phpstack-916728-3182247.cloudwaysapps.com Open in urlscan Pro
139.162.34.171 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://phpstack-916728-3182247.cloudwaysapps.com/
Submission: On January 14 via api (January 14th 2023, 5:04:44 pm UTC) from JP — Scanned from JP

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 139.162.34.171, located in Singapore and belongs to AKAMAI-AP Akamai Technologies, Inc., SG. The main domain is phpstack-916728-3182247.cloudwaysapps.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 9th 2022. Valid for: a year.

This is the only time phpstack-916728-3182247.cloudwaysapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address		AS Autonomous System
10	139.162.34.171 139.162.34.171		63949 (AKAMAI-AP...) (AKAMAI-AP Akamai Technologies)
10	1

10 139.162.34.171 (Singapore)

ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG)
PTR: 139-162-34-171.ip.linodeusercontent.com

phpstack-916728-3182247.cloudwaysapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	cloudwaysapps.com phpstack-916728-3182247.cloudwaysapps.com	148 KB
10	1

	Domain	Requested by
10	phpstack-916728-3182247.cloudwaysapps.com	phpstack-916728-3182247.cloudwaysapps.com
10	1

This site contains no links.

Subject Issuer	Validity	Valid
*.cloudwaysapps.com Sectigo RSA Domain Validation Secure Server CA	`2022-09-09` - `2023-10-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://phpstack-916728-3182247.cloudwaysapps.com/
Frame ID: 4C05CF888B0DE6A5B35653FDEA5DE1C8
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Covid 19 Process

