imustalk.com.ng - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 103.196.240.54, located in Netherlands and belongs to SERVERIUS-AS, NL. The main domain is imustalk.com.ng.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 7th 2018. Valid for: 3 months.

This is the only time imustalk.com.ng was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	94.76.196.98 94.76.196.98	29550 (SIMPLYTRA...) (SIMPLYTRANSIT)
1 6	103.196.240.54 103.196.240.54	50673 (SERVERIUS-AS) (SERVERIUS-AS)
6	2

1 94.76.196.98 (United Kingdom)

ASN29550 (SIMPLYTRANSIT, GB)
PTR: upfdd.co.uk

fabhull.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 103.196.240.54 (Netherlands) 1 redirects

ASN50673 (SERVERIUS-AS, NL)
PTR: hosted-by.speedhost247.com

imustalk.com.ng	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	imustalk.com.ng 1 redirects imustalk.com.ng	358 KB
1	fabhull.co.uk fabhull.co.uk	206 B
6	2

	Domain	Requested by
6	imustalk.com.ng	1 redirects fabhull.co.uk imustalk.com.ng
1	fabhull.co.uk
6	2

This site contains no links.

Subject Issuer	Validity	Valid
fabhull.co.uk Let's Encrypt Authority X3	`2018-07-12` - `2018-10-10`	3 months	crt.sh
imustalk.net Let's Encrypt Authority X3	`2018-07-07` - `2018-10-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
Frame ID: 1FE399253FBD3CA6276FFBEB0B1696D2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://fabhull.co.uk/readmon.php?userid= Page URL
https://imustalk.com.ng/ink/index.php?userid= HTTP 302
https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.177... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

358 kB
Transfer

360 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fabhull.co.uk/readmon.php?userid= Page URL
https://imustalk.com.ng/ink/index.php?userid= HTTP 302
https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 readmon.php Show response
fabhull.co.uk/ 107 B
206 B 140ms
95ms Document
text/html 94.76.196.98
SIMPLYTRANSIT

General

Check archive.org

Show headers Download Go to

Full URL: https://fabhull.co.uk/readmon.php?userid=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.76.196.98 , United Kingdom, ASN29550 (SIMPLYTRANSIT, GB),
Reverse DNS: upfdd.co.uk
Software: Apache /
Resource Hash: ec652da2c40f722fbc626c40be78cfe23804c6dc0a6c3d45d3615d9c2c4b79d3

Request headers

:method: GET
:authority: fabhull.co.uk
:scheme: https
:path: /readmon.php?userid=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 1FE399253FBD3CA6276FFBEB0B1696D2

Response headers

status: 200
date: Fri, 20 Jul 2018 01:59:06 GMT
server: Apache
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 113
content-type: text/html

GET
H2

200

Primary Request login.php Show response
imustalk.com.ng/ink/
Redirect Chain

https://imustalk.com.ng/ink/index.php?userid=
https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=

5 KB
2 KB

23ms
23ms

Document
text/html

103.196.240.54
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=

Requested by

Host: fabhull.co.uk
URL: https://fabhull.co.uk/readmon.php?userid=

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.196.240.54 , Netherlands, ASN50673 (SERVERIUS-AS, NL),

Reverse DNS

hosted-by.speedhost247.com

Software

nginx /

Resource Hash

7d79103ddb66bf305cae01f8ae7628d1cbdd5f1fc9309cf0d5baccc23c8585cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: imustalk.com.ng
:scheme: https
:path: /ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: https://fabhull.co.uk/readmon.php?userid=
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 1FE399253FBD3CA6276FFBEB0B1696D2
Referer: https://fabhull.co.uk/readmon.php?userid=

Response headers

status: 200
server: nginx
date: Fri, 20 Jul 2018 01:59:06 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: BYPASS
content-encoding: gzip

Redirect headers

status: 302
server: nginx
date: Fri, 20 Jul 2018 01:59:06 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: MISS

GET
H2 200 t3.png
imustalk.com.ng/ink/images/ 353 KB
354 KB 38ms
35ms Image
image/png 103.196.240.54
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imustalk.com.ng/ink/images/t3.png

Requested by

Host: imustalk.com.ng
URL: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.196.240.54 , Netherlands, ASN50673 (SERVERIUS-AS, NL),

Reverse DNS

hosted-by.speedhost247.com

Software

nginx /

Resource Hash

259155392eaaa969a5d5308ea31acf59a19b9c1f6d8e0a24922d392d1a3c4ac6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /ink/images/t3.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: imustalk.com.ng
referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
:scheme: https
:method: GET
Referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Jul 2018 01:59:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Jul 2018 22:26:47 GMT
server: nginx
x-nginx-cache-status: REVALIDATED
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-type: image/png
content-length: 361495
x-xss-protection: 1; mode=block
expires: Tue, 18 Sep 2018 01:59:07 GMT

GET
H2 200 t4.png
imustalk.com.ng/ink/images/ 838 B
1 KB 65ms
62ms Image
image/png 103.196.240.54
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imustalk.com.ng/ink/images/t4.png

Requested by

Host: imustalk.com.ng
URL: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.196.240.54 , Netherlands, ASN50673 (SERVERIUS-AS, NL),

Reverse DNS

hosted-by.speedhost247.com

Software

nginx /

Resource Hash

84d6a8ccb0e4f93f0ed990e4b8437f485cd5a44e2ea0ac8f7eb1e583f96d2403

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /ink/images/t4.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: imustalk.com.ng
referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
:scheme: https
:method: GET
Referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Jul 2018 01:59:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Jul 2018 22:26:47 GMT
server: nginx
x-nginx-cache-status: REVALIDATED
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-type: image/png
content-length: 838
x-xss-protection: 1; mode=block
expires: Tue, 18 Sep 2018 01:59:07 GMT

GET
H2 200 sgn.png
imustalk.com.ng/ink/images/ 523 B
778 B 65ms
61ms Image
image/png 103.196.240.54
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imustalk.com.ng/ink/images/sgn.png

Requested by

Host: imustalk.com.ng
URL: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.196.240.54 , Netherlands, ASN50673 (SERVERIUS-AS, NL),

Reverse DNS

hosted-by.speedhost247.com

Software

nginx /

Resource Hash

7b73f03db4759a9a8cfe2860f5af3f4e9be1101dc03ffba61357960947092bb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /ink/images/sgn.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: imustalk.com.ng
referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
:scheme: https
:method: GET
Referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Jul 2018 01:59:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Jul 2018 22:26:47 GMT
server: nginx
x-nginx-cache-status: REVALIDATED
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-type: image/png
content-length: 523
x-xss-protection: 1; mode=block
expires: Tue, 18 Sep 2018 01:59:07 GMT

GET
H2 200 csscheckbox_0f97b07d91ef3d2f1c0f936a59395179.png
imustalk.com.ng/ink/images/ 575 B
830 B 62ms
62ms Image
image/png 103.196.240.54
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imustalk.com.ng/ink/images/csscheckbox_0f97b07d91ef3d2f1c0f936a59395179.png

Requested by

Host: imustalk.com.ng
URL: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

103.196.240.54 , Netherlands, ASN50673 (SERVERIUS-AS, NL),

Reverse DNS

hosted-by.speedhost247.com

Software

nginx /

Resource Hash

d2411bbcca069ac6ab2351448046a9292904f2e5ab5196ab605851baf96ddac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /ink/images/csscheckbox_0f97b07d91ef3d2f1c0f936a59395179.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: imustalk.com.ng
referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
:scheme: https
:method: GET
Referer: https://imustalk.com.ng/ink/login.php?l=_JeHFUq_VJOXK0QWHtoGYDw1774256418&fid.13InboxLight.aspxn.1774256418&fid.125289964252813InboxLight99642_Product-userid&userid=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Fri, 20 Jul 2018 01:59:07 GMT
x-content-type-options: nosniff
last-modified: Thu, 19 Jul 2018 22:26:47 GMT
server: nginx
x-nginx-cache-status: REVALIDATED
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-type: image/png
content-length: 575
x-xss-protection: 1; mode=block
expires: Tue, 18 Sep 2018 01:59:07 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fabhull.co.uk
imustalk.com.ng
103.196.240.54
94.76.196.98
259155392eaaa969a5d5308ea31acf59a19b9c1f6d8e0a24922d392d1a3c4ac6
7b73f03db4759a9a8cfe2860f5af3f4e9be1101dc03ffba61357960947092bb6
7d79103ddb66bf305cae01f8ae7628d1cbdd5f1fc9309cf0d5baccc23c8585cf
84d6a8ccb0e4f93f0ed990e4b8437f485cd5a44e2ea0ac8f7eb1e583f96d2403
d2411bbcca069ac6ab2351448046a9292904f2e5ab5196ab605851baf96ddac2
ec652da2c40f722fbc626c40be78cfe23804c6dc0a6c3d45d3615d9c2c4b79d3

imustalk.com.ng Open in urlscan Pro 103.196.240.54 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

358 kBTransfer

360 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

imustalk.com.ng Open in urlscan Pro
103.196.240.54 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

358 kB
Transfer

360 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!