urlscan.io logo urlscan.io
SecurityTrails logo

www.strictlyslots.eu Open in urlscan Pro
51.89.188.198  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Submission Tags: @ipnigh
Submission: On September 10 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 51.89.188.198, located in France and belongs to OVH, FR. The main domain is www.strictlyslots.eu.
This is the only time www.strictlyslots.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Navy Federal Credit Union (Government)

Domain & IP information

IP Address AS Autonomous System
5 51.89.188.198 16276 (OVH)
5 1
Apex Domain
Subdomains		 Transfer
5 strictlyslots.eu
www.strictlyslots.eu
117 KB
5 1
Domain Requested by
5 www.strictlyslots.eu www.strictlyslots.eu
5 1

This site contains no links.

Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh

This page contains 1 frames:

Primary Page: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Frame ID: 9E8DD356F2F69C6903E12163FED381D6
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

117 kB
Transfer

116 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request fulls.php
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Protocol
HTTP/1.1
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
d6272578e2b251ccba38765252476c6a8d023d69b8073e21c693c998389cc84b

Request headers

Host
www.strictlyslots.eu
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:43 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
header.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/header.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
ac5e930c36d9bd29ecf5728664b92117d713e1effa7e4eefc2dfba9b3783d392

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:43 GMT
Last-Modified
Mon, 16 Apr 2018 18:59:22 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
25863
sigininss.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/sigininss.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
95f268067fcd1d7d7c4512eefb95c79e097c69d21835e2e8f05acb3e8a180cab

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:43 GMT
Last-Modified
Sun, 24 Jun 2018 17:49:56 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
34621
submit2.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/submit2.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
026689cf002276e84232ef3b81b37663fe2504ea4051f6509b7b2eefbadd0006

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:43 GMT
Last-Modified
Sun, 24 Jun 2018 17:36:28 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1494
end.PNG
www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/ 		53 KB
53 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/images/end.PNG
Requested by
Host: www.strictlyslots.eu
URL: http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
Protocol
HTTP/1.1
Security
, ,
Server
51.89.188.198 , France, ASN16276 (OVH, FR),
Reverse DNS
ip198.ip-51-89-188.eu
Software
Apache /
Resource Hash
c2e9b340b890890d30ab7b0d170f0b747827a04ced4e96e726cd5f11ec301976

Request headers

Referer
http://www.strictlyslots.eu/new/wp-content/plugins/bghh/112/fulls.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Tue, 10 Sep 2019 00:38:43 GMT
Last-Modified
Mon, 16 Apr 2018 19:08:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
54350

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Navy Federal Credit Union (Government)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| unhideBody

0 Cookies