bl0ci.com Open in urlscan Pro
160.119.254.114  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Signin2.htm Show response bl0ci.com/	14 KB 5 KB	663ms 282ms	Document text/html	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash d7e829e62432f451449c68ab5ea2c33438c913c0e487b61b1cd3979e905da910 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 accept-language en-US,en;q=0.9 Response headers accept-ranges bytes connection Keep-Alive content-encoding gzip content-length 4620 content-type text/html date Wed, 06 Dec 2023 21:57:45 GMT etag "37b6-6514651e-17a6a1;gz" last-modified Wed, 27 Sep 2023 17:23:42 GMT server LiteSpeed vary Accept-Encoding
GET H/1.1	200 OK	csspage2.css bl0ci.com/Signin2_files/	11 KB 3 KB	282ms 281ms	Stylesheet text/css	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/Signin2_files/csspage2.css Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash 954dd646ba96c8b4af6e0592027e18937cee696eb19a36f40383a2fdd8c0f255 Request headers accept-language en-US,en;q=0.9 Referer http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 21:57:45 GMT content-encoding gzip last-modified Fri, 22 Sep 2023 14:46:06 GMT server LiteSpeed etag "2b27-650da8ae-17a655;gz" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 2245 expires Wed, 13 Dec 2023 21:57:45 GMT
GET H/1.1	200 OK	modernizr.min.js Show response bl0ci.com/Signin2_files/	11 KB 5 KB	285ms 284ms	Script application/x-javascript	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/Signin2_files/modernizr.min.js Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe Request headers Referer Origin http://bl0ci.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 21:57:45 GMT content-encoding gzip last-modified Fri, 22 Sep 2023 14:46:06 GMT server LiteSpeed etag "2b4c-650da8ae-17a658;gz" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 4511 expires Wed, 13 Dec 2023 21:57:45 GMT
GET H/1.1	200 OK	all.min.css bl0ci.com/Signin2_files/	58 KB 13 KB	561ms 280ms	Stylesheet text/css	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/Signin2_files/all.min.css Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash 99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e Request headers Referer Origin http://bl0ci.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 21:57:46 GMT content-encoding gzip last-modified Fri, 22 Sep 2023 14:46:06 GMT server LiteSpeed etag "e7a9-650da8ae-17a654;gz" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 12857 expires Wed, 13 Dec 2023 21:57:46 GMT
GET H/1.1	200 OK	jquery-3.3.1.min.js Show response bl0ci.com/Signin2_files/	85 KB 30 KB	562ms 280ms	Script application/x-javascript	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/Signin2_files/jquery-3.3.1.min.js Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers accept-language en-US,en;q=0.9 Referer http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 21:57:46 GMT content-encoding gzip last-modified Fri, 22 Sep 2023 14:46:06 GMT server LiteSpeed etag "1538f-650da8ae-17a656;gz" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 30351 expires Wed, 13 Dec 2023 21:57:46 GMT
GET H/1.1	200 OK	logo.png bl0ci.com/Signin2_files/	3 KB 4 KB	562ms 280ms	Image image/png	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Show image Full URL http://bl0ci.com/Signin2_files/logo.png Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash 3e4af3f39885c55017c51ee4c68ab87c4ecb6af0d9a54417eee33d9db13b036e Request headers accept-language en-US,en;q=0.9 Referer http://bl0ci.com/Signin2.htm?ScrPg=&ACCT.x=ID-DL=WF324=/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers date Wed, 06 Dec 2023 21:57:46 GMT last-modified Fri, 22 Sep 2023 14:46:06 GMT server LiteSpeed etag "d1c-650da8ae-17a657;;;" content-type image/png cache-control public, max-age=604800 connection Keep-Alive accept-ranges bytes content-length 3356 expires Wed, 13 Dec 2023 21:57:46 GMT
GET H/1.1	200 OK	background.jpg strox.nl/we_files/pics/	599 KB 599 KB	645ms 315ms	Image image/jpeg	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Show image Full URL https://strox.nl/we_files/pics/background.jpg Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2_files/csspage2.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash d3ee0c954f26a12702c2ad4ca5fc14fa14198eadd59113a5baef17e0c1240ebe Request headers accept-language en-US,en;q=0.9 Referer http://bl0ci.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Date Wed, 06 Dec 2023 21:57:46 GMT Last-Modified Sat, 21 Aug 2021 22:21:42 GMT Server nginx/1.20.1 ETag "95bb8-5ca19355f8980" Upgrade h2,h2c Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 613304