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

148 kB
Transfer

299 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response phpstack-916728-3182247.cloudwaysapps.com/	4 KB 2 KB	208ms 69ms	Document text/html	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Full URL https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `24a699963a7d7ef26b7fea8e4c2006499b0356021044a9603f32f925d6feeb06` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers accept-ranges bytes age 10029 content-encoding gzip content-length 1396 content-type text/html; charset=UTF-8 date Sat, 14 Jan 2023 17:04:39 GMT server nginx vary Accept-Encoding x-cache HIT x-robots-tag noindex, nofollow
GET H2	200	bts.css phpstack-916728-3182247.cloudwaysapps.com/	118 KB 19 KB	139ms 138ms	Stylesheet text/css	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Full URL https://phpstack-916728-3182247.cloudwaysapps.com/bts.css Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `745fb7e80c0f9b4025c8fcc7b588c34b7b1177398fab00cf46ce1891291af5f3` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT content-encoding gzip last-modified Fri, 13 Jan 2023 14:18:08 GMT server nginx etag W/"63c16820-1d94e" vary Accept-Encoding content-type text/css cache-control public, max-age=31536000 x-robots-tag noindex, nofollow
GET H2	200	stst.css phpstack-916728-3182247.cloudwaysapps.com/	3 KB 1 KB	139ms 138ms	Stylesheet text/css	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Full URL https://phpstack-916728-3182247.cloudwaysapps.com/stst.css Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `541ce5bf2c8f066d0c5c24897b0ace56777d0bbc48e419e5b1294cae3367f28c` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT content-encoding gzip last-modified Fri, 13 Jan 2023 14:18:13 GMT server nginx etag W/"63c16825-c9e" vary Accept-Encoding content-type text/css cache-control public, max-age=31536000 x-robots-tag noindex, nofollow
GET H2	200	ono.png phpstack-916728-3182247.cloudwaysapps.com/	31 KB 32 KB	125ms 124ms	Image image/png	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Show image Full URL https://phpstack-916728-3182247.cloudwaysapps.com/ono.png Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `55f2bc0397ede374e94d7881ae0c56228f24079251b5d9310e1b8cf5be079b11` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT last-modified Fri, 13 Jan 2023 14:18:13 GMT server nginx etag "63c16825-7d47" content-type image/png cache-control public, max-age=31536000 accept-ranges bytes x-robots-tag noindex, nofollow content-length 32071
GET H2	200	papa.png phpstack-916728-3182247.cloudwaysapps.com/	7 KB 8 KB	191ms 191ms	Image image/png	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Show image Full URL https://phpstack-916728-3182247.cloudwaysapps.com/papa.png Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `d0462a103e0f027c2c2ab713f02eeb40e567c981c7143578796ba2c96d54efc8` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT last-modified Fri, 13 Jan 2023 14:18:13 GMT server nginx etag "63c16825-1dca" content-type image/png cache-control public, max-age=31536000 accept-ranges bytes x-robots-tag noindex, nofollow content-length 7626
GET H2	200	stst.png phpstack-916728-3182247.cloudwaysapps.com/	14 KB 14 KB	192ms 191ms	Image image/png	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Show image Full URL https://phpstack-916728-3182247.cloudwaysapps.com/stst.png Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `215e46442382af6784b854e56f70c527d0d205a367c58567c308d3c3fbe31cc2` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT last-modified Fri, 13 Jan 2023 14:18:13 GMT server nginx etag "63c16825-3685" content-type image/png cache-control public, max-age=31536000 accept-ranges bytes x-robots-tag noindex, nofollow content-length 13957
GET H2	200	apl.svg phpstack-916728-3182247.cloudwaysapps.com/	11 KB 4 KB	192ms 191ms	Image image/svg+xml	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Show image Full URL https://phpstack-916728-3182247.cloudwaysapps.com/apl.svg Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `a26fc5b38380272c92e9019a2eb8b45542a66814b3e2b203772db8904b9fb99f` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT content-encoding gzip last-modified Fri, 13 Jan 2023 14:18:08 GMT server nginx etag W/"63c16820-2a34" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=31536000 x-robots-tag noindex, nofollow
GET H2	404	jk.js phpstack-916728-3182247.cloudwaysapps.com/	0 0	193ms 191ms	Script text/html	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Full URL https://phpstack-916728-3182247.cloudwaysapps.com/jk.js Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT content-encoding gzip server nginx age 0 vary Accept-Encoding x-cache MISS content-type text/html; charset=iso-8859-1 cache-control max-age=1440 x-robots-tag noindex, nofollow expires 1440
GET H2	404	bts.js phpstack-916728-3182247.cloudwaysapps.com/	0 0	193ms 192ms	Script text/html	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Full URL https://phpstack-916728-3182247.cloudwaysapps.com/bts.js Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT content-encoding gzip server nginx age 0 vary Accept-Encoding x-cache MISS content-type text/html; charset=iso-8859-1 cache-control max-age=1440 x-robots-tag noindex, nofollow expires 1440
GET H2	200	ipl.svg phpstack-916728-3182247.cloudwaysapps.com/	110 KB 69 KB	69ms 69ms	Image image/svg+xml	139.162.34.171 AKAMAI-AP Akamai ...
General Check archive.org Show headers Download Go to Show image Full URL https://phpstack-916728-3182247.cloudwaysapps.com/ipl.svg Requested by Host: phpstack-916728-3182247.cloudwaysapps.com URL: https://phpstack-916728-3182247.cloudwaysapps.com/stst.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 139.162.34.171 , Singapore, ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG), Reverse DNS 139-162-34-171.ip.linodeusercontent.com Software nginx / Resource Hash `828cbd2daec3e6bdcd87950db55cc7603d6b87ba9a8f1c8c78a4552e5491a957` Request headers accept-language jp-JP,jp;q=0.9 Referer https://phpstack-916728-3182247.cloudwaysapps.com/stst.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Sat, 14 Jan 2023 17:04:39 GMT content-encoding gzip last-modified Fri, 13 Jan 2023 14:18:11 GMT server nginx etag W/"63c16823-1b859" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=31536000 x-robots-tag noindex, nofollow

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://phpstack-916728-3182247.cloudwaysapps.com/jk.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://phpstack-916728-3182247.cloudwaysapps.com/bts.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

phpstack-916728-3182247.cloudwaysapps.com
139.162.34.171
215e46442382af6784b854e56f70c527d0d205a367c58567c308d3c3fbe31cc2
24a699963a7d7ef26b7fea8e4c2006499b0356021044a9603f32f925d6feeb06
541ce5bf2c8f066d0c5c24897b0ace56777d0bbc48e419e5b1294cae3367f28c
55f2bc0397ede374e94d7881ae0c56228f24079251b5d9310e1b8cf5be079b11
745fb7e80c0f9b4025c8fcc7b588c34b7b1177398fab00cf46ce1891291af5f3
828cbd2daec3e6bdcd87950db55cc7603d6b87ba9a8f1c8c78a4552e5491a957
a26fc5b38380272c92e9019a2eb8b45542a66814b3e2b203772db8904b9fb99f
d0462a103e0f027c2c2ab713f02eeb40e567c981c7143578796ba2c96d54efc8

phpstack-916728-3182247.cloudwaysapps.com Open in urlscan Pro 139.162.34.171 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

148 kBTransfer

299 kBSize

0 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

phpstack-916728-3182247.cloudwaysapps.com Open in urlscan Pro
139.162.34.171 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

148 kB
Transfer

299 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!