urlscan.io logo urlscan.io
SecurityTrails logo

events4u.in Open in urlscan Pro
162.222.225.160  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://events4u.in/
Effective URL: http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f869...
Submission: On April 09 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 162.222.225.160, located in United States and belongs to PUBLIC-DOMAIN-REGISTRY, US. The main domain is events4u.in.
This is the only time events4u.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Wells Fargo (Banking)

Domain & IP information

IP Address AS Autonomous System
1 4 162.222.225.160 394695 (PUBLIC-DO...)
3 1
Apex Domain
Subdomains		 Transfer
4 events4u.in
events4u.in
2 MB
3 1
Domain Requested by
4 events4u.in 1 redirects events4u.in
3 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
Frame ID: B5C2B8B4E5BB61C8F465CF2205706B02
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://events4u.in/ HTTP 302
    http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

2517 kB
Transfer

2518 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://events4u.in/ HTTP 302
    http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 5797uke3wx2wzm3a8vb1evgf.php
events4u.in/
Redirect Chain
  • http://events4u.in/
  • http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628...
3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
Protocol
HTTP/1.1
Server
162.222.225.160 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
bh-43.webhostbox.net
Software
nginx/1.19.5 /
Resource Hash
ede5b5bff002027c01cb20a5412426d2efb521831357a6d0ad2355f2d850af84

Request headers

Host
events4u.in
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 09 Apr 2021 03:12:16 GMT
Server
nginx/1.19.5
Content-Type
text/html; charset=UTF-8
Content-Length
1186
Vary
Accept-Encoding
Content-Encoding
gzip
X-Server-Cache
false

Redirect headers

Date
Fri, 09 Apr 2021 03:12:15 GMT
Server
nginx/1.19.5
Content-Type
text/html; charset=UTF-8
Content-Length
0
Location
5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
X-Server-Cache
false
ww1.png
events4u.in/images/ 		2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://events4u.in/images/ww1.png
Requested by
Host: events4u.in
URL: http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
Protocol
HTTP/1.1
Server
162.222.225.160 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
bh-43.webhostbox.net
Software
nginx/1.19.5 /
Resource Hash
332c3c8cdb00148acbb78392e96dcfad53ad364f16b285fd1e010006d9c87ee1

Request headers

Referer
http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 09 Apr 2021 03:12:16 GMT
Content-Length
2525814
Last-Modified
Sat, 18 Jan 2020 15:52:44 GMT
Server
nginx/1.19.5
Accept-Ranges
bytes
X-Server-Cache
false
Content-Type
image/png
sub.png
events4u.in/images/ 		49 KB
49 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://events4u.in/images/sub.png
Requested by
Host: events4u.in
URL: http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
Protocol
HTTP/1.1
Server
162.222.225.160 , United States, ASN394695 (PUBLIC-DOMAIN-REGISTRY, US),
Reverse DNS
bh-43.webhostbox.net
Software
nginx/1.19.5 /
Resource Hash
a1dd63a4b71520cfab892499583c01c36a29ad683399f12eb5771c76d96e2cf9

Request headers

Referer
http://events4u.in/5797uke3wx2wzm3a8vb1evgf.php?193C4D1617937935fa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54efa628f70d3c50a2f8693491860bab54e&email=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 09 Apr 2021 03:12:16 GMT
Content-Length
50124
Last-Modified
Thu, 09 May 2019 20:29:38 GMT
Server
nginx/1.19.5
Accept-Ranges
bytes
X-Server-Cache
false
Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Wells Fargo (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

events4u.in
162.222.225.160
332c3c8cdb00148acbb78392e96dcfad53ad364f16b285fd1e010006d9c87ee1
a1dd63a4b71520cfab892499583c01c36a29ad683399f12eb5771c76d96e2cf9
ede5b5bff002027c01cb20a5412426d2efb521831357a6d0ad2355f2d850af84