GET H/1.1	200 OK	alert_list.png strox.nl/we_files/lib/pics/	5 KB 5 KB	475ms 158ms	Image image/png	212.23.222.194 MEVSPACE
General Check archive.org Show headers Download Go to Show image Full URL https://strox.nl/we_files/lib/pics/alert_list.png Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2_files/csspage2.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 212.23.222.194 , Poland, ASN201814 (MEVSPACE, PL), Reverse DNS Software nginx/1.20.1 / Resource Hash 54436312813c5ba0070898ec0ac998a94e0486d12417a8fa4602cc501a94029e Request headers accept-language en-US,en;q=0.9 Referer http://bl0ci.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers Date Wed, 06 Dec 2023 21:57:47 GMT Last-Modified Thu, 27 May 2021 20:09:06 GMT Server nginx/1.20.1 ETag "1243-5c35554ce5c80" Upgrade h2,h2c Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 4675
GET H/1.1	404 Not Found	fa-solid-900.woff2 bl0ci.com/webfonts/	0 0	282ms 282ms	Font text/html	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/webfonts/fa-solid-900.woff2 Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2_files/all.min.css Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash Request headers Referer http://bl0ci.com/Signin2_files/all.min.css Origin http://bl0ci.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers pragma no-cache date Wed, 06 Dec 2023 21:57:46 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding transfer-encoding chunked content-type text/html cache-control private, no-cache, max-age=0 connection Keep-Alive
GET H/1.1	404 Not Found	fa-solid-900.woff bl0ci.com/webfonts/	0 0	284ms 284ms	Font text/html	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/webfonts/fa-solid-900.woff Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2_files/all.min.css Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash Request headers Referer http://bl0ci.com/Signin2_files/all.min.css Origin http://bl0ci.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers pragma no-cache date Wed, 06 Dec 2023 21:57:47 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding transfer-encoding chunked content-type text/html cache-control private, no-cache, max-age=0 connection Keep-Alive
GET H/1.1	404 Not Found	fa-solid-900.ttf bl0ci.com/webfonts/	0 0	281ms 280ms	Font text/html	160.119.254.114 Host-Africa-AS
General Check archive.org Show headers Download Go to Full URL http://bl0ci.com/webfonts/fa-solid-900.ttf Requested by Host: bl0ci.com URL: http://bl0ci.com/Signin2_files/all.min.css Protocol HTTP/1.1 Server 160.119.254.114 , South Africa, ASN328364 (Host-Africa-AS, ZA), Reverse DNS Software LiteSpeed / Resource Hash Request headers Referer http://bl0ci.com/Signin2_files/all.min.css Origin http://bl0ci.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36 Response headers pragma no-cache date Wed, 06 Dec 2023 21:57:47 GMT content-encoding gzip server LiteSpeed vary Accept-Encoding transfer-encoding chunked content-type text/html cache-control private, no-cache, max-age=0 connection Keep-Alive

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking) PayPal (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| html5 object| Modernizr function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://bl0ci.com/webfonts/fa-solid-900.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://bl0ci.com/webfonts/fa-solid-900.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://bl0ci.com/webfonts/fa-solid-900.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bl0ci.com
strox.nl
160.119.254.114
212.23.222.194
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
3e4af3f39885c55017c51ee4c68ab87c4ecb6af0d9a54417eee33d9db13b036e
54436312813c5ba0070898ec0ac998a94e0486d12417a8fa4602cc501a94029e
954dd646ba96c8b4af6e0592027e18937cee696eb19a36f40383a2fdd8c0f255
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
d3ee0c954f26a12702c2ad4ca5fc14fa14198eadd59113a5baef17e0c1240ebe
d7e829e62432f451449c68ab5ea2c33438c913c0e487b61b1cd3979e905da910