www.metin-ilac.com Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://symposium.kedokteran.ums.ac.id/wp-content/mu-plugins-old/bankofamericaupdate/ Page URL
2. https://www.metin-ilac.com/wp-content/bofasecureupdate/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ symposium.kedokteran.ums.ac.id/wp-content/mu-plugins-old/bankofamericaupdate/	366 B 509 B	2377ms 215ms	Document text/html	103.226.174.244 IDNIC-UMS-AS-ID U...
General Check archive.org Show headers Download Go to Full URL https://symposium.kedokteran.ums.ac.id/wp-content/mu-plugins-old/bankofamericaupdate/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 103.226.174.244 Semarang, Indonesia, ASN59275 (IDNIC-UMS-AS-ID Universitas Muhammadiyah Surakarta, ID), Reverse DNS Software Apache/2.4.41 (Ubuntu) / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Length 257 Content-Type text/html; charset=UTF-8 Date Mon, 17 Oct 2022 19:56:03 GMT Keep-Alive timeout=5, max=100 Server Apache/2.4.41 (Ubuntu) Vary Accept-Encoding
GET H2	200	Primary Request / Show response www.metin-ilac.com/wp-content/bofasecureupdate/	385 B 838 B	453ms 340ms	Document text/html	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.metin-ilac.com/wp-content/bofasecureupdate/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2e3fc978d46a004e403d9c1ba5776dd1163d58553bebbb664f4ad682d84b599c Request headers Referer https://symposium.kedokteran.ums.ac.id/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 75bb986bca6cca60-HAM content-encoding br content-type text/html; charset=UTF-8 date Mon, 17 Oct 2022 19:56:04 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SFjