itabrics.com
Open in
urlscan Pro
103.250.185.131
Malicious Activity!
Public Scan
Submitted URL: http://ht.ly/XZ2130raXCW
Effective URL: https://itabrics.com/cntrapl/Bom/1/index2.php?is_retargeting=true&af_cost_currency=USD&shortlink=c857426bs&c=service4...
Submission: On September 23 via automatic, source phishtank
Effective URL: https://itabrics.com/cntrapl/Bom/1/index2.php?is_retargeting=true&af_cost_currency=USD&shortlink=c857426bs&c=service4...
Submission: On September 23 via automatic, source phishtank
Summary
This website contacted 1 IPs
in 3 countries
across 3 domains to perform 3 HTTP transactions.
The main IP is 103.250.185.131, located in
Pune, India and
belongs to NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN.
The main domain is itabrics.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 28th 2020. Valid for: 3 months.
This is the only time itabrics.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 28th 2020. Valid for: 3 months.
This is the only time itabrics.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Bank of America (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 54.67.62.204 54.67.62.204 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 1 | 54.171.143.173 54.171.143.173 | 16509 (AMAZON-02) (AMAZON-02) | |
| 3 | 103.250.185.131 103.250.185.131 | 132335 (NETWORK-L...) (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd) | |
| 3 | 1 |
1
54.171.143.173
(Dublin, Ireland)
ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-143-173.eu-west-1.compute.amazonaws.com
ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-143-173.eu-west-1.compute.amazonaws.com
| amazon2s.onelink.me |
3
103.250.185.131
(Pune, India)
ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN)
PTR: mail.qloud.in
ASN132335 (NETWORK-LEAPSWITCH-IN LeapSwitch Networks Pvt Ltd, IN)
PTR: mail.qloud.in
| itabrics.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
itabrics.com
itabrics.com |
12 KB |
| 1 |
onelink.me
1 redirects
amazon2s.onelink.me |
550 B |
| 1 |
ht.ly
1 redirects
ht.ly |
126 B |
| 3 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | itabrics.com |
itabrics.com
|
| 1 | amazon2s.onelink.me | 1 redirects |
| 1 | ht.ly | 1 redirects |
| 3 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| itabrics.com cPanel, Inc. Certification Authority |
2020-07-28 - 2020-10-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://itabrics.com/cntrapl/Bom/1/index2.php?is_retargeting=true&af_cost_currency=USD&shortlink=c857426bs&c=service4boa&pid=boa23&af_cost_value=1000&af_click_lookback=7d
Frame ID: D89E6617135CA78A4B005ACE430B812B
Requests: 3 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://ht.ly/XZ2130raXCW
HTTP 301
https://amazon2s.onelink.me/bMAW/c857426bs HTTP 302
https://itabrics.com/cntrapl/Bom/1/index2.php?is_retargeting=true&af_cost_currency=USD&shortlink=... Page URL
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ht.ly/XZ2130raXCW
HTTP 301
https://amazon2s.onelink.me/bMAW/c857426bs HTTP 302
https://itabrics.com/cntrapl/Bom/1/index2.php?is_retargeting=true&af_cost_currency=USD&shortlink=c857426bs&c=service4boa&pid=boa23&af_cost_value=1000&af_click_lookback=7d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
index2.php
itabrics.com/cntrapl/Bom/1/ Redirect Chain
|
808 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clog1.png
itabrics.com/cntrapl/Bom/1/DX3/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
captcha.php
itabrics.com/cntrapl/Bom/1/DX3/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Bank of America (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amazon2s.onelink.me
ht.ly
itabrics.com
103.250.185.131
54.171.143.173
54.67.62.204
7cbe7580b8e02ae8bf06caa73dda90279124becab4fee2e176a1d73f0793542f
97f0549b914441e876a7a5d9fa1debc978fa17e8474a3164df07ea6daa1cbcd5
f9fca4070dbcf45060d9cc1306c76ffdc71ff26d527401d0192f90d09a35f7df