urlscan.io logo urlscan.io
SecurityTrails logo

ip168.ip-145-239-39.eu Open in urlscan Pro
145.239.39.168  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Submission Tags: @ipnigh
Submission: On October 11 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 145.239.39.168, located in France and belongs to OVH, FR. The main domain is ip168.ip-145-239-39.eu.
This is the only time ip168.ip-145-239-39.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

IP Address AS Autonomous System
11 145.239.39.168 16276 (OVH)
11 1
Apex Domain
Subdomains		 Transfer
11 ip-145-239-39.eu
ip168.ip-145-239-39.eu
182 KB
11 1
Domain Requested by
11 ip168.ip-145-239-39.eu ip168.ip-145-239-39.eu
11 1

This site contains links to these domains. Also see Links.

Domain
www.bankofamerica.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Frame ID: 43925907A694A6EF994B0C9E46C651A8
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

182 kB
Transfer

559 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set profile.php
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/ 		10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
4b326b23ca4def2201b1a55f4f8da939b7ad1a0aad2be381331f8b8099734f9c

Request headers

Host
ip168.ip-145-239-39.eu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:11 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=iletg7duab05q3vf8vo16tspi2; path=/
Vary
Accept-Encoding
Content-Encoding
gzip
Referrer-Policy
no-referrer-when-downgrade
Content-Length
3520
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
login.css
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		133 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.css
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
092f0fd4ebf0542f944fb3ff4d704bfc308daf374efd1bfe5d7f37e2ac62060c

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Content-Encoding
gzip
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:36 GMT
Server
Apache
ETag
"2124d-5944a3bd72700-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
21043
Expires
Sat, 10 Oct 2020 12:27:12 GMT
login.js
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		355 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.js
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
07e4c753ffc2eb5b218c8f022406951f1c052771ffe9b22aecff0e705f4c13f8

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Content-Encoding
gzip
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:42 GMT
Server
Apache
ETag
"58a44-5944a3c32b480-gzip"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
max-age=31536000
Transfer-Encoding
chunked
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Expires
Sat, 10 Oct 2020 12:27:12 GMT
LOGO.gif
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/LOGO.gif
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
0509ef5fb3dad7001f5095ebe63933dff0e0d113045e696ed16ff46ce5af8c72

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:36 GMT
Server
Apache
ETag
"e0c-5944a3bd72700"
Content-Type
image/gif
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3596
Expires
Sat, 10 Oct 2020 12:27:12 GMT
secure.png
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		473 B
859 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/secure.png
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
8c37fb372596058d87dd9208541c49b020d0e840e4f3a5baa27d39be2dc70b01

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:40 GMT
Server
Apache
ETag
"1d9-5944a3c143000"
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
473
Expires
Sat, 10 Oct 2020 12:27:12 GMT
summary-bground.jpg
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/summary-bground.jpg
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
b6ee8873f150ce4d82208a5c59a52da723b5a1f3d01b7e12afe734080a52b83d

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Transfer-Encoding
chunked
Content-Type
text/html
fsd-arrows.png
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		246 B
631 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/fsd-arrows.png
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.js
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
ec8a7b5d27dd9c4cd59db1c74a73aec065c0660675f7ef26f300ab49e4bb5825

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:36 GMT
Server
Apache
ETag
"f6-5944a3bd72700"
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
246
Expires
Sat, 10 Oct 2020 12:27:12 GMT
gfootb.png
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		48 KB
48 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/gfootb.png
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.js
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
ca3205c6a4eecfd67ad990b62b10e19f601230a2a5b2791676089e82836763f4

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:34 GMT
Server
Apache
ETag
"be1b-5944a3bb8a280"
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
48667
Expires
Sat, 10 Oct 2020 12:27:12 GMT
gfoot-home.png
ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/ 		144 B
529 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/gfoot-home.png
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.js
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
a8bc6337547a246ef75d1ae66d7ec8a0ed6171c1ba49804a403124e27c8e8452

Request headers

Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 07 Oct 2019 04:10:34 GMT
Server
Apache
ETag
"90-5944a3bb8a280"
Content-Type
image/png
Cache-Control
max-age=31536000
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
144
Expires
Sat, 10 Oct 2020 12:27:12 GMT
cnx-regular.woff
ip168.ip-145-239-39.eu/pa/global-assets/1.0/font/cnx-regular/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://ip168.ip-145-239-39.eu/pa/global-assets/1.0/font/cnx-regular/cnx-regular.woff
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/imgs/login.js
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Origin
http://ip168.ip-145-239-39.eu

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Transfer-Encoding
chunked
Content-Type
text/html
cnx-regular.ttf
ip168.ip-145-239-39.eu/pa/global-assets/1.0/font/cnx-regular/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://ip168.ip-145-239-39.eu/pa/global-assets/1.0/font/cnx-regular/cnx-regular.ttf
Requested by
Host: ip168.ip-145-239-39.eu
URL: http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Protocol
HTTP/1.1
Server
145.239.39.168 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://ip168.ip-145-239-39.eu/~mehwishg/ssc/en/en/profile.php?errors=1
Origin
http://ip168.ip-145-239-39.eu

Response headers

Date
Fri, 11 Oct 2019 12:27:12 GMT
Server
Apache
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Transfer-Encoding
chunked
Content-Type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

96 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| boaVIPAAjawrEnabled object| boa function| windowSetup function| displayPopup function| boaLangSetup function| boaLocationReplace function| boaEqualHeight function| boaEqualWidth function| boaCenterAlign function| boaVerCheck function| boaTLUIFieldValidationError function| boaTLAddCustomEvent function| boaTLAddEvent function| dartFireOnClick function| dartFireOnClickWithoutNumParam function| dartFireOnClickSpecial function| boaOBORestricted function| asyncPrintCssInclude object| selectBofa object| cfLoader object| SessionTimeout function| setFlexLayoutFooterHeight number| flexLayoutFooterHeightOriginal number| flexLayoutCenterContentHeightOriginal object| $flexLayoutFooterDiv object| $flexLayoutFooterInner boolean| isIE boolean| isWin boolean| isOpera function| ControlVersion function| GetSwfVer function| DetectFlashVer function| AC_AddExtension function| AC_Generateobj function| AC_FL_RunContent function| AC_GetArgs string| SEP string| PAIR function| PM_FP_activeXDetect function| PM_FP_stripIllegalChars function| PM_FP_stripFullPath object| PM_FP_BrowserDetect function| PM_FP_FingerPrint function| Hashtable function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| add_deviceprint function| PM_FP_urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_deviceprint_sk function| getBrowserType function| addPassMarkFlash2 number| requiredMajorVersion number| requiredMinorVersion number| requiredRevision string| src string| width string| height string| application string| bgcolor function| showWidget string| spwSafePassNonFlashUrl string| spwPageCode string| spwFormName string| spwDeviceIndex string| spwExpand string| spwDivId number| spwProgressBarEachPercent string| spwContainerID undefined| spwScriptNode undefined| spwLinkNode function| showNonFlashWidget object| spwProgressBar function| isBrowserIE function| isBrowserOpera function| getVersionString function| isExternalInterfaceCompatible function| isWidgetCompatible function| isSitekeyWidgetCompatible string| $errorMessageContent object| $quickHelpBoaLangObj function| $ function| jQuery object| input object| theBody string| quickHelpRequestURL object| $boaLangObj string| browserFullVersion string| browserClass object| $flexBottomRow object| $quickHelp

1 Cookies

Domain/Path Name / Value
ip168.ip-145-239-39.eu/ Name: PHPSESSID
Value: iletg7duab05q3vf8vo16tspi2