ams-shared-7.hostwindsdns.com Open in urlscan Pro
192.236.208.112 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://alpha.securityhelp.co/
Effective URL:
https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/
Submission: On May 07 via automatic, source certstream-suspicious (May 7th 2022, 1:30:18 pm UTC) — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 15 HTTP transactions. The main IP is 192.236.208.112, located in United States and belongs to HOSTWINDS, US. The main domain is ams-shared-7.hostwindsdns.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 21st 2022. Valid for: 3 months.

This is the only time ams-shared-7.hostwindsdns.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alpha Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	192.236.208.152 192.236.208.152	54290 (HOSTWINDS) (HOSTWINDS)
14	192.236.208.112 192.236.208.112	54290 (HOSTWINDS) (HOSTWINDS)
1	2606:4700::68... 2606:4700::6812:1634	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	2

1 192.236.208.152 (United States) 1 redirects

ASN54290 (HOSTWINDS, US)
PTR: client-192-236-208-152.hostwindsdns.com

alpha.securityhelp.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 192.236.208.112 (United States)

ASN54290 (HOSTWINDS, US)
PTR: ams-shared-7.hostwindsdns.com

ams-shared-7.hostwindsdns.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1634 (United States)

ASN13335 (CLOUDFLARENET, US)

pro.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	hostwindsdns.com ams-shared-7.hostwindsdns.com	1 MB
1	fontawesome.com pro.fontawesome.com — Cisco Umbrella Rank: 9585	29 KB
1	securityhelp.co 1 redirects alpha.securityhelp.co	126 B
15	3

	Domain	Requested by
14	ams-shared-7.hostwindsdns.com	ams-shared-7.hostwindsdns.com
1	pro.fontawesome.com	ams-shared-7.hostwindsdns.com
1	alpha.securityhelp.co	1 redirects
15	3

This site contains no links.

Subject Issuer	Validity	Valid
ams-shared-7.hostwindsdns.com cPanel, Inc. Certification Authority	`2022-04-21` - `2022-07-20`	3 months	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/
Frame ID: 619BAC09FF3A41C7E2E827D1169C7DA6
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

myAlpha Web

Page URL History Show full URLs

https://alpha.securityhelp.co/ HTTP 301
https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

1292 kB
Transfer

1702 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://alpha.securityhelp.co/ HTTP 301
https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Redirect Chain https://alpha.securityhelp.co/ https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/	3 KB 1 KB	422ms 29ms	Document text/html	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `04653cc50ea8bc335b9e167660815f0b2c249f1b400da196d885365728ddd55e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-length 1138 content-type text/html; charset=UTF-8 date Sat, 07 May 2022 13:30:13 GMT server Apache vary Accept-Encoding Redirect headers content-length 273 content-type text/html; charset=iso-8859-1 date Sat, 07 May 2022 13:30:13 GMT location https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ server Apache
GET H2	200	bootstrap.css ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/	188 KB 22 KB	36ms 36ms	Stylesheet text/css	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/bootstrap.css Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Mon, 07 Dec 2020 16:50:12 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 21913
GET H2	200	test.css ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/	2 KB 554 B	17ms 16ms	Stylesheet text/css	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/test.css Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `88705c266eb60a4c909da982e30f850d9530e1fd3e0276505be76336d50ff5f2` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Thu, 13 Jan 2022 21:20:42 GMT server Apache vary Accept-Encoding content-type text/css accept-ranges bytes content-length 487
GET H2	200	html5shiv.min.js Show response ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/	3 KB 1 KB	19ms 18ms	Script application/javascript	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/html5shiv.min.js Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Mon, 21 Aug 2017 22:37:38 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 1203
GET H2	200	respond.min.js Show response ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/	4 KB 2 KB	20ms 20ms	Script application/javascript	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/respond.min.js Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Fri, 27 Jan 2017 06:50:18 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 2039
GET H2	200	all.css pro.fontawesome.com/releases/v5.10.0/css/	153 KB 29 KB	83ms 43ms	Stylesheet text/css	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.10.0/css/all.css Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec` Request headers Referer https://ams-shared-7.hostwindsdns.com/ Origin https://ams-shared-7.hostwindsdns.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding gzip vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cf-cache-status HIT age 633 x-amz-request-id QKN5F31WTFRHRVCB x-amz-id-2 NkYDB9WGQRa0NPErHVPMvABHM3euhZPJw8nv82ALsiDm60tIDUJRKo67PuqtSwYeOjbJVp6xexI= last-modified Mon, 28 Jun 2021 16:54:32 GMT server cloudflare etag W/"aa1272633e7e552395d147a499bad186" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * cache-control max-age=31556926 cf-ray 707a4f1b4a13233d-ZRH
GET H2	200	loogo.png ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/	3 KB 3 KB	20ms 20ms	Image image/png	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Show image Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/loogo.png Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `21503eecb48b62604d6855e33399ab5731f3679a03d412065ea47464de612785` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT last-modified Sun, 09 Jan 2022 19:23:44 GMT server Apache accept-ranges bytes content-length 3350 content-type image/png
GET H2	200	mavv.png ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/	3 KB 3 KB	21ms 20ms	Image image/png	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Show image Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/mavv.png Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `5ce6104922ccbbe7a252304948bcc08228ea0e1de72602b37fb0ecee8fb13bf0` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT last-modified Thu, 13 Jan 2022 20:10:28 GMT server Apache accept-ranges bytes content-length 3273 content-type image/png
GET H2	200	nav-left.png ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/	3 KB 3 KB	21ms 20ms	Image image/png	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Show image Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/nav-left.png Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `07770611de17caea37af5195b29db6960cb9b0a9bc737678ffc4e922f4cf619c` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT last-modified Thu, 13 Jan 2022 20:08:38 GMT server Apache accept-ranges bytes content-length 3266 content-type image/png
GET H2	200	forget.png ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/	1 KB 2 KB	20ms 20ms	Image image/png	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Show image Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/forget.png Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `9af3b6e46e12683a3320e4cc01f40ee593f35517c68cfbe696f2b73564dad606` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT last-modified Thu, 13 Jan 2022 20:57:56 GMT server Apache accept-ranges bytes content-length 1503 content-type image/png
GET H2	200	jquery-3.5.1.min.js Show response ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/	87 KB 30 KB	40ms 40ms	Script application/javascript	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/jquery-3.5.1.min.js Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Tue, 24 Nov 2020 01:18:24 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 30308
GET H2	200	bootstrap.min.js Show response ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/	61 KB 15 KB	38ms 38ms	Script application/javascript	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/bootstrap.min.js Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Mon, 07 Dec 2020 16:50:12 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 15397
GET H2	200	jquery.mask.js Show response ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/	23 KB 6 KB	25ms 24ms	Script application/javascript	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/js/jquery.mask.js Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT content-encoding br last-modified Tue, 24 Mar 2020 15:30:46 GMT server Apache vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 5594
GET H2	200	back.png ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/	162 KB 163 KB	14ms 14ms	Image image/png	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Show image Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/back.png Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/test.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `a7b625a085dc2e7e3c7c5d882c279d6e6da3a860fb17c041232a575bfe033f1d` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/test.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT last-modified Thu, 13 Jan 2022 20:23:32 GMT server Apache accept-ranges bytes content-length 165495 content-type image/png
GET H2	200	baa.png ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/	1006 KB 1011 KB	14ms 14ms	Image image/png	192.236.208.112 HOSTWINDS
General Check archive.org Show headers Download Go to Show image Full URL https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/image/baa.png Requested by Host: ams-shared-7.hostwindsdns.com URL: https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/test.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.236.208.112 , United States, ASN54290 (HOSTWINDS, US), Reverse DNS ams-shared-7.hostwindsdns.com Software Apache / Resource Hash `0735fb7399059f96adfcea3b0378e2df6e08488c6b65627e4fb79e1d127b3336` Request headers accept-language de-DE,de;q=0.9 Referer https://ams-shared-7.hostwindsdns.com/~xgtlfrsx/alpha/alphsecure/css/test.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36 Response headers date Sat, 07 May 2022 13:30:13 GMT last-modified Thu, 13 Jan 2022 20:26:00 GMT server Apache accept-ranges bytes content-length 1029774 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alpha Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alpha.securityhelp.co
ams-shared-7.hostwindsdns.com
pro.fontawesome.com
192.236.208.112
192.236.208.152
2606:4700::6812:1634
04653cc50ea8bc335b9e167660815f0b2c249f1b400da196d885365728ddd55e
0735fb7399059f96adfcea3b0378e2df6e08488c6b65627e4fb79e1d127b3336
07770611de17caea37af5195b29db6960cb9b0a9bc737678ffc4e922f4cf619c
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e
21503eecb48b62604d6855e33399ab5731f3679a03d412065ea47464de612785
2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9
2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec
5ce6104922ccbbe7a252304948bcc08228ea0e1de72602b37fb0ecee8fb13bf0
88705c266eb60a4c909da982e30f850d9530e1fd3e0276505be76336d50ff5f2
9af3b6e46e12683a3320e4cc01f40ee593f35517c68cfbe696f2b73564dad606
a199620fe981df00a825f78761d3f7c8870f8117daa4a890e08018dec386dae8
a7b625a085dc2e7e3c7c5d882c279d6e6da3a860fb17c041232a575bfe033f1d
dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

ams-shared-7.hostwindsdns.com Open in urlscan Pro 192.236.208.112 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

1292 kBTransfer

1702 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

ams-shared-7.hostwindsdns.com Open in urlscan Pro
192.236.208.112 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

1292 kB
Transfer

1702 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!