sh014.hostgator.tempwebhost.net Open in urlscan Pro
162.241.123.26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bit.ly/3tHP8fl
Effective URL:
http://sh014.hostgator.tempwebhost.net/~kokycsaf/
Submission: On March 29 via manual (March 29th 2022, 8:28:29 am UTC) from IN — Scanned from DE

Summary HTTP 8 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 162.241.123.26, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is sh014.hostgator.tempwebhost.net.

This is the only time sh014.hostgator.tempwebhost.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 9	162.241.123.26 162.241.123.26	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
8	1

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 162.241.123.26 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: sh014.hostgator.in

sh014.hostgator.tempwebhost.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tempwebhost.net 1 redirects sh014.hostgator.tempwebhost.net	342 KB
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 2583	362 B
8	2

	Domain	Requested by
9	sh014.hostgator.tempwebhost.net	1 redirects sh014.hostgator.tempwebhost.net
1	bit.ly	1 redirects
8	2

This site contains links to these domains. Also see Links.

Domain
retail.onlinesbi.com
play.google.com
apps.apple.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://sh014.hostgator.tempwebhost.net/~kokycsaf/
Frame ID: B9CC644EE75FCC3CC72A05AB6917A176
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

State Bank Of India-KYC/login

Page URL History Show full URLs

http://bit.ly/3tHP8fl HTTP 301
http://sh014.hostgator.tempwebhost.net/~kokycsaf HTTP 301
http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Page URL

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

342 kB
Transfer

344 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://retail.onlinesbi.com/preretail/lockunlockuseraccess.htm
Title: Lock Access

Search URL Search Domain Scan URL

URL: https://retail.onlinesbi.com/retail/troubleloginhome.htm?bankCode=0
Title: Forgot Password

