sh005.hostgator.tempwebhost.net

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 162.241.85.138, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is sh005.hostgator.tempwebhost.net.

This is the only time sh005.hostgator.tempwebhost.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.184.197.212 18.184.197.212	16509 (AMAZON-02) (AMAZON-02)
1 6	162.241.85.138 162.241.85.138	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2a00:1450:400... 2a00:1450:4001:827::2010	15169 (GOOGLE) (GOOGLE)
6	2

1 18.184.197.212 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: eu-ip-2.short.io

3xnc.short.gy	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 162.241.85.138 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: sh005.hostgator.in

sh005.hostgator.tempwebhost.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	tempwebhost.net 1 redirects sh005.hostgator.tempwebhost.net	199 KB
1	googleapis.com storage.googleapis.com — Cisco Umbrella Rank: 492
1	short.gy 1 redirects 3xnc.short.gy	423 B
6	3

	Domain	Requested by
6	sh005.hostgator.tempwebhost.net	1 redirects sh005.hostgator.tempwebhost.net
1	storage.googleapis.com	sh005.hostgator.tempwebhost.net
1	3xnc.short.gy	1 redirects
6	3

This site contains no links.

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1C3	`2022-03-28` - `2022-06-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://sh005.hostgator.tempwebhost.net/~oiuytx5a/
Frame ID: 494EF75B2E955E5E52F64726715C7934
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

login

Page URL History Show full URLs

http://3xnc.short.gy/5RyHGL HTTP 302
http://sh005.hostgator.tempwebhost.net/~oiuytx5a HTTP 301
http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Page URL

Page Statistics

6
Requests

17 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

199 kB
Transfer

199 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://3xnc.short.gy/5RyHGL HTTP 302
http://sh005.hostgator.tempwebhost.net/~oiuytx5a HTTP 301
http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response sh005.hostgator.tempwebhost.net/~oiuytx5a/ Redirect Chain http://3xnc.short.gy/5RyHGL http://sh005.hostgator.tempwebhost.net/~oiuytx5a http://sh005.hostgator.tempwebhost.net/~oiuytx5a/	2 KB 927 B	362ms 362ms	Document text/html	162.241.85.138 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Protocol HTTP/1.1 Server 162.241.85.138 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh005.hostgator.in Software Apache / Resource Hash `2b24c174956cb1aff9849a61ac1fd6bbe9afa3f3377869808b8818df5e8faba5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 692 Content-Type text/html; charset=UTF-8 Date Tue, 19 Apr 2022 09:31:31 GMT Keep-Alive timeout=5, max=74 Server Apache Vary Accept-Encoding Redirect headers Connection Keep-Alive Content-Length 257 Content-Type text/html; charset=iso-8859-1 Date Tue, 19 Apr 2022 09:31:31 GMT Keep-Alive timeout=5, max=75 Location http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Server Apache
GET H2	404	1.js storage.googleapis.com/jsimg/	0 0	478ms 453ms	Script application/xml	2a00:1450:4001:827::2010 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://storage.googleapis.com/jsimg/1.js Requested by Host: sh005.hostgator.tempwebhost.net URL: http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer http://sh005.hostgator.tempwebhost.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers
GET H/1.1	200 OK	second.jpeg sh005.hostgator.tempwebhost.net/~oiuytx5a/	64 KB 64 KB	133ms 133ms	Image image/jpeg	162.241.85.138 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh005.hostgator.tempwebhost.net/~oiuytx5a/second.jpeg Requested by Host: sh005.hostgator.tempwebhost.net URL: http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Protocol HTTP/1.1 Server 162.241.85.138 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh005.hostgator.in Software Apache / Resource Hash `4859f37545a3638afb5135183bd7d0dd561034649f8944079e166ab4269b0b00` Request headers accept-language de-DE,de;q=0.9 Referer http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Tue, 19 Apr 2022 09:31:32 GMT Last-Modified Mon, 18 Apr 2022 10:13:22 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=73 Content-Length 65791
GET H/1.1	200 OK	fifth.jpeg sh005.hostgator.tempwebhost.net/~oiuytx5a/	32 KB 32 KB	130ms 129ms	Image image/jpeg	162.241.85.138 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh005.hostgator.tempwebhost.net/~oiuytx5a/fifth.jpeg Requested by Host: sh005.hostgator.tempwebhost.net URL: http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Protocol HTTP/1.1 Server 162.241.85.138 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh005.hostgator.in Software Apache / Resource Hash `704cbc8c7cce4ca10879990312bb9028f728c8426bc50a0a1fb537aa3b75e86b` Request headers accept-language de-DE,de;q=0.9 Referer http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Tue, 19 Apr 2022 09:31:32 GMT Last-Modified Mon, 18 Apr 2022 10:13:21 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=72 Content-Length 32314
GET H/1.1	200 OK	last.jpeg sh005.hostgator.tempwebhost.net/~oiuytx5a/	71 KB 71 KB	167ms 131ms	Image image/jpeg	162.241.85.138 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh005.hostgator.tempwebhost.net/~oiuytx5a/last.jpeg Requested by Host: sh005.hostgator.tempwebhost.net URL: http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Protocol HTTP/1.1 Server 162.241.85.138 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh005.hostgator.in Software Apache / Resource Hash `e90eed2ef9c236b4f4b605614d0ffb12453ce5166680234c94bbefc6958d3267` Request headers accept-language de-DE,de;q=0.9 Referer http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Tue, 19 Apr 2022 09:31:32 GMT Last-Modified Mon, 18 Apr 2022 10:13:21 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=71 Content-Length 72290
GET H/1.1	200 OK	sixth.jpeg sh005.hostgator.tempwebhost.net/~oiuytx5a/	31 KB 31 KB	250ms 127ms	Image image/jpeg	162.241.85.138 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL http://sh005.hostgator.tempwebhost.net/~oiuytx5a/sixth.jpeg Requested by Host: sh005.hostgator.tempwebhost.net URL: http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ Protocol HTTP/1.1 Server 162.241.85.138 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS sh005.hostgator.in Software Apache / Resource Hash `a3af3ed5fcef86976ed75590c6992970557814df6986856bb8d19690920979b3` Request headers accept-language de-DE,de;q=0.9 Referer http://sh005.hostgator.tempwebhost.net/~oiuytx5a/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers Date Tue, 19 Apr 2022 09:31:32 GMT Last-Modified Mon, 18 Apr 2022 10:13:22 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/jpeg Keep-Alive timeout=5, max=75 Content-Length 31255

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://storage.googleapis.com/jsimg/1.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3xnc.short.gy
sh005.hostgator.tempwebhost.net
storage.googleapis.com
162.241.85.138
18.184.197.212
2a00:1450:4001:827::2010
2b24c174956cb1aff9849a61ac1fd6bbe9afa3f3377869808b8818df5e8faba5
4859f37545a3638afb5135183bd7d0dd561034649f8944079e166ab4269b0b00
704cbc8c7cce4ca10879990312bb9028f728c8426bc50a0a1fb537aa3b75e86b
a3af3ed5fcef86976ed75590c6992970557814df6986856bb8d19690920979b3
e90eed2ef9c236b4f4b605614d0ffb12453ce5166680234c94bbefc6958d3267

sh005.hostgator.tempwebhost.net Open in urlscan Pro 162.241.85.138 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

17 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

199 kBTransfer

199 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

sh005.hostgator.tempwebhost.net Open in urlscan Pro
162.241.85.138 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

17 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

199 kB
Transfer

199 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!