Submitted URL: https://moi.gov.ly/irsdaect.php
Effective URL: https://pointnepal.net/csss/signin.php
Submission Tags: 6868296
Submission: On November 30 via api from NL

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 24 HTTP transactions. The main IP is 167.86.77.147, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is pointnepal.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 14th 2020. Valid for: 3 months.
This is the only time pointnepal.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

IP Address AS Autonomous System
1 41.208.70.8 21003 (GPTC-AS)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 172.67.38.97 13335 (CLOUDFLAR...)
17 167.86.77.147 51167 (CONTABO)
1 2 162.144.65.124 46606 (UNIFIEDLA...)
24 7
Domain Requested by
17 pointnepal.net pointnepal.net
2 daebakpop.com 1 redirects pointnepal.net
1 secure.statcounter.com ajax.cloudflare.com
1 ajax.cloudflare.com nullrefer.com
1 nullrefer.com moi.gov.ly
1 moi.gov.ly
0 c.statcounter.com Failed secure.statcounter.com
24 7

This site contains no links.

Subject Issuer Validity Valid
moi.gov.ly
cPanel, Inc. Certification Authority
2020-09-16 -
2020-12-15
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-07-06 -
2021-07-06
a year crt.sh
ajax.cloudflare.com
DigiCert ECC Secure Server CA
2020-08-11 -
2022-08-16
2 years crt.sh
us-dallas.statcounter.com
Sectigo RSA Domain Validation Secure Server CA
2020-10-13 -
2021-11-13
a year crt.sh
mail.pointnepal.net
Let's Encrypt Authority X3
2020-10-14 -
2021-01-12
3 months crt.sh
daebakpop.com
Let's Encrypt Authority X3
2019-07-17 -
2019-10-15
3 months crt.sh

This page contains 1 frames:

Primary Page: https://pointnepal.net/csss/signin.php
Frame ID: 6A0B6D0A7A95EB753602F1A24B22D1DB
Requests: 24 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://moi.gov.ly/irsdaect.php Page URL
  2. https://nullrefer.com/?https://pointnepal.net/csss/signin.php Page URL
  3. https://pointnepal.net/csss/signin.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /dtagent.*\.js/i

Page Statistics

24
Requests

88 %
HTTPS

33 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

921 kB
Transfer

2185 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://moi.gov.ly/irsdaect.php Page URL
  2. https://nullrefer.com/?https://pointnepal.net/csss/signin.php Page URL
  3. https://pointnepal.net/csss/signin.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10
  • https://daebakpop.com/cart,jpg HTTP 302
  • https://daebakpop.com/cgi-sys/suspendedpage.cgi

24 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
irsdaect.php
moi.gov.ly/
297 B
505 B
Document
General
Full URL
https://moi.gov.ly/irsdaect.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
41.208.70.8 , Libya, ASN21003 (GPTC-AS, LY),
Reverse DNS
mail.moi.gov.ly
Software
Apache /
Resource Hash
5654bac0fe7eeb65202fbdefbe1fa8e1b37b0e8485440bdd55d0a24cf18dae51

Request headers

Host
moi.gov.ly
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 30 Nov 2020 00:21:24 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
/
nullrefer.com/
0
0

/
nullrefer.com/
823 B
1 KB
Document
General
Full URL
https://nullrefer.com/?https://pointnepal.net/csss/signin.php
Requested by
Host: moi.gov.ly
URL: https://moi.gov.ly/irsdaect.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681f:4024 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/5.3.28
Resource Hash
d771142ff862a306177e3e1af75360cfff55d21892c51d0b477c1df138647093

Request headers

:method
GET
:authority
nullrefer.com
:scheme
https
:path
/?https://pointnepal.net/csss/signin.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://moi.gov.ly/irsdaect.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://moi.gov.ly/irsdaect.php

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-type
text/html
set-cookie
__cfduid=d2d243108de9bef6257df667edc04bd051606695685; expires=Wed, 30-Dec-20 00:21:25 GMT; path=/; domain=.nullrefer.com; HttpOnly; SameSite=Lax
x-powered-by
PHP/5.3.28
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
06b81fa3df00009ace28333000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cnexCw%2FkMUUWRkN6m%2Fw9oPZ6hZA1NsWqyGVYl2ZLJo%2FlY38dvP3Ki1swD94K%2BLRGie%2FK1nSdadv5lXfI5KexO%2BnvHAi1VlPS2uiz%2FgEA3xQYSya1DCIXcmzh"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5fa0687fcde29ace-FRA
content-encoding
br
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/
12 KB
5 KB
Script
General
Full URL
https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Requested by
Host: nullrefer.com
URL: https://nullrefer.com/?https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://nullrefer.com/?https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
cf-request-id
06b81fa4c7000005d487285000000001
last-modified
Tue, 24 Nov 2020 15:06:25 GMT
server
cloudflare
x-frame-options
DENY
etag
W/"5fbd2171-3016"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5x68%2Ft7Nr9bzgBTtl7%2FFBAD7o1h9dBL1m0HlqX7hfNu4WFz53RsQAmkVp2h%2F%2Bwz4iw%2FKJcRmXFbLiCW%2F%2FrVTe62NvA6w8jqoGSW7Ih3dLp8%2BS9JffdcTKeGQGny%2F%2F1Hl"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
5fa068813ab905d4-FRA
expires
Wed, 02 Dec 2020 00:21:25 GMT
counter.js
secure.statcounter.com/counter/
36 KB
12 KB
Script
General
Full URL
https://secure.statcounter.com/counter/counter.js
Requested by
Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.38.97 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://nullrefer.com/?https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 09 Nov 2020 09:14:05 GMT
server
cloudflare
age
10607
etag
W/"5fa9085d-9109"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=43200
cf-ray
5fa0688279d01ece-AMS
cf-request-id
06b81fa58e00001ecef20ff000000001
expires
Mon, 30 Nov 2020 09:24:38 GMT
Primary Request signin.php
pointnepal.net/csss/
16 KB
4 KB
Document
General
Full URL
https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
d7e224b4059d991acf7e432be4d937645ad311d47b81c54c3c57bb27ff91d342
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pointnepal.net
:scheme
https
:path
/csss/signin.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://nullrefer.com/?https://pointnepal.net/csss/signin.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://nullrefer.com/?https://pointnepal.net/csss/signin.php

Response headers

server
nginx
date
Mon, 30 Nov 2020 00:21:25 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-nginx-upstream-cache-status
BYPASS
x-server-powered-by
Engintron
content-encoding
gzip
t.php
c.statcounter.com/
0
0

dtagent_A23STVjpqrvx_7000000151019.js
pointnepal.net/events/
0
0
Script
General
Full URL
https://pointnepal.net/events/dtagent_A23STVjpqrvx_7000000151019.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
link
<https://pointnepal.net/wp-json/>; rel="https://api.w.org/"
x-xss-protection
1; mode=block
appConfig.js
pointnepal.net/csss/web/2018.04.08-234/logon/js/
12 KB
3 KB
Script
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/logon/js/appConfig.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
07d3cce11dd0a62d1b9ffc0bc4c0ca1c94e2aa0a973903ae642cd8e40159964d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:16:16 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
expires
Wed, 30 Dec 2020 00:21:25 GMT
cache-control
max-age=2592000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
logon.css
pointnepal.net/csss/web/2018.04.08-234/logon/assets/
107 KB
15 KB
Stylesheet
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/logon/assets/logon.css
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
9d74a838c6dc6ef97b503a4aea8067b1651dcea1040783c481cdfc15e83b41dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:15:14 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
expires
Wed, 30 Dec 2020 00:21:25 GMT
cache-control
max-age=2592000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
blue-ui.css
pointnepal.net/csss/web/2018.04.08-234/common/assets/
380 KB
50 KB
Stylesheet
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/common/assets/blue-ui.css
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
e93833c14491ef399441c665587b8c356800b76add8759c4f314ab410b993b9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 03:59:06 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css
expires
Wed, 30 Dec 2020 00:21:25 GMT
cache-control
max-age=2592000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
suspendedpage.cgi
daebakpop.com/cgi-sys/
Redirect Chain
  • https://daebakpop.com/cart,jpg
  • https://daebakpop.com/cgi-sys/suspendedpage.cgi
0
0
Stylesheet
General
Full URL
https://daebakpop.com/cgi-sys/suspendedpage.cgi
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.144.65.124 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
theoryprinting.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

