citymanagesinter.com
Open in
urlscan Pro
132.148.199.225
Malicious Activity!
Public Scan
Effective URL: http://citymanagesinter.com/so/dly/ria.php?cmd=login_submit&id=771e67dc7a627f99aff5987b17a04b6f771e67dc7a627f99aff5987b17a04...
Submission: On February 13 via manual from CA
Summary
This is the only time citymanagesinter.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 17 | 132.148.199.225 132.148.199.225 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
2 | 104.111.232.126 104.111.232.126 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
2 | 45.40.130.22 45.40.130.22 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 | 91.198.174.208 91.198.174.208 | 14907 (WIKIMEDIA) (WIKIMEDIA - Wikimedia Foundation Inc.) | |
1 | 137.44.1.7 137.44.1.7 | 786 (JANET Jis...) (JANET Jisc Services Limited) | |
20 | 5 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-132-148-199-225.ip.secureserver.net
citymanagesinter.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-232-126.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
img.secureserver.net |
ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US)
PTR: upload-lb.esams.wikimedia.org
upload.wikimedia.org |
ASN786 (JANET Jisc Services Limited, GB)
PTR: web.swan.ac.uk
www.swansea.ac.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
citymanagesinter.com
3 redirects
citymanagesinter.com |
72 KB |
2 |
secureserver.net
img.secureserver.net |
1 KB |
2 |
wsimg.com
img1.wsimg.com |
9 KB |
1 |
swansea.ac.uk
www.swansea.ac.uk |
44 KB |
1 |
wikimedia.org
upload.wikimedia.org |
14 KB |
20 | 5 |
Domain | Requested by | |
---|---|---|
17 | citymanagesinter.com |
3 redirects
citymanagesinter.com
|
2 | img.secureserver.net | |
2 | img1.wsimg.com |
citymanagesinter.com
|
1 | www.swansea.ac.uk |
citymanagesinter.com
|
1 | upload.wikimedia.org |
citymanagesinter.com
|
20 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://citymanagesinter.com/so/dly/ria.php?cmd=login_submit&id=771e67dc7a627f99aff5987b17a04b6f771e67dc7a627f99aff5987b17a04b6f&session=771e67dc7a627f99aff5987b17a04b6f771e67dc7a627f99aff5987b17a04b6f
Frame ID: (FB88C126C09E74B17E4E2793C7CB35B7)
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://citymanagesinter.com/seeth
HTTP 301
http://citymanagesinter.com/seeth/ HTTP 302
http://citymanagesinter.com/seeth/two.php?cmd=login_submit&id=52cbf2de4544d955f7d78cbe43945b2852cbf2de45... Page URL
-
http://citymanagesinter.com/so/dly/
HTTP 302
http://citymanagesinter.com/so/dly/ria.php?cmd=login_submit&id=771e67dc7a627f99aff5987b17a04b6f771e67dc7... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://citymanagesinter.com/seeth
HTTP 301
http://citymanagesinter.com/seeth/ HTTP 302
http://citymanagesinter.com/seeth/two.php?cmd=login_submit&id=52cbf2de4544d955f7d78cbe43945b2852cbf2de4544d955f7d78cbe43945b28&session=52cbf2de4544d955f7d78cbe43945b2852cbf2de4544d955f7d78cbe43945b28 Page URL
-
http://citymanagesinter.com/so/dly/
HTTP 302
http://citymanagesinter.com/so/dly/ria.php?cmd=login_submit&id=771e67dc7a627f99aff5987b17a04b6f771e67dc7a627f99aff5987b17a04b6f&session=771e67dc7a627f99aff5987b17a04b6f771e67dc7a627f99aff5987b17a04b6f Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://citymanagesinter.com/seeth HTTP 301
- http://citymanagesinter.com/seeth/ HTTP 302
- http://citymanagesinter.com/seeth/two.php?cmd=login_submit&id=52cbf2de4544d955f7d78cbe43945b2852cbf2de4544d955f7d78cbe43945b28&session=52cbf2de4544d955f7d78cbe43945b2852cbf2de4544d955f7d78cbe43945b28
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
two.php
citymanagesinter.com/seeth/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 591 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
ria.php
citymanagesinter.com/so/dly/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
font.css
citymanagesinter.com/so/dly/telm_files/ |
509 B 576 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
citymanagesinter.com/so/dly/telm_files/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
input.css
citymanagesinter.com/so/dly/telm_files/ |
5 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
stander.css
citymanagesinter.com/so/dly/telm_files/ |
405 B 518 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.css
citymanagesinter.com/so/dly/telm_files/ |
101 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap-responsive.css
citymanagesinter.com/so/dly/telm_files/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap-select.css
citymanagesinter.com/so/dly/telm_files/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
responsive.css
citymanagesinter.com/so/dly/telm_files/ |
1023 B 747 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
1024px-DHL_Logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/a/ac/DHL_Logo.svg/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office-2.png
www.swansea.ac.uk/it-services/software-enquiry/office-365/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading_ajax.gif
citymanagesinter.com/so/dly/telm_files/ |
39 KB 39 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
robot.jpg
citymanagesinter.com/so/img/robot/ |
2 KB 2 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
open-sans.light-webfont.woff
citymanagesinter.com/so/dly/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
open-sans.light-webfont.ttf
citymanagesinter.com/so/dly/font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 591 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
citymanagesinter.com/ | Name: _tccl_visit Value: 1ee77e16-3736-4af8-997c-01d5478bb2e9 |
|
citymanagesinter.com/ | Name: _tccl_visitor Value: 1ee77e16-3736-4af8-997c-01d5478bb2e9 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
citymanagesinter.com
img.secureserver.net
img1.wsimg.com
upload.wikimedia.org
www.swansea.ac.uk
104.111.232.126
132.148.199.225
137.44.1.7
45.40.130.22
91.198.174.208
1dbf9f0ae4697fe453c8bc4d75aa88a6c3bf92518ab46b8240f29322717c9b6e
21569df5d450d358411f36081353aca62910441f3de4b176c9182d07194f2448
43bdd7b311c1bbf61b833bdece51e14b34aa392f5a93ed8845d6b30787045f74
71633d747b508f0a38ee40b41a372faeec604ca1070d511fd5b8cbcb453cf3b2
7f87de48adfa878b20a6e1ba12f7409d99b0a450fca3903d64630085da53377f
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0a14531e911c75acc5fc8819d1c1554c02b87cfecbc0da2a31ed3da106ddca5
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
b45b58a62c06651bd1a1bd21cc20281dbe1d1a6e587c6385b0a99511067a8c19
cc161144760ae41a24180099d28ea76f12e6225e3559966aa7b11668306585ae
cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed
d657f5f4559dc7ca2114aa5c0b19d4da699bbcc7590e497a01f52b9967d4423d
dd2e0da64d0a5863b018d28eae05ffd255224bfed8a551dddbb3d0b27c351dba
e5dc908c683f9fedd0183d4dc8a844f0c1053575301b069852f17afd4fc082bd
e72e35314fd855a490e1e6a08c3356662c3bb18bc74af9d94af2a3652f4056dc
ef70a526888d55ed811c3254b91ae48509cc1746f3efe1051e7350077d1440ab