princessgroup.ae Open in urlscan Pro
108.170.35.139 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://princessgroup.ae/iqpi/qbot.zip
Effective URL:
https://princessgroup.ae/wp-admin/setup-config.php
Submission Tags: falconsandbox
Submission: On February 20 via api (February 20th 2023, 5:21:20 am UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 108.170.35.139, located in Phoenix, United States and belongs to SSASN2, US. The main domain is princessgroup.ae.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 16th 2022. Valid for: 3 months.

This is the only time princessgroup.ae was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 12	108.170.35.139 108.170.35.139		20454 (SSASN2) (SSASN2)
11	1

12 108.170.35.139 (Phoenix, United States) 1 redirects

ASN20454 (SSASN2, US)
PTR: gains.bsafemail.com

princessgroup.ae	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	princessgroup.ae 1 redirects princessgroup.ae	216 KB
11	1

	Domain	Requested by
12	princessgroup.ae	1 redirects princessgroup.ae
11	1

This site contains no links.

Subject Issuer	Validity	Valid
princessgroup.ae cPanel, Inc. Certification Authority	`2022-12-16` - `2023-03-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://princessgroup.ae/wp-admin/setup-config.php
Frame ID: 638C381590495CE970F4268F95C6B20E
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WordPress › Setup Configuration File

Page URL History Show full URLs

https://princessgroup.ae/iqpi/qbot.zip HTTP 302
https://princessgroup.ae/wp-admin/setup-config.php Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

