adoring-sinoussi.157-245-54-52.plesk.page
Open in
urlscan Pro
157.245.54.52
Malicious Activity!
Public Scan
Effective URL: https://adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/main.php
Submission: On October 12 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 11th 2022. Valid for: 3 months.
This is the only time adoring-sinoussi.157-245-54-52.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 50.116.94.129 50.116.94.129 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 8 | 157.245.54.52 157.245.54.52 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200a | 15169 (GOOGLE) (GOOGLE) | |
9 | 3 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 50-116-94-129.unifiedlayer.com
teba.kibarsoft.com |
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: mail.indon
adoring-sinoussi.157-245-54-52.plesk.page |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
plesk.page
1 redirects
adoring-sinoussi.157-245-54-52.plesk.page |
376 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 118 |
1 KB |
1 |
kibarsoft.com
teba.kibarsoft.com |
216 B |
9 | 3 |
Domain | Requested by | |
---|---|---|
8 | adoring-sinoussi.157-245-54-52.plesk.page |
1 redirects
adoring-sinoussi.157-245-54-52.plesk.page
|
1 | fonts.googleapis.com |
adoring-sinoussi.157-245-54-52.plesk.page
|
1 | teba.kibarsoft.com | |
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.teba.kibarsoft.com R3 |
2022-10-01 - 2022-12-30 |
3 months | crt.sh |
adoring-sinoussi.157-245-54-52.plesk.page R3 |
2022-10-11 - 2023-01-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-09-12 - 2022-12-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/main.php
Frame ID: 36730001AE8AC84B6B9DE5EDE9F2B474
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
index - homePage URL History Show full URLs
- https://teba.kibarsoft.com/readme.php?id=88474775810485058345 Page URL
-
https://adoring-sinoussi.157-245-54-52.plesk.page/themes
HTTP 301
https://adoring-sinoussi.157-245-54-52.plesk.page/themes/ Page URL
- https://adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/main.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://teba.kibarsoft.com/readme.php?id=88474775810485058345 Page URL
-
https://adoring-sinoussi.157-245-54-52.plesk.page/themes
HTTP 301
https://adoring-sinoussi.157-245-54-52.plesk.page/themes/ Page URL
- https://adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/main.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://adoring-sinoussi.157-245-54-52.plesk.page/themes HTTP 301
- https://adoring-sinoussi.157-245-54-52.plesk.page/themes/
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
readme.php
teba.kibarsoft.com/ |
102 B 216 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
adoring-sinoussi.157-245-54-52.plesk.page/themes/ Redirect Chain
|
78 B 591 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
main.php
adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kjas.css
adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/dwassa/ |
182 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kjd.png
adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/dwassa/pic/ |
178 KB 179 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down.png
adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/dwassa/pic/ |
76 KB 77 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/dwassa/ |
262 KB 73 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
adoring-sinoussi.157-245-54-52.plesk.page/themes/cap/dwassa/pic/ |
20 KB 21 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
adoring-sinoussi.157-245-54-52.plesk.page/ | Name: PHPSESSID Value: cvjn3oc15q9p58mcv9jfigbnpm |
|
.adoring-sinoussi.157-245-54-52.plesk.page/ | Name: antibot_a3e90e80f6700c59185233c5d5387532 Value: 2e7ec5c421a5f75c1beac46bd31378b2-1665580660 |
|
adoring-sinoussi.157-245-54-52.plesk.page/ | Name: antibot_hits Value: 3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adoring-sinoussi.157-245-54-52.plesk.page
fonts.googleapis.com
teba.kibarsoft.com
157.245.54.52
2a00:1450:4001:80e::200a
50.116.94.129
195d7bcb447834bc5a7a849742e243fbda88886e1212aa9a85cc23fe028c6583
61fcaf60ecdf8d6b29bdc104701cdedfe094c6341c96b3a7d676fdc2bfd1db06
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8a8bed3e9c069fd3a8f6e733c47d433e083c5c61788b88125f4d90ba33b7c0aa
a75a0f7bd46cfee0ff9091b25582fb77b622ae5610b73a787924986223fed5dd
b3cd66080f16d0be6cf4c8fcf24709d0c7909c0ff4ea95ee49c84424dbf7f8b2
d13a246d3a6066f48bccff33e931082ee06de02bf3cdadf63ae7b12a571adf68
f41428bb3f8bd412eed7e59325ab789007fb6362ec5f06da18c67e5bb7639114