urlscan.io logo urlscan.io
SecurityTrails logo

skripsiku.ga Open in urlscan Pro
145.14.144.229  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://skripsiku.ga/index.php
Submission: On April 18 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 145.14.144.229, located in Netherlands and belongs to AWEX, US. The main domain is skripsiku.ga.
This is the only time skripsiku.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

IP Address AS Autonomous System
1 145.14.144.229 204915 (AWEX)
1 91.198.174.208 14907 (WIKIMEDIA)
1 207.154.19.194 33251 (AS-TIERP-...)
2 172.217.22.35 15169 (GOOGLE)
5 4
Domain Requested by
2 fonts.gstatic.com skripsiku.ga
1 wabashin.myseniorcenter.net skripsiku.ga
1 upload.wikimedia.org skripsiku.ga
1 skripsiku.ga
5 4

This site contains links to these domains. Also see Links.

Domain
accounts.google.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://skripsiku.ga/index.php
Frame ID: 882ED836BD6E091160D7D99587D8250F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

134 kB
Transfer

170 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.php
skripsiku.ga/ 		61 KB
23 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://skripsiku.ga/index.php
Protocol
HTTP/1.1
Server
145.14.144.229 , Netherlands, ASN204915 (AWEX, US),
Reverse DNS
Software
awex /
Resource Hash
2bbbc135fd431e38a64dafebd60c7e437ea9380c5d7add796a4770c73fc346e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
skripsiku.ga
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Wed, 18 Apr 2018 05:39:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
awex
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Connection
keep-alive
X-Xss-Protection
1; mode=block
X-Request-ID
558a7cc7ea15d09e93bafe7d1ddb7904
2000px-Google_2015_logo.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/2/2f/Google_2015_logo.svg/ 		71 KB
72 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://upload.wikimedia.org/wikipedia/commons/thumb/2/2f/Google_2015_logo.svg/2000px-Google_2015_logo.svg.png
Requested by
Host: skripsiku.ga
URL: http://skripsiku.ga/index.php
Protocol
SPDY
Server
91.198.174.208 , Netherlands, ASN14907 (WIKIMEDIA - Wikimedia Foundation Inc., US),
Reverse DNS
upload-lb.esams.wikimedia.org
Software
/
Resource Hash
8ae0c82957607151809bfc7ed8e2bba29e3f9e06e5edc39ee0d1f5dcb75c840f
Security Headers
Name Value
Strict-Transport-Security max-age=106384710; includeSubDomains; preload

Request headers

Referer
http://skripsiku.ga/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

x-analytics
https=1;nocookies=1
date
Wed, 18 Apr 2018 05:39:58 GMT
via
1.1 varnish (Varnish/5.1), 1.1 varnish (Varnish/5.1), 1.1 varnish (Varnish/5.1)
age
12641
x-cache-status
hit-front
x-cache
cp1074 hit/7, cp3045 hit/5, cp3035 hit/12
status
200
x-trans-id
tx988e1168b105494dbb965-005ad6a8cb
x-client-ip
148.251.45.254
timing-allow-origin
*
accept-ranges
bytes
last-modified
Tue, 10 Oct 2017 16:33:07 GMT
etag
54b30123af76bc6fe7759b3498002cb0
strict-transport-security
max-age=106384710; includeSubDomains; preload
x-varnish
363192199 364225731, 398298734 396501208, 130155254 114989945
access-control-allow-origin
*
x-timestamp
1507653186.73951
content-length
72991
content-type
image/png
access-control-expose-headers
Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache, X-Varnish
default-profile.png
wabashin.myseniorcenter.net/Content/Images/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wabashin.myseniorcenter.net/Content/Images/default-profile.png
Requested by
Host: skripsiku.ga
URL: http://skripsiku.ga/index.php
Protocol
HTTP/1.1
Server
207.154.19.194 Saint Louis, United States, ASN33251 (AS-TIERP-33251 - TierPoint, LLC, US),
Reverse DNS
mail.xavus.com
Software
Microsoft-IIS/8.0 / ASP.NET
Resource Hash
db9aa751383e6261b485fb9aeb1cab5d28446df96f1b4277c7e51610bc9f20fa

Request headers

Referer
http://skripsiku.ga/index.php
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date
Wed, 18 Apr 2018 05:44:59 GMT
Last-Modified
Fri, 03 Jul 2015 10:40:04 GMT
Server
Microsoft-IIS/8.0
X-Powered-By
ASP.NET
ETag
"e79599f7cb5d01:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
7203
DXI1ORHCpsQm3Vp6mXoaTegdm0LZdjqr5-oayXSOefg.woff2
fonts.gstatic.com/s/opensans/v10/ 		16 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTegdm0LZdjqr5-oayXSOefg.woff2
Requested by
Host: skripsiku.ga
URL: http://skripsiku.ga/index.php
Protocol
HTTP/1.1
Server
172.217.22.35 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f35.1e100.net
Software
sffe /
Resource Hash
30427ab021a9d28d0f9724a8565c2463ee5a3938417dd0750d58ab79ac07cf12
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer
http://skripsiku.ga/index.php
Origin
http://skripsiku.ga

Response headers

Date
Sun, 04 Feb 2018 11:04:03 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Aug 2014 18:08:10 GMT
Server
sffe
Age
6287755
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
16212
X-XSS-Protection
1; mode=block
Expires
Mon, 04 Feb 2019 11:04:03 GMT
cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2
fonts.gstatic.com/s/opensans/v10/ 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3VtXRa8TVwTICgirnJhmVJw.woff2
Requested by
Host: skripsiku.ga
URL: http://skripsiku.ga/index.php
Protocol
HTTP/1.1
Server
172.217.22.35 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f35.1e100.net
Software
sffe /
Resource Hash
3135160ee3b34e2d1e58bf80944a1ed2cef3f073528ea98f11916a397b4c6ac9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer
http://skripsiku.ga/index.php
Origin
http://skripsiku.ga

Response headers

Date
Mon, 12 Feb 2018 14:47:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 21 Aug 2014 18:06:58 GMT
Server
sffe
Age
5583119
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
15556
X-XSS-Protection
1; mode=block
Expires
Tue, 12 Feb 2019 14:47:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| shortcut function| gaia_attachEvent object| G function| Gb function| Ga object| Gc function| Gf function| Gg function| Gh function| Gd function| Ge function| Gi function| Gj function| Gl function| Gk object| Gm object| Gn function| Go function| Gp object| Gq object| Gr object| Gs object| Gt function| Gu function| Gv function| Gw function| Gx function| G_checkConnectionMain function| G_setPostMessageSupportFlag object| __CHECK_CONNECTION_CONFIG object| botguard function| gaia_parseFragment function| gaia_prefillEmail object| hashParams function| gaia_setFocus function| gaia_scrollToElement function| onMessage function| gaia_onChromeLoginSubmit function| gaia_onLoginSubmit

2 Cookies

Domain/Path Name / Value
accounts.youtube.com/accounts Name: CheckConnectionTempCookie683
Value: 874778
accounts.youtube.com/accounts Name: CheckConnectionTempCookie882
Value: 630046

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block