thenetisours.com Open in urlscan Pro
66.103.159.14  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://amiratalbahar.com/js.html?email=ahmed_basossi%40ublint.com Page URL
2. https://thenetisours.com/wp-includes/images/smilies/mrgreen.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	js.html Show response amiratalbahar.com/	610 B 437 B	688ms 224ms	Document text/html	199.188.201.134 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://amiratalbahar.com/js.html?email=ahmed_basossi%40ublint.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 199.188.201.134 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium110-1.web-hosting.com Software LiteSpeed / Resource Hash e3fea91a74c48a6a81ed6572c6929273296ec85969a6eec4f20e8ee30951006a Request headers :method GET :authority amiratalbahar.com :scheme https :path /js.html?email=ahmed_basossi%40ublint.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers content-type text/html last-modified Mon, 16 Aug 2021 15:16:40 GMT accept-ranges bytes content-encoding br vary Accept-Encoding content-length 262 date Wed, 18 Aug 2021 03:16:45 GMT server LiteSpeed x-turbo-charged-by LiteSpeed
GET H/1.1	200 OK	Primary Request mrgreen.html Show response thenetisours.com/wp-includes/images/smilies/	7 KB 3 KB	380ms 125ms	Document text/html	66.103.159.14 COLOSOLUTIONS
General Check archive.org Show headers Download Go to Full URL https://thenetisours.com/wp-includes/images/smilies/mrgreen.html Requested by Host: amiratalbahar.com URL: https://amiratalbahar.com/js.html?email=ahmed_basossi%40ublint.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 66.103.159.14 Orlando, United States, ASN16557 (COLOSOLUTIONS, US), Reverse DNS stats.capslock.peopleshostdedicated.com Software Apache / Resource Hash bf98f0f0c03c0b3103150c478d3a8acd2f8d07f9f53c9d84b127157bdddabe1a Request headers Host thenetisours.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest document Referer https://amiratalbahar.com/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer https://amiratalbahar.com/ Response headers Date Wed, 18 Aug 2021 03:16:44 GMT Server Apache Last-Modified Sun, 15 Aug 2021 23:01:59 GMT Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 2503 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	24ms 9ms	Script application/javascript	2001:4de0:ac18::1:a:3b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: thenetisours.com URL: https://thenetisours.com/wp-includes/images/smilies/mrgreen.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers Referer https://thenetisours.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 18 Aug 2021 03:16:45 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx etag W/"58d026fb-15283" vary Accept-Encoding x-hw 1629256605.dop101.fr8.t,1629256605.cds203.fr8.hc,1629256605.cds133.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	25ms 13ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: thenetisours.com URL: https://thenetisours.com/wp-includes/images/smilies/mrgreen.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://thenetisours.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 18 Aug 2021 03:16:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723, 718 age 12809322 cdn-cachedat 2021-03-11 11:57:52 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 48f4598378fe1b699fcee6ac68d6cc25 cf-ray 6807fc39dcd505f5-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET		/ www.ublint.com/ Frame F3B1	0 0
GET H2	200	favicons www.google.com/s2/	492 B 1 KB	32ms 31ms	Image image/png	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/s2/favicons?domain=https://www.ublint.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947 Security Headers Name Value Content-Security-Policy require-trusted-types-for 'script';report-uri /s2/_/FaviconHttp/cspreport, script-src 'report-sample' 'nonce-bqkW88MlpixIegIi52RFKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-bqkW88MlpixIegIi52RFKA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://thenetisours.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 18 Aug 2021 03:16:45 GMT x-content-type-options nosniff server ESF cross-origin-opener-policy same-origin x-frame-options SAMEORIGIN p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private, max-age=28800 cross-origin-resource-policy cross-origin content-security-policy require-trusted-types-for 'script';report-uri /s2/_/FaviconHttp/cspreport, script-src 'report-sample' 'nonce-bqkW88MlpixIegIi52RFKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-bqkW88MlpixIegIi52RFKA' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport content-type image/png alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Wed, 18 Aug 2021 03:16:45 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.ublint.com

URL

https://www.ublint.com/

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amiratalbahar.com
code.jquery.com
stackpath.bootstrapcdn.com
thenetisours.com
www.google.com
www.ublint.com
www.ublint.com
199.188.201.134
2001:4de0:ac18::1:a:3b
2606:4700::6812:acf
2a00:1450:4001:831::2004
66.103.159.14
2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
bf98f0f0c03c0b3103150c478d3a8acd2f8d07f9f53c9d84b127157bdddabe1a
e3fea91a74c48a6a81ed6572c6929273296ec85969a6eec4f20e8ee30951006a