www.otrrpedia.net
Open in
urlscan Pro
66.147.242.159
Malicious Activity!
Public Scan
URL:
http://www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/step3.php?cmd=log...
Submission: On September 24 via automatic, source openphish
Submission: On September 24 via automatic, source openphish
Summary
This website contacted 3 IPs
in 1 countries
across 3 domains to perform 13 HTTP transactions.
The main IP is 66.147.242.159, located in
Provo, United States and
belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US.
The main domain is www.otrrpedia.net.
This is the only time www.otrrpedia.net was scanned on urlscan.io!
This is the only time www.otrrpedia.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: CapitalOne (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 66.147.242.159 66.147.242.159 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
| 1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
| 2 | 2400:cb00:204... 2400:cb00:2048:1::6810:5914 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 13 | 3 |
10
66.147.242.159
(Provo, United States)
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box559.bluehost.com
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box559.bluehost.com
| www.otrrpedia.net |
1
205.185.208.52
(Phoenix, United States)
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
| code.jquery.com |
2
2400:cb00:2048:1::6810:5914
(United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| cdn.jsdelivr.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
otrrpedia.net
www.otrrpedia.net |
141 KB |
| 2 |
jsdelivr.net
cdn.jsdelivr.net |
13 KB |
| 1 |
jquery.com
code.jquery.com |
33 KB |
| 13 | 3 |
| Domain | Requested by | |
|---|---|---|
| 10 | www.otrrpedia.net |
www.otrrpedia.net
code.jquery.com |
| 2 | cdn.jsdelivr.net |
www.otrrpedia.net
|
| 1 | code.jquery.com |
www.otrrpedia.net
|
| 13 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| code.jquery.com Let's Encrypt Authority X3 |
2018-08-29 - 2018-11-27 |
3 months | crt.sh |
| ssl363648.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-05-19 - 2018-11-25 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/step3.php?cmd=login_submit&id=b5f68a9fcd810d480212838895dfa1fab5f68a9fcd810d480212838895dfa1fa&session=b5f68a9fcd810d480212838895dfa1fab5f68a9fcd810d480212838895dfa1fa
Frame ID: 7C4215A6EC55E730207648F8D0847D2C
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
step3.php
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/ |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app-3f627e3dc2.css
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/index_files/ |
115 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
capitalone-logo.png
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/index_files/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
9.gif
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/images/ |
13 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
8.gif
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/images/ |
14 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
7.gif
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/images/ |
21 KB 10 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.11.1.min.js
code.jquery.com/ |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.validate.min.js
cdn.jsdelivr.net/jquery.validation/1.16.0/ |
23 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
additional-methods.min.js
cdn.jsdelivr.net/jquery.validation/1.16.0/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
drop-icon.png
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/images/ |
44 KB 44 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ProximaNovaRegular.woff2
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ProximaNovaSemiBold.woff2
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/fonts/ |
20 KB 20 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ProximaNovaRegular.woff
www.otrrpedia.net/mags/mags/RadioLife/Covers/capital/capitalone/b7bd86e0449789fc922998735e635078/fonts/ |
24 KB 24 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: CapitalOne (Financial)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| cc_number_saved function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
code.jquery.com
www.otrrpedia.net
205.185.208.52
2400:cb00:2048:1::6810:5914
66.147.242.159
177379d346f3bfce7ec40748f6e431ad306569243cd8c8ab2a4829b1109c50e8
2425df165e05b47e37377d7b85e73cce960502603a9642eb78ab892df698a9bc
30d15e1284d2ec3fc9ce2b5fa43f9e89d9106a45677a24c0bb529cba1ae2f7a0
3db577869cbe9e2e300e6575965aa1c63ae1054fbbd66aa166c8efb04d5c706f
50e497b00818378dcffe856b994f89947b620c66163768879c9b8a63d583f898
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
76680efd61dc1f00144c9af7adb317cc0642fe53282525e7e35806a12e74a084
8b1554032d2cfbf0e858518df6460b2b4336be2cfb1f188dfd1108a3ae50b2e8
9e4d2744ae75b0cbe321261c8517fe4fd16a0314f08b2931cf4f0833803dbaa4
b59f61eeaeea3400b0c27424ea1074ac4b2d9130d66e7c218fc2b8b94e7e227a
ce8aa7f6a453f00f303e63b5f0d81dc9983994cc85bb8be36315f5f0a6e71751
da7c29ad433fe646e6d22a47b186fe112a7eb9b9200cd26ea917e0a6c05c1c4e