location
https://daebakpop.com/cgi-sys/suspendedpage.cgi
date
Mon, 30 Nov 2020 00:21:26 GMT
server
Apache
content-length
295
content-type
text/html; charset=iso-8859-1
main-ver.js
pointnepal.net/csss/web/library/blue-boot/dist/blue-boot/2.15.1/js/
69 KB
22 KB
Script
General
Full URL
https://pointnepal.net/csss/web/library/blue-boot/dist/blue-boot/2.15.1/js/main-ver.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
7f1c7b4ddc3ecad1a05bf350ee54460030650cc0ad7697e766a093620e80c893
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:20:30 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
expires
Wed, 30 Dec 2020 00:21:25 GMT
cache-control
max-age=2592000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
main.js
pointnepal.net/csss/web/library/blue-vendor/dist/blue-vendor/2.10.1/js/
0
0
Script
General
Full URL
https://pointnepal.net/csss/web/library/blue-vendor/dist/blue-vendor/2.10.1/js/main.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
link
<https://pointnepal.net/wp-json/>; rel="https://api.w.org/"
x-xss-protection
1; mode=block
main.js
pointnepal.net/csss/web/library/blue-core/dist/blue/2.14.1/js/
0
0
Script
General
Full URL
https://pointnepal.net/csss/web/library/blue-core/dist/blue/2.14.1/js/main.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
link
<https://pointnepal.net/wp-json/>; rel="https://api.w.org/"
x-xss-protection
1; mode=block
boot.js
pointnepal.net/csss/web/2018.04.08-234/logon/js/
886 KB
195 KB
Script
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/logon/js/boot.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
587505724086bd1b0f9fd00dba0ae5ff8a2eb88ac4717dcd0fabd061f23dec47
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:16:46 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
expires
Wed, 30 Dec 2020 00:21:27 GMT
cache-control
max-age=2592000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
main.js
pointnepal.net/csss/web/library/blue-app/dist/blue-app/2.12.1/js/
0
0
Script
General
Full URL
https://pointnepal.net/csss/web/library/blue-app/dist/blue-app/2.12.1/js/main.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
link
<https://pointnepal.net/wp-json/>; rel="https://api.w.org/"
x-xss-protection
1; mode=block
main.js
pointnepal.net/csss/web/library/blue-view/dist/blue-view/2.10.3/js/
0
0
Script
General
Full URL
https://pointnepal.net/csss/web/library/blue-view/dist/blue-view/2.10.3/js/main.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
link
<https://pointnepal.net/wp-json/>; rel="https://api.w.org/"
x-xss-protection
1; mode=block
main.js
pointnepal.net/csss/web/2018.04.08-234/appkit-utilities/dist/appkit-utilities/js/
76 KB
24 KB
Script
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/appkit-utilities/dist/appkit-utilities/js/main.js
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
35aba30d13f93e52e410195ab9aad9c4fa95de47f9f4e5431552cf4e32e372f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:11:12 GMT
server
nginx
vary
Accept-Encoding
content-type
application/javascript
expires
Wed, 30 Dec 2020 00:21:27 GMT
cache-control
max-age=2592000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
wordmark-white.svg
pointnepal.net/csss/web/2018.04.08-234/common/assets/img/logos/
1 KB
924 B
Image
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/common/assets/img/logos/wordmark-white.svg
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/web/2018.04.08-234/logon/assets/logon.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/web/2018.04.08-234/logon/assets/logon.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:13:54 GMT
server
nginx
vary
Accept-Encoding
content-type
image/svg+xml
expires
Fri, 29 Jan 2021 00:21:27 GMT
cache-control
max-age=5184000
x-server-powered-by
Engintron
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
default.jpeg
pointnepal.net/csss/content/geo-images/images/background.desktop.day.4.jpeg/
488 KB
488 KB
Image
General
Full URL
