starpets.top Open in urlscan Pro
93.157.63.172 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://starpets.top/n.php
Submission: On March 17 via manual (March 17th 2022, 1:09:51 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 93.157.63.172, located in Russian Federation and belongs to NFORCE, NL. The main domain is starpets.top.
TLS certificate: Issued by R3 on March 15th 2022. Valid for: 3 months.

This is the only time starpets.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Unicredit (Banking)

Domain & IP information

	IP Address		AS Autonomous System
8	93.157.63.172 93.157.63.172		43350 (NFORCE) (NFORCE)
8	1

8 93.157.63.172 (Russian Federation)

ASN43350 (NFORCE, NL)
PTR: starrywolf.weedcheap4you.com

starpets.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	starpets.top starpets.top	4 MB
8	1

	Domain	Requested by
8	starpets.top	starpets.top
8	1

This site contains links to these domains. Also see Links.

Domain
online.bulbank.bg
www.unicreditbulbank.bg

Subject Issuer	Validity	Valid
starpets.top R3	`2022-03-15` - `2022-06-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://starpets.top/n.php
Frame ID: 77141D69B1E19C63A4F9A27B50BBD094
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

УниКредит Булбанк

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

4019 kB
Transfer

4017 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://online.bulbank.bg/docs/BBO_security_recommendation_BG.pdf
Title: Препоръки за сигурност при работа с алтернативни канали на Банката

Search URL Search Domain Scan URL

URL: https://www.unicreditbulbank.bg/bg/pravna-informatsiya/biskvitki/
Title: Политика за прилагане на бисквитки

Search URL Search Domain Scan URL

URL: https://online.bulbank.bg/docs/FAQ_BG.pdf
Title: Често задавани въпроси

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request n.php Show response starpets.top/	12 KB 12 KB	60ms 19ms	Document text/html	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Full URL https://starpets.top/n.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `38925fbd4d9563bb1a0a3408d43d388716b80e740a11a1a513bde4dfc7230528` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Thu, 17 Mar 2022 13:09:45 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	summernote-bs4.min.css starpets.top/Content/css/summernote/	19 KB 19 KB	19ms 18ms	Stylesheet text/css	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Full URL https://starpets.top/Content/css/summernote/summernote-bs4.min.css Requested by Host: starpets.top URL: https://starpets.top/n.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `301b07bc4e286658adb2bb9ee48d8ee5edd83a1277c56f90e7c9a46c0de32cae` Request headers Accept-Language de-DE,de;q=0.9 Referer https://starpets.top/n.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:45 GMT Last-Modified Thu, 20 Jan 2022 03:54:42 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 19407
GET H/1.1	200 OK	style.min.css starpets.top/Content/css/	436 KB 437 KB	55ms 18ms	Stylesheet text/css	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Full URL https://starpets.top/Content/css/style.min.css Requested by Host: starpets.top URL: https://starpets.top/n.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `95470af6a2f060d3955cf0e8e5b1e83fcb112cda48759db92c5c6e11e0e3036c` Request headers Accept-Language de-DE,de;q=0.9 Referer https://starpets.top/n.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:45 GMT Last-Modified Mon, 14 Mar 2022 14:48:14 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 446783
GET H/1.1	200 OK	unicredit-bulbank-logo.svg starpets.top/Content/img/	6 KB 6 KB	19ms 19ms	Image image/svg+xml	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://starpets.top/Content/img/unicredit-bulbank-logo.svg Requested by Host: starpets.top URL: https://starpets.top/Content/css/style.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `51441f51f8fb9a7a820cbd086c4b8ec1fedfca249e1f04c1661bc499d4ad2296` Request headers Accept-Language de-DE,de;q=0.9 Referer https://starpets.top/Content/css/style.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:46 GMT Last-Modified Mon, 14 Mar 2022 14:49:16 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 6337
GET H/1.1	200 OK	bg-login.jpg starpets.top/Content/img/	3 MB 3 MB	19ms 19ms	Image image/jpeg	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Show image Full URL https://starpets.top/Content/img/bg-login.jpg Requested by Host: starpets.top URL: https://starpets.top/Content/css/style.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `ed13e02955062e0a400fae465f5af84f629345295eb3e2f2e35824104ac1d766` Request headers Accept-Language de-DE,de;q=0.9 Referer https://starpets.top/Content/css/style.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:46 GMT Last-Modified Wed, 04 Aug 2021 07:13:28 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2983729
GET H/1.1	200 OK	Material-Design-Iconic-Font.woff2 starpets.top/Content/icons/	37 KB 38 KB	36ms 18ms	Font font/woff2	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Full URL https://starpets.top/Content/icons/Material-Design-Iconic-Font.woff2?v=2.2.0 Requested by Host: starpets.top URL: https://starpets.top/Content/css/style.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c` Request headers Referer https://starpets.top/Content/css/style.min.css Origin https://starpets.top Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:46 GMT Last-Modified Mon, 14 Mar 2022 14:50:18 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 38384
GET H/1.1	200 OK	PT_Sans-Web-Regular.ttf starpets.top/Content/fonts/PTSans/	433 KB 433 KB	37ms 12ms	Font font/ttf	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Full URL https://starpets.top/Content/fonts/PTSans/PT_Sans-Web-Regular.ttf Requested by Host: starpets.top URL: https://starpets.top/Content/css/style.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `112c1b947e2e7291e4112891417337c9c783b291de62a010364982579f2efc6e` Request headers Referer https://starpets.top/Content/css/style.min.css Origin https://starpets.top Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:46 GMT Last-Modified Mon, 14 Mar 2022 14:45:40 GMT Server Apache Content-Type font/ttf Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 442960
GET H/1.1	200 OK	UniCredit%20CY-Regular.ttf starpets.top/Content/fonts/UniCreditCY/	160 KB 160 KB	37ms 12ms	Font font/ttf	93.157.63.172 NFORCE
General Check archive.org Show headers Download Go to Full URL https://starpets.top/Content/fonts/UniCreditCY/UniCredit%20CY-Regular.ttf Requested by Host: starpets.top URL: https://starpets.top/Content/css/style.min.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 93.157.63.172 , Russian Federation, ASN43350 (NFORCE, NL), Reverse DNS starrywolf.weedcheap4you.com Software Apache / Resource Hash `afe29236c39bbf223e0200679325eed367fe172ddfc54b1ac6e9a36dc8f2b2fc` Request headers Referer https://starpets.top/Content/css/style.min.css Origin https://starpets.top Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Date Thu, 17 Mar 2022 13:09:46 GMT Last-Modified Mon, 14 Mar 2022 14:45:00 GMT Server Apache Content-Type font/ttf Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 163956

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Unicredit (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

starpets.top
93.157.63.172
112c1b947e2e7291e4112891417337c9c783b291de62a010364982579f2efc6e
301b07bc4e286658adb2bb9ee48d8ee5edd83a1277c56f90e7c9a46c0de32cae
38925fbd4d9563bb1a0a3408d43d388716b80e740a11a1a513bde4dfc7230528
51441f51f8fb9a7a820cbd086c4b8ec1fedfca249e1f04c1661bc499d4ad2296
95470af6a2f060d3955cf0e8e5b1e83fcb112cda48759db92c5c6e11e0e3036c
afe29236c39bbf223e0200679325eed367fe172ddfc54b1ac6e9a36dc8f2b2fc
e8eea96e29a7c0a72612ab85ca3229979666467a28349642c2176e7189a1a39c
ed13e02955062e0a400fae465f5af84f629345295eb3e2f2e35824104ac1d766

starpets.top Open in urlscan Pro 93.157.63.172 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

4019 kBTransfer

4017 kBSize

0 Cookies

3 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

starpets.top Open in urlscan Pro
93.157.63.172 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

4019 kB
Transfer

4017 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!