28 via automatic, source openphish
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 6 HTTP transactions.
The main IP is 212.83.190.34, located in
La Bathie, France and
belongs to Online SAS, FR.
The main domain is www.rugbystore.shop.
This is the only time www.rugbystore.shop was scanned on urlscan.io!
This is the only time www.rugbystore.shop was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Netflix (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 4 | 212.83.190.34 212.83.190.34 | 12876 (Online SAS) (Online SAS) | |
| 2 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN - Netflix Streaming Services Inc.) | |
| 6 | 2 |
4
212.83.190.34
(La Bathie, France)
ASN12876 (Online SAS, FR)
PTR: 212-83-190-34.rev.poneytelecom.eu
ASN12876 (Online SAS, FR)
PTR: 212-83-190-34.rev.poneytelecom.eu
| www.rugbystore.shop |
2
2a00:86c0:2091::1
(United Kingdom)
ASN40027 (NETFLIX-ASN - Netflix Streaming Services Inc., US)
ASN40027 (NETFLIX-ASN - Netflix Streaming Services Inc., US)
| assets.nflxext.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
rugbystore.shop
www.rugbystore.shop |
32 KB |
| 2 |
nflxext.com
assets.nflxext.com |
80 KB |
| 6 | 2 |
| Domain | Requested by | |
|---|---|---|
| 4 | www.rugbystore.shop |
www.rugbystore.shop
|
| 2 | assets.nflxext.com | |
| 6 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.1.nflxso.net DigiCert SHA2 Secure Server CA |
2019-11-06 - 2019-12-09 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.rugbystore.shop/wa/homes/billing.php?ip=185.220.101.66
Frame ID: 86DC5F29C64C97E1C1BA8EC7373B7DD7
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Ubuntu
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Ubuntu/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
billing.php
www.rugbystore.shop/wa/homes/ |
11 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
hok.js
www.rugbystore.shop/wa/homes/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
b.css
www.rugbystore.shop/wa/homes/css/ |
47 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
c.css
www.rugbystore.shop/wa/homes/css/ |
45 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
carrot_sprite_16x33.png
assets.nflxext.com/en_us/layout/ecweb/common/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nf-icon-v1-80.woff
assets.nflxext.com/ffe/siteui/fonts/ |
78 KB 78 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Netflix (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| Aes object| Base64 object| Utf8 string| hea2p string| hea2t string| output string| ctrTxt0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
www.rugbystore.shop
212.83.190.34
2a00:86c0:2091::1
1f24e58ff9d53d36818697d994c3fc7e3c4fb7191d5769c3c74fde80b72637a1
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
698b6be2d6d9c0302d13ff00cd503fd93c5a8ea57060626fefa013375efeb2ae
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
8d15ec80cea1636491bfea0698be262c710303e7390b6c1f629cf368435e9f5b
a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b