https://pointnepal.net/csss/content/geo-images/images/background.desktop.day.4.jpeg/default.jpeg
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
e35db11666e946f23bb84dcd1e23177da16ad76a5e86b579735b96a8918076e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 03:54:54 GMT
server
nginx
content-type
image/jpeg
expires
Fri, 29 Jan 2021 00:21:27 GMT
cache-control
max-age=5184000
x-server-powered-by
Engintron
accept-ranges
bytes
content-length
499367
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
opensans-regular.woff
pointnepal.net/csss/content/dam/cpo-static/fonts/
24 KB
25 KB
Font
General
Full URL
https://pointnepal.net/csss/content/dam/cpo-static/fonts/opensans-regular.woff
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
b8422277fc69c8e6ab51112dbf25048e40425cc497490fee251b56d7ef0ca179
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://pointnepal.net
Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 03:02:16 GMT
server
nginx
content-type
font/woff
expires
Fri, 29 Jan 2021 00:21:27 GMT
cache-control
max-age=5184000
x-server-powered-by
Engintron
accept-ranges
bytes
content-length
24876
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
opensans-semibold.woff
pointnepal.net/csss/content/dam/cpo-static/fonts/
25 KB
25 KB
Font
General
Full URL
https://pointnepal.net/csss/content/dam/cpo-static/fonts/opensans-semibold.woff
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/signin.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
d2113460c69de50edc6206a20deec3c2bc2733929f53817f1faca74ab34c33e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://pointnepal.net
Referer
https://pointnepal.net/csss/signin.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 03:55:42 GMT
server
nginx
content-type
font/woff
expires
Fri, 29 Jan 2021 00:21:27 GMT
cache-control
max-age=5184000
x-server-powered-by
Engintron
accept-ranges
bytes
content-length
25108
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT
dcefont.woff
pointnepal.net/csss/web/2018.04.08-234/common/assets/fonts/
51 KB
51 KB
Font
General
Full URL
https://pointnepal.net/csss/web/2018.04.08-234/common/assets/fonts/dcefont.woff
Requested by
Host: pointnepal.net
URL: https://pointnepal.net/csss/web/2018.04.08-234/common/assets/blue-ui.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.86.77.147 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
server15.namastehost.com
Software
nginx /
Resource Hash
002a5f21378ae680359252b4fb352a3de46ed0f33fec75e311b43eca7c9feddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://pointnepal.net
Referer
https://pointnepal.net/csss/web/2018.04.08-234/common/assets/blue-ui.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 30 Nov 2020 00:21:27 GMT
x-content-type-options
nosniff
last-modified
Sun, 15 Apr 2018 04:12:14 GMT
server
nginx
content-type
font/woff
expires
Fri, 29 Jan 2021 00:21:27 GMT
cache-control
max-age=5184000
x-server-powered-by
Engintron
accept-ranges
bytes
content-length
52400
x-xss-protection
1; mode=block
x-nginx-upstream-cache-status
HIT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
nullrefer.com
URL
https://nullrefer.com/?https://pointnepal.net/csss/signin.php
Domain
c.statcounter.com
URL
https://c.statcounter.com/t.php?sc_project=11231575&java=1&security=96323b3b&u1=C5CFE788A2E44F66297A0EED8B2BC791&sc_rum_f_s=0&sc_rum_f_e=522&sc_rum_e_s=532&sc_rum_e_e=552&sc_random=0.09214229572740495&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=https%3A//moi.gov.ly/irsdaect.php&u=https%3A//nullrefer.com/%3Fhttps%3A//pointnepal.net/csss/signin.php&t=Nullrefer.com%20Anonym%20Link&rcat=r&rdom=moi.gov.ly&rdomg=new&bb=1&sc_snum=1&sess=6ea6fa&p=0&invisible=1&get_config=true

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| initAppConfig function| loaderCallback function| processClientEnvProps function| requirejs function| require function| define object| Blue undefined| envConfig undefined| appConfig

0 Cookies