alege.malware.ltd
Open in
urlscan Pro
2a06:98c1:3121::c
Public Scan
Submission Tags: c2 malware evisyn Search All
Submission: On September 08 via api from US — Scanned from NL
Summary
This is the only time alege.malware.ltd was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2a06:98c1:312... 2a06:98c1:3121::c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:303... 2606:4700:3032::ac43:a9f7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
malware.ltd
alege.malware.ltd |
28 KB |
2 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1565 |
48 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1202 |
35 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 355 |
27 KB |
9 | 4 |
Domain | Requested by | |
---|---|---|
4 | alege.malware.ltd |
alege.malware.ltd
|
2 | use.fontawesome.com |
alege.malware.ltd
use.fontawesome.com |
2 | maxcdn.bootstrapcdn.com |
alege.malware.ltd
|
1 | cdnjs.cloudflare.com |
alege.malware.ltd
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-06 - 2023-06-05 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://alege.malware.ltd/login.php
Frame ID: 31C69FE68DD42E1EF297103F1DC4B963
Requests: 6 HTTP requests in this frame
Frame:
http://alege.malware.ltd/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1662609600
Frame ID: 406AFFB1B7AA56AE8D9E01FB7F28D690
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Evisyn — LoginDetected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css HTTP 307
- https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
- http://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js HTTP 307
- https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
- http://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js HTTP 307
- https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
alege.malware.ltd/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ Redirect Chain
|
141 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ Redirect Chain
|
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ Redirect Chain
|
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.0.8/css/ |
35 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
use.fontawesome.com/releases/v5.0.8/webfonts/ |
39 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
invisible.js
alege.malware.ltd/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 406A |
38 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pica.js
alege.malware.ltd/cdn-cgi/challenge-platform/h/b/scripts/ Frame 406A |
18 KB 8 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
747511ececd8b933
alege.malware.ltd/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 406A |
2 B 971 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| bootstrap function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
alege.malware.ltd/ | Name: PHPSESSID Value: lanl8vrth9u986rrv6e5003tnn |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
alege.malware.ltd
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
use.fontawesome.com
2606:4700:3032::ac43:a9f7
2606:4700::6811:180e
2606:4700::6812:bcf
2a06:98c1:3121::c
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
4080b83d8afc4487b8229308be2f196372bd2123613b46388048f14159f07181
434466b59545a8a1cac6ddb38197cdc6b35995a98c3f3812fb88d61b1c300dd3
4822bb909bccb119254db23efa490ecd498826e24620a3e1d7d88a595a364278
5c069cf9e9f31486aa83447225773cb1da8a86101295303143c26a8f9ed205a1
8455778b46ce10f15e74d6e0fe03bcca0f2e455bfaee68fbf861e259a65c12ef
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b