interstoff.com.bd Open in urlscan Pro
182.160.99.190  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://behinyab.org/styles/sl.html?email=meleta%40prival.com Page URL
2. https://interstoff.com.bd/app-data/index.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	sl.html behinyab.org/styles/	572 B 658 B	341ms 113ms	Document text/html	185.165.116.31 DGPCO
General Check archive.org Show headers Download Go to Full URL http://behinyab.org/styles/sl.html?email=meleta%40prival.com Protocol HTTP/1.1 Server 185.165.116.31 , Iran, Islamic Republic Of, ASN207125 (DGPCO, IR), Reverse DNS av.wir4.31.maralhost.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Content-Encoding gzip Content-Length 334 Content-Type text/html Date Mon, 23 May 2022 15:03:17 GMT ETag "809c407b846ed81:0" Last-Modified Mon, 23 May 2022 09:07:09 GMT Server Microsoft-IIS/8.5 Vary Accept-Encoding X-Powered-By ASP.NET X-Powered-By-Plesk PleskWin
GET H/1.1	200 OK	Primary Request index.html Show response interstoff.com.bd/app-data/	11 KB 11 KB	1467ms 416ms	Document text/html	182.160.99.190 AAMRA-NETWORKS-AS...
General Check archive.org Show headers Download Go to Full URL https://interstoff.com.bd/app-data/index.html Requested by Host: behinyab.org URL: http://behinyab.org/styles/sl.html?email=meleta%40prival.com Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 182.160.99.190 Dhaka, Bangladesh, ASN24323 (AAMRA-NETWORKS-AS-AP aamra networks limited, BD), Reverse DNS vhost160.aamranetworks.com Software Apache / Resource Hash d97939235396151fbb8d80952da26d511f4d177959580ebe2d5616b712af731c Request headers Referer http://behinyab.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 11242 Content-Type text/html Date Mon, 23 May 2022 15:03:18 GMT Keep-Alive timeout=5, max=100 Last-Modified Mon, 23 May 2022 09:00:58 GMT Server Apache
GET H2	200	email-2-icon.png icons.iconarchive.com/icons/graphicloads/100-flat/256/	6 KB 7 KB	280ms 181ms	Image image/png	2606:4700:3038::6815:e9b5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:e9b5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c Request headers accept-language de-DE,de;q=0.9 Referer https://interstoff.com.bd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 15:03:20 GMT cf-cache-status REVALIDATED last-modified Wed, 08 Jul 2020 23:41:28 GMT server cloudflare etag "5f0659a8-19be" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jjq97O3C8aPNSwRv3JvN0HQfU945AhncAqhoiqclaCR3DLR6MxHjWBF3guST9nIFhgWELvXP7IX4CguSVTpLWF%2FzqcjvnmCTXvCcXucjHhDe2OIocL6OhlQaCjkdm0NcDvH%2FLm7%2Frdf9yHjZJx6jU203e5E%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 70fead818ea576ed-LHR alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6590
GET H2	200	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	248ms 148ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398 Request headers Referer https://interstoff.com.bd/ Origin https://interstoff.com.bd accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 15:03:20 GMT content-encoding gzip last-modified Fri, 20 Aug 2021 17:47:53 GMT server nginx etag W/"611feac9-10fdd" vary Accept-Encoding x-hw 1653318200.dop154.fr8.t,1653318200.cds279.fr8.hn,1653318200.cds257.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 23856
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	125ms 45ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://interstoff.com.bd/ Origin https://interstoff.com.bd accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 15:03:20 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 2216164 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6157 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cqQweFyO2xHhxWA4CSQnvLtGcLp6tU6ASgJU%2FjiQYcmACh83Wt9sPJAKcAlhFEIwAa4Nns3c9Kt53E8kBD27712fdKQF%2FMPUxw5ceO%2F%2B61rf97dP1cPfn0YAbQAV1HlA9fvRWRkafvxuEtSvdfL92XRV"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 70fead815df39293-FRA expires Sat, 13 May 2023 15:03:20 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/	48 KB 14 KB	138ms 59ms	Script application/javascript	2606:4700::6812:acf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://interstoff.com.bd/ Origin https://interstoff.com.bd accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 15:03:20 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 860 age 23504 cdn-cachedat 03/10/2022 17:24:53 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cdn-proxyver 1.02 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 etag W/"14d449eb8876fa55e1ef3c2cc52b0c17" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid ce7cf9934b1220f50433189c8430b2eb cf-ray 70fead8158e6696a-FRA cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	149ms 41ms	Script text/javascript	2a00:1450:4001:809::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://interstoff.com.bd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 12:06:58 GMT content-encoding gzip x-content-type-options nosniff age 10582 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 23 May 2023 12:06:58 GMT
GET H2	200	bootstrap.min.js Show response stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/	50 KB 15 KB	150ms 63ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://interstoff.com.bd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 15:03:20 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 723 age 10312745 cdn-cachedat 11/15/2021 23:30:00 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cdn-proxyver 1.0 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:06 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid a35b0179a28ed953258d0fb41376a09c cf-ray 70fead816ab59b28-FRA cdn-requestcountrycode DE cdn-status 200 cdn-requestpullsuccess True
GET H2	200	jquery.session.min.js Show response cdn.jsdelivr.net/npm/jquery.session@1.0.0/	2 KB 2 KB	127ms 49ms	Script application/javascript	2606:4700::6810:5914 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js Requested by Host: interstoff.com.bd URL: https://interstoff.com.bd/app-data/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://interstoff.com.bd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers date Mon, 23 May 2022 15:03:20 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 5463672 x-jsd-version 1.0.0 x-cache HIT, HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19171-FRA, cache-hhn4031-HHN timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"91d-mUGbC+S4VCL/hIcOVNvYpS3G2rE" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L6R8wVKMkV%2BzXA8stxj0K9Lt0pOfEpxPN0UV5cVhSPi5Uth2kjBBLZnFPrlJnK8W4OGmsU30qyBXkDaSsdbvdiU3yBkDN2CAfTNpO0biGLxWGls%2FjJskhwAn%2FnA6nXm2UrQdS6ERejR%2FVku%2FoMk%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 70fead815d009b39-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails function| getDateTime string| message function| clickIE function| clickNS function| disableCtrlKeyCombination function| $ function| jQuery function| Popper object| bootstrap string| currentTime

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			interstoff.com.bd/	1970-01-20 03:15:18	Name: __session:0.9507822091022335: Value: https:

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://interstoff.com.bd/app-data/index.html#meleta@prival.com Message: Mixed Content: The page at 'https://interstoff.com.bd/app-data/index.html#meleta@prival.com' was loaded over HTTPS, but requested an insecure element 'http://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://interstoff.com.bd/app-data/index.html#meleta@prival.com(Line 243) Message: Mixed Content: The page at 'https://interstoff.com.bd/app-data/index.html#meleta@prival.com' was loaded over HTTPS, but requested an insecure element 'http://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
behinyab.org
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
icons.iconarchive.com
interstoff.com.bd
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
182.160.99.190
185.165.116.31
2001:4de0:ac18::1:a:3a
2606:4700:3038::6815:e9b5
2606:4700::6810:5914
2606:4700::6811:180e
2606:4700::6812:acf
2606:4700::6812:bcf
2a00:1450:4001:809::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
d97939235396151fbb8d80952da26d511f4d177959580ebe2d5616b712af731c
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b