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.sbi.SBIFreedomPlus

Search URL Search Domain Scan URL

URL: https://apps.apple.com/in/developer/state-bank-of-india/id503784436

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.ly/3tHP8fl HTTP 301
http://sh014.hostgator.tempwebhost.net/~kokycsaf HTTP 301
http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response sh014.hostgator.tempwebhost.net/~kokycsaf/ Redirect Chain http://bit.ly/3tHP8fl http://sh014.hostgator.tempwebhost.net/~kokycsaf http://sh014.hostgator.tempwebhost.net/~kokycsaf/	6 KB 2 KB	136ms 135ms	Document text/html	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `3248e607159c58d7a76db3f1d68e9e8794dccb6a5dd0ff67a5a9730374056dc2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Server Apache Last-Modified Mon, 28 Mar 2022 09:35:36 GMT Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 1985 Keep-Alive timeout=5, max=74 Connection Keep-Alive Content-Type text/html Redirect headers Date Tue, 29 Mar 2022 08:28:23 GMT Server Apache Location http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Content-Length 257 Keep-Alive timeout=5, max=75 Connection Keep-Alive Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	removeBanner.js Show response sh014.hostgator.tempwebhost.net/~kokycsaf/	172 B 446 B	133ms 133ms	Script application/javascript	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/removeBanner.js Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `19ec723f0ad7fe719bb2a3259b085d4e21195dd3d1abc91d18c13d098b7610c6` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Content-Encoding gzip Last-Modified Mon, 28 Mar 2022 09:35:37 GMT Server Apache Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=73 Content-Length 145
GET H/1.1	200 OK	second.jpeg sh014.hostgator.tempwebhost.net/~kokycsaf/	76 KB 76 KB	261ms 133ms	Image image/jpeg	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/second.jpeg Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `77bd641dab78f2d471f894653cb7fc3f8c021c91b2df66ecba074d7e3944cfdb` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Last-Modified Mon, 28 Mar 2022 09:35:37 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/jpeg Keep-Alive timeout=5, max=75 Content-Length 77711
GET H/1.1	200 OK	fifth.jpeg sh014.hostgator.tempwebhost.net/~kokycsaf/	93 KB 93 KB	133ms 132ms	Image image/jpeg	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/fifth.jpeg Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `b0037701ede43288600349090bffd2afeba0a16de1fb7f9c1ef55700fdc12b3f` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Last-Modified Mon, 28 Mar 2022 09:35:36 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=72 Content-Length 95285
GET H/1.1	200 OK	play.png sh014.hostgator.tempwebhost.net/~kokycsaf/	28 KB 28 KB	259ms 134ms	Image image/png	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/play.png Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `264e03c5e08a6b2e52d68e2fe01af2e123e1854b48daf1eb3f05a45ea664ca6f` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Last-Modified Mon, 28 Mar 2022 09:35:37 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/png Keep-Alive timeout=5, max=75 Content-Length 28434
GET H/1.1	200 OK	app.png sh014.hostgator.tempwebhost.net/~kokycsaf/	43 KB 43 KB	260ms 134ms	Image image/png	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/app.png Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `783417fea21f13e4b772d3a23be9284812a144a7fdbb62576974d2b27a05a909` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Last-Modified Mon, 28 Mar 2022 09:35:35 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/png Keep-Alive timeout=5, max=75 Content-Length 43806
GET H/1.1	200 OK	last.jpeg sh014.hostgator.tempwebhost.net/~kokycsaf/	71 KB 71 KB	258ms 130ms	Image image/jpeg	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/last.jpeg Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `e90eed2ef9c236b4f4b605614d0ffb12453ce5166680234c94bbefc6958d3267` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Last-Modified Mon, 28 Mar 2022 09:35:36 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/jpeg Keep-Alive timeout=5, max=75 Content-Length 72290
GET H/1.1	200 OK	footer.jpg sh014.hostgator.tempwebhost.net/~kokycsaf/	28 KB 28 KB	264ms 135ms	Image image/jpeg	162.241.123.26 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh014.hostgator.tempwebhost.net/~kokycsaf/footer.jpg Requested by Host: sh014.hostgator.tempwebhost.net URL: http://sh014.hostgator.tempwebhost.net/~kokycsaf/ Protocol HTTP/1.1 Server 162.241.123.26 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh014.hostgator.in Software Apache / Resource Hash `127724b9264e03352b4321b468361f3b0ed3cfe06da96f7c189c4feaecb4f325` Request headers Accept-Language de-DE,de;q=0.9 Referer http://sh014.hostgator.tempwebhost.net/~kokycsaf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36 Response headers Date Tue, 29 Mar 2022 08:28:24 GMT Last-Modified Mon, 28 Mar 2022 09:35:36 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/jpeg Keep-Alive timeout=5, max=75 Content-Length 28365

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| myFunction

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 06:14:54	Name: _bit Value: m2t8sn-61d7214d18789c66f2-00y

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
sh014.hostgator.tempwebhost.net
162.241.123.26
67.199.248.11
127724b9264e03352b4321b468361f3b0ed3cfe06da96f7c189c4feaecb4f325
19ec723f0ad7fe719bb2a3259b085d4e21195dd3d1abc91d18c13d098b7610c6
264e03c5e08a6b2e52d68e2fe01af2e123e1854b48daf1eb3f05a45ea664ca6f
3248e607159c58d7a76db3f1d68e9e8794dccb6a5dd0ff67a5a9730374056dc2
77bd641dab78f2d471f894653cb7fc3f8c021c91b2df66ecba074d7e3944cfdb
783417fea21f13e4b772d3a23be9284812a144a7fdbb62576974d2b27a05a909
b0037701ede43288600349090bffd2afeba0a16de1fb7f9c1ef55700fdc12b3f
e90eed2ef9c236b4f4b605614d0ffb12453ce5166680234c94bbefc6958d3267

sh014.hostgator.tempwebhost.net Open in urlscan Pro 162.241.123.26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

342 kBTransfer

344 kBSize

1 Cookies

4 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

sh014.hostgator.tempwebhost.net Open in urlscan Pro
162.241.123.26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

342 kB
Transfer

344 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!