envious-cow.w5.wpsandbox.pro Open in urlscan Pro
54.157.141.105 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://embarrassed-worm.w5.wpsandbox.pro/
Effective URL:
https://envious-cow.w5.wpsandbox.pro/alpha2/gr/
Submission: On June 14 via manual (June 14th 2022, 6:17:48 am UTC) from GR — Scanned from DE

Summary HTTP 1 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 54.157.141.105, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is envious-cow.w5.wpsandbox.pro.
TLS certificate: Issued by Amazon on November 17th 2021. Valid for: a year.

This is the only time envious-cow.w5.wpsandbox.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alpha Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.235.242.85 54.235.242.85	14618 (AMAZON-AES) (AMAZON-AES)
1 2	54.157.141.105 54.157.141.105	14618 (AMAZON-AES) (AMAZON-AES)
1	2

1 54.235.242.85 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-242-85.compute-1.amazonaws.com

embarrassed-worm.w5.wpsandbox.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.157.141.105 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-141-105.compute-1.amazonaws.com

envious-cow.w5.wpsandbox.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	wpsandbox.pro 2 redirects embarrassed-worm.w5.wpsandbox.pro envious-cow.w5.wpsandbox.pro	2 MB
1	1

	Domain	Requested by
2	envious-cow.w5.wpsandbox.pro	1 redirects
1	embarrassed-worm.w5.wpsandbox.pro	1 redirects
1	2

This site contains no links.

Subject Issuer	Validity	Valid
*.w6.wpsandbox.pro Amazon	`2021-11-17` - `2022-12-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://envious-cow.w5.wpsandbox.pro/alpha2/gr/
Frame ID: F42DECDD4832CB72710AAC44B9BF9D3C
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

myAlpha Web

Page URL History Show full URLs

http://embarrassed-worm.w5.wpsandbox.pro/ HTTP 302
https://envious-cow.w5.wpsandbox.pro/alpha2/ HTTP 302
https://envious-cow.w5.wpsandbox.pro/alpha2/gr/ Page URL

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1655 kB
Transfer

2828 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://embarrassed-worm.w5.wpsandbox.pro/ HTTP 302
https://envious-cow.w5.wpsandbox.pro/alpha2/ HTTP 302
https://envious-cow.w5.wpsandbox.pro/alpha2/gr/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
13 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response envious-cow.w5.wpsandbox.pro/alpha2/gr/ Redirect Chain http://embarrassed-worm.w5.wpsandbox.pro/ https://envious-cow.w5.wpsandbox.pro/alpha2/ https://envious-cow.w5.wpsandbox.pro/alpha2/gr/	2 MB 2 MB	185ms 185ms	Document text/html	54.157.141.105 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://envious-cow.w5.wpsandbox.pro/alpha2/gr/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.157.141.105 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-157-141-105.compute-1.amazonaws.com Software Apache/2.4.34 (Red Hat) / Resource Hash `971bffb999708ecde2d8727996c4e2327fb69ac2b893d2f0205f320072d13f16` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes content-length 1661302 content-type text/html; charset=UTF-8 date Tue, 14 Jun 2022 06:17:41 GMT etag "195976-5d9fcfc740080" last-modified Sat, 12 Mar 2022 03:24:34 GMT server Apache/2.4.34 (Red Hat) Redirect headers content-type text/html; charset=UTF-8 date Tue, 14 Jun 2022 06:17:41 GMT location gr/ server Apache/2.4.34 (Red Hat) x-powered-by PHP/7.2.34
GET DATA	200 OK	truncated /	451 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ccc3857f312489191143a105a811870ae647d7814faeeb54dc9873cd614022af` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `21503eecb48b62604d6855e33399ab5731f3679a03d412065ea47464de612785` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	197 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ac0e33bb17835c7f3da216a59602fddd36fe00ff0702519baa88ef212780a4c0` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	8 KB 8 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `de63222194af0292363f4acaf2e3162a13a088b327c27242f20c8c679b63bf80` Request headers Referer Origin https://envious-cow.w5.wpsandbox.pro accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type application/font-woff2
GET DATA	200 OK	truncated /	23 KB 23 KB		Font font/x-woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `971c63fd885d291336d9cccd8f2665180768cfd0aa1d944819e104fd9cba6de9` Request headers Referer Origin https://envious-cow.w5.wpsandbox.pro accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type font/x-woff
GET DATA	200 OK	truncated /	442 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a9ba69a712ca83a83213bb90a9f821da8c904c9f954eba6c5e7e23bdad6e2c3e` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	311 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a1612606ef48d6a8c375d4a747b8c1fe4f6927e242ec21c449b27ed0325505f2` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	350 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ed71ce33d772d291d9c787d26972c89d581a81b6b5e10bfaa8a18173a9877f4c` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4626e282c2921300f1f087f82643dfe7c3482ef156d4f151d5d892d1a6cb7f49` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	622 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `dd892e8748d7c8b9068fc17b082e57ba012a3e1923f8ea0323f4a325e5367e52` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	162 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a7b625a085dc2e7e3c7c5d882c279d6e6da3a860fb17c041232a575bfe033f1d` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1006 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0735fb7399059f96adfcea3b0378e2df6e08488c6b65627e4fb79e1d127b3336` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	675 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b9294cf365d3365ce77692019b950cd5c1c1ea1187aa6cc891b0ee1457578643` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alpha Bank (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

embarrassed-worm.w5.wpsandbox.pro
envious-cow.w5.wpsandbox.pro
54.157.141.105
54.235.242.85
0735fb7399059f96adfcea3b0378e2df6e08488c6b65627e4fb79e1d127b3336
21503eecb48b62604d6855e33399ab5731f3679a03d412065ea47464de612785
4626e282c2921300f1f087f82643dfe7c3482ef156d4f151d5d892d1a6cb7f49
971bffb999708ecde2d8727996c4e2327fb69ac2b893d2f0205f320072d13f16
971c63fd885d291336d9cccd8f2665180768cfd0aa1d944819e104fd9cba6de9
a1612606ef48d6a8c375d4a747b8c1fe4f6927e242ec21c449b27ed0325505f2
a7b625a085dc2e7e3c7c5d882c279d6e6da3a860fb17c041232a575bfe033f1d
a9ba69a712ca83a83213bb90a9f821da8c904c9f954eba6c5e7e23bdad6e2c3e
ac0e33bb17835c7f3da216a59602fddd36fe00ff0702519baa88ef212780a4c0
b9294cf365d3365ce77692019b950cd5c1c1ea1187aa6cc891b0ee1457578643
ccc3857f312489191143a105a811870ae647d7814faeeb54dc9873cd614022af
dd892e8748d7c8b9068fc17b082e57ba012a3e1923f8ea0323f4a325e5367e52
de63222194af0292363f4acaf2e3162a13a088b327c27242f20c8c679b63bf80
ed71ce33d772d291d9c787d26972c89d581a81b6b5e10bfaa8a18173a9877f4c

envious-cow.w5.wpsandbox.pro Open in urlscan Pro 54.157.141.105 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

2 IPs

1 Countries

1655 kBTransfer

2828 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 13 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

envious-cow.w5.wpsandbox.pro Open in urlscan Pro
54.157.141.105 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

2
IPs

1
Countries

1655 kB
Transfer

2828 kB
Size

0
Cookies

1 HTTP transactions
13 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!