216 kB
Transfer

213 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://princessgroup.ae/iqpi/qbot.zip HTTP 302
https://princessgroup.ae/wp-admin/setup-config.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request setup-config.php Show response princessgroup.ae/wp-admin/ Redirect Chain https://princessgroup.ae/iqpi/qbot.zip https://princessgroup.ae/wp-admin/setup-config.php	13 KB 13 KB	1106ms 1106ms	Document text/html	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `7cb96cc92fe315659dcd0c1aa6d7e16d4ffa0cfcdbda1742aea2f0b632a245f8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Content-Length 13102 Content-Type text/html; charset=utf-8 Date Mon, 20 Feb 2023 05:21:14 GMT Expires Wed, 11 Jan 1984 05:00:00 GMT Keep-Alive timeout=40, max=99 Server Apache Redirect headers Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 20 Feb 2023 05:21:14 GMT Keep-Alive timeout=40, max=100 Location https://princessgroup.ae/wp-admin/setup-config.php Server Apache
GET H/1.1	200 OK	dashicons.min.css princessgroup.ae/wp-includes/css/	58 KB 58 KB	348ms 200ms	Stylesheet text/css	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-includes/css/dashicons.min.css?ver=6.1.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Wed, 03 Mar 2021 21:16:22 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=98 Content-Length 59016
GET H/1.1	200 OK	buttons.min.css princessgroup.ae/wp-includes/css/	6 KB 6 KB	482ms 172ms	Stylesheet text/css	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-includes/css/buttons.min.css?ver=6.1.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `a263951ba358b2b766fe5e06c24a5869f2a67aeee53a4ba7d3b1f9d478fc3c34` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Mon, 15 Nov 2021 23:22:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=100 Content-Length 5854
GET H/1.1	200 OK	forms.min.css princessgroup.ae/wp-admin/css/	26 KB 26 KB	491ms 181ms	Stylesheet text/css	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-admin/css/forms.min.css?ver=6.1.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `f04177c2afea04d6213980ae38e1f23d791f4d8c166018cc0cbd72c21f4a2c14` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Thu, 15 Sep 2022 22:59:11 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=100 Content-Length 26233
GET H/1.1	200 OK	l10n.min.css princessgroup.ae/wp-admin/css/	2 KB 3 KB	498ms 186ms	Stylesheet text/css	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-admin/css/l10n.min.css?ver=6.1.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `86669f0412fff3ba05a09c21f077c7a9ec4d9054633216b6ce04eb3c6c57538b` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Tue, 11 Dec 2018 16:13:26 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=100 Content-Length 2477
GET H/1.1	200 OK	install.min.css princessgroup.ae/wp-admin/css/	5 KB 5 KB	500ms 188ms	Stylesheet text/css	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-admin/css/install.min.css?ver=6.1.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `b1982495819ff087df70175807cac7ff5714009c6e227e5474d1379119a57173` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Thu, 02 Sep 2021 22:18:00 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=100 Content-Length 4954
GET H/1.1	200 OK	jquery.min.js Show response princessgroup.ae/wp-includes/js/jquery/	88 KB 88 KB	341ms 178ms	Script application/javascript	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-includes/js/jquery/jquery.min.js?ver=3.6.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Mon, 19 Sep 2022 14:16:24 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=100 Content-Length 89684
GET H/1.1	200 OK	jquery-migrate.min.js Show response princessgroup.ae/wp-includes/js/jquery/	11 KB 11 KB	527ms 193ms	Script application/javascript	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Wed, 18 Nov 2020 09:06:06 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=99 Content-Length 11224
GET H/1.1	200 OK	language-chooser.min.js Show response princessgroup.ae/wp-admin/js/	423 B 678 B	563ms 214ms	Script application/javascript	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Full URL https://princessgroup.ae/wp-admin/js/language-chooser.min.js?ver=6.1.1 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/setup-config.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `ccc2c261625acaeefe4b29d33f962ff6cff548edb2d37782f5522f3d3e56b816` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/setup-config.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:15 GMT Last-Modified Tue, 23 Feb 2021 19:45:04 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=99 Content-Length 423
GET H/1.1	200 OK	wordpress-logo.svg princessgroup.ae/wp-admin/images/	1 KB 2 KB	181ms 180ms	Image image/svg+xml	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://princessgroup.ae/wp-admin/images/wordpress-logo.svg?ver=20131107 Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/css/install.min.css?ver=6.1.1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/css/install.min.css?ver=6.1.1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:16 GMT Last-Modified Sun, 05 Apr 2015 21:20:27 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=99 Content-Length 1521
GET H/1.1	200 OK	spinner.gif princessgroup.ae/wp-admin/images/	4 KB 4 KB	195ms 195ms	Image image/gif	108.170.35.139 SSASN2
General Check archive.org Show headers Download Go to Show image Full URL https://princessgroup.ae/wp-admin/images/spinner.gif Requested by Host: princessgroup.ae URL: https://princessgroup.ae/wp-admin/css/install.min.css?ver=6.1.1 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 108.170.35.139 Phoenix, United States, ASN20454 (SSASN2, US), Reverse DNS gains.bsafemail.com Software Apache / Resource Hash `5c2d44038a6c53bd74f3a26e690c1974e1385fffbc6def4c59f91dc1f738f0b3` Request headers accept-language de-DE,de;q=0.9 Referer https://princessgroup.ae/wp-admin/css/install.min.css?ver=6.1.1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 05:21:16 GMT Last-Modified Tue, 16 Nov 2021 00:04:01 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=40, max=97 Content-Length 3656

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange undefined| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

princessgroup.ae
108.170.35.139
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
5c2d44038a6c53bd74f3a26e690c1974e1385fffbc6def4c59f91dc1f738f0b3
7cb96cc92fe315659dcd0c1aa6d7e16d4ffa0cfcdbda1742aea2f0b632a245f8
86669f0412fff3ba05a09c21f077c7a9ec4d9054633216b6ce04eb3c6c57538b
a0bbefd626f1e76f9245ec6c6101b679ba27412b71b32fc43eccda9db40f394b
a263951ba358b2b766fe5e06c24a5869f2a67aeee53a4ba7d3b1f9d478fc3c34
b1982495819ff087df70175807cac7ff5714009c6e227e5474d1379119a57173
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
ccc2c261625acaeefe4b29d33f962ff6cff548edb2d37782f5522f3d3e56b816
f04177c2afea04d6213980ae38e1f23d791f4d8c166018cc0cbd72c21f4a2c14

princessgroup.ae Open in urlscan Pro 108.170.35.139 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

216 kBTransfer

213 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

0 Cookies

Indicators

princessgroup.ae Open in urlscan Pro
108.170.35.139 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

216 kB
Transfer

213 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions