ict-backan.gov.vn
Open in
urlscan Pro
123.30.185.161
Malicious Activity!
Public Scan
Submission Tags: phishing malicious Search All
Submission: On November 28 via api from US
Summary
This is the only time ict-backan.gov.vn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Wells Fargo (Banking) PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 123.30.185.161 123.30.185.161 | 45899 (VNPT-AS-V...) (VNPT-AS-VN VNPT Corp) | |
3 10 | 23.205.213.30 23.205.213.30 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
17 | 3 |
ASN45899 (VNPT-AS-VN VNPT Corp, VN)
PTR: hostcloud3.vdconline.vn
ict-backan.gov.vn |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-205-213-30.deploy.static.akamaitechnologies.com
www.paypalobjects.com | |
www.paypal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
ict-backan.gov.vn
ict-backan.gov.vn |
359 KB |
6 |
paypalobjects.com
www.paypalobjects.com |
154 KB |
4 |
paypal.com
3 redirects
www.paypal.com |
4 KB |
17 | 3 |
Domain | Requested by | |
---|---|---|
10 | ict-backan.gov.vn |
ict-backan.gov.vn
|
6 | www.paypalobjects.com |
ict-backan.gov.vn
|
4 | www.paypal.com |
3 redirects
ict-backan.gov.vn
|
17 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2019-09-10 - 2020-08-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/
Frame ID: E5B4D3694D92012C8F642B3F7095CAB0
Requests: 19 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://www.paypal.com/search/js/embed.js HTTP 301
- https://www.paypal.com/ru/smarthelp/home/js/embed.js HTTP 301
- https://www.paypal.com/smarthelp/home HTTP 301
- https://www.paypal.com/ru/smarthelp/home
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/ |
9 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
ict-backan.gov.vn/css/jczmjy=/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pa.js
www.paypalobjects.com/pa/js/min/ |
43 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
paypal-sans.css
www.paypalobjects.com/ui-web/vx-pattern-lib/2-0-5/ |
3 KB 593 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-service-nav.css
www.paypalobjects.com/web/res/1f0/6dcd434cd566c97d0085ac711fbc4/css/ |
156 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
home
www.paypal.com/ru/smarthelp/ Redirect Chain
|
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headersRedirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
selfi.png
ict-backan.gov.vn/css/jczmjy=/img/ |
127 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sample-photo-id-card.svg
ict-backan.gov.vn/css/jczmjy=/img/ |
80 KB 80 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/css/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.fileuploader.css
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/src/ |
16 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.fileuploader-theme-thumbnails.css
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.1.1.min.js
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.fileuploader.min.js
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/src/ |
27 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.js
ict-backan.gov.vn/css/jczmjy=/myaccount/uploads/js/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
610 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff2
www.paypalobjects.com/ui-web/paypal-sans-big/1-0-0/ |
37 KB 38 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
36 KB 37 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Medium.woff2
www.paypalobjects.com/ui-web/paypal-sans-small/1-0-0/ |
38 KB 38 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Wells Fargo (Banking) PayPal (Financial)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| PAYPAL object| fpti string| fptiserverurl boolean| isLessthanIE10 function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ict-backan.gov.vn
www.paypal.com
www.paypalobjects.com
123.30.185.161
23.205.213.30
15d0885f0bd68f518345d1d9ed06bf9fea395a9086c7ced201ed168c29eb0b69
288487dbcc08513b8dec41131c4dd82370c87796fa1bfb98b05693a00a5f6519
4619d70d7bd1b3d7572940e9ee7f31bc4c07f4c9cad6ae2d3e5b2eb555b6a2c0
4afb4b79dc68130a2d437e2362adffded06d17119631b32d19e1ea38eb8db47f
5b0762c89f2d66aca96baadb117e844c5a65a5e517a68573ae5e5f87f81ef12b
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
88cdb84bb12b1781db7daaf74b795db1d0c25a15c50eac4edbaee39bf3c2ff52
a3b846d3c224f7d3cab0015a83152a15447aa9bae4470c1ca7f291b3a7a58dad
b337b4723a05881b0fdbc54695b0558d288b13ab9d98ff45d091e51d78fd6ed0
c200a32e739086d840ba433505c722ca0f398c2a69c390a7fd44b297ca934a85
c6c94c9eaefd52e7d69296e0a56e93c77406187f5b76d9b8967d516108a8b66b
c913cf347361d7b7881beb389918d65e41e5c8d7c3943a0cb58797e0fe4c16ac
d5d721e98ba7a207ad3e0f2422170c7cdef2c02c50951096c11a3870ac7d4824
df76ffbe0fc372a2f2d9ece1ef50055b23b5cc776c4556e2533add339e63bdf8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edc5ee3b590dae17b0eb19063c34680c15ee144d13583d006e6a7976b69cd2db
fbc9938e7f80cc983bbdfe777b736364fec34f493d20a81f84b5c67b6bc0c24e
fd8d1f600eb73a267a181d7954ae0503ada28c37a3a39ab9ecf386561d04aae3