shambika.com
Open in
urlscan Pro
199.43.206.69
Malicious Activity!
Public Scan
Submission: On March 22 via manual from TW
Summary
This is the only time shambika.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Global Sources (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 199.43.206.69 199.43.206.69 | 53340 (FIBERHUB) (FIBERHUB) | |
7 | 203.92.211.29 203.92.211.29 | 2687 (ATGS-MMD-AS) (ATGS-MMD-AS) | |
1 | 2620:1ec:46::19 2620:1ec:46::19 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
10 | 3 |
ASN53340 (FIBERHUB, US)
PTR: server1.shambika.com
shambika.com |
ASN2687 (ATGS-MMD-AS, US)
PTR: hkgs29.globalsources.com
login.globalsources.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
globalsources.com
login.globalsources.com |
65 KB |
2 |
shambika.com
shambika.com |
16 KB |
1 |
linkedin.com
platform.linkedin.com |
55 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
7 | login.globalsources.com |
shambika.com
|
2 | shambika.com |
shambika.com
|
1 | platform.linkedin.com |
shambika.com
|
10 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.globalsources.com |
login.globalsources.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
login.globalsources.com Thawte RSA CA 2018 |
2020-06-12 - 2021-10-08 |
a year | crt.sh |
platform.linkedin.com DigiCert SHA2 Secure Server CA |
2021-02-22 - 2021-08-21 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://shambika.com/Home/Global.htm
Frame ID: 7B51007190FF9BE27D856B885273F2A6
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
UNIX (Operating Systems) ExpandDetected patterns
- headers server /Unix/i
OpenSSL (Web Server Extensions) Expand
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Register now
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Security Measures
Search URL Search Domain Scan URL
Title: IP Policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Global.htm
shambika.com/Home/ |
15 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BASE.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SSO.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/ |
41 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jqueryandplugins.js
login.globalsources.com/sso/gsol/pex/en/balat/includes/ |
99 KB 35 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ssoscripts.js
login.globalsources.com/sso/gsol/pex/en/common/includes/ |
39 KB 11 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GS_LOGO.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
IN_ICO.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
in.js
platform.linkedin.com/ |
181 KB 55 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BLANK.GIF
login.globalsources.com/sso/gsol/pex/en/balat/images/ |
43 B 651 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webtrends-prod.js
shambika.com/sso/gsol/pex/en/balat/includes/ |
64 B 329 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Global Sources (E-commerce)164 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated object| sldpnl function| $ function| jQuery object| Color number| DELAY_SHOW_HIDE string| RFI_MINILOGIN string| RFI_MINIREG string| RFI_MINIREG_PALITE string| USER_REGISTRATION string| PALITE_UPGRADE string| USER_PROFILE string| RFQ_REG string| M_REG string| M_RFI_REG string| EMAGLITE_REG string| LOGIN_LINKEDIN string| BUYER_REGISTRATION_LINKEDIN string| LINKEDIN_EXISTING string| LINKEDIN_NEWREG string| LINKEDIN_EXISTING_NOAPP object| WTSI_P_PREFIX function| winPop function| winPop2 function| winPop3 function| sortThis function| toggleDefValue function| syncCheckboxToHidden function| checkValidID function| getRandom boolean| isMSIE3 string| path number| expDays object| exp string| value function| GetCookie function| SetCookie function| DeleteCookie function| setUniqCookie function| showBox function| hideBox function| delayShowBox function| delayHideBox function| delayShowBox2 function| delayHideBox2 function| toggleHiddenByCheckbox function| checkKeyword function| LTrim function| RTrim function| Trim function| checkIsFilledMandatory function| checkForEmailError function| validateEmailValue function| trimFieldValue function| checkforEmail function| checkEmailFieldNoTrack function| checkEmailIsNotInError function| checkEmailField function| showEmailTipWithError function| showEmailTipWithErrorEmag function| showEmailTipWithErrorEmagCheck function| showErrorEmagLoginCheck function| hasSpecialChars function| hasSpaceChars function| checkUidChar function| showUidTipWithError function| checkPwdChar function| checkValuesMatch function| isNum function| isNumWithSpace function| isPhone function| extendisPhone function| checkNameBg function| changeNameBg function| checkFieldIsNotInError function| changePhoneBg function| toggleLabelColor function| checkEmailBg function| checkPhoneBg function| validatePhoneForEmag function| validatePhoneNumberForEmag function| validatePhoneForOTP function| validateOTPInput function| hideErrorBoxForOTP function| checkPhoneBgEmag function| changeCompanyNameBg function| checkCompanyNameBgEmag function| checkNameBgEmagLiteForm function| checkEmagSelected function| validateCompanyNameForEmag function| checkCombineNameEmag function| checkNameBgEmagLiteFormNew function| checkCompanyURL function| checkCompanyURLFieldError function| checkCompanyURLField function| checkCompanyURLFieldMobile function| checkCompanyDescriptionField function| WTFieldErrorTag function| WTFieldPWLengthErrorTag function| WTFieldTag function| WTNumFieldTag string| msg_invalidemailchar string| msg_invalidemail string| invalidemailchar string| invalidemail string| iChar string| iEmail boolean| goWT_Track function| getEvent function| automailKeydown function| automail function| fillinmaill function| hideAutomailBox undefined| req undefined| ctyflag function| checkCountryFieldMobile function| validatingCountryMobile boolean| first_load function| processCountryMobile function| checkUid function| requestReminder function| removeSpaceTelFax function| removeSpaceTelMobile function| removeSpaces function| checkIMoption function| checkEMoption function| isEmpty function| validatePAKW function| toggleCheckBox undefined| compurl function| appendSuggestedCompUrl function| showOverlayLogin function| downloadfile function| checkCompanyURLFieldForSmallRFI function| InvalidMsg object| today number| timetoday number| randm string| timenow boolean| nets boolean| nseven number| bVer function| displayFocus function| login_decodeappURL function| login_decodeRegAppURL function| login_decodeSubAppURL function| displayAlert object| snooky function| showMsg object| __core-js_shared__ object| Sslac object| IN function| linkedinLogin function| setValue string| linkedinUserId string| emailaddr function| linkedinDoOnUserLogin function| ajaxCheckGSOLUser undefined| _tag0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.globalsources.com
platform.linkedin.com
shambika.com
199.43.206.69
203.92.211.29
2620:1ec:46::19
14efac6d0b6b202539b6925d00f07ac134ae965aa4feda15bd7a34a5d0aeebe3
186a9d2e228927f343665fe7bfeec6d02d00384b42c610a2ca0a969e163026e3
27dd4c4ecfe38fec71e2253eaf341ff66e6473219c1bf2af7b8cea3f365cbe16
5ee7561a3a5c0bcfd620ab6004ff7cab8ee16c800aada8a165c32cd104086cd5
7f3022abceb8c928d5b255a0437ea84e9db97229695596b340e3044fd8d8034f
9ec0e499f3c48bcb3347efe99d695288da5b2da94fe3333ca52b7bd7f0a075a1
a0ff7bd26675d0bd632c14628c1dbf2dd81ff6f092575f1616551d2eca4700b3
dd09ac569606839a91da1ec3b96ffa4e75cf303ffd0ea8a733c4e1befb8c8e12
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
f62fd5f40cbe91f8281fdab0ebb14faf5961cc10a304479dff25d9635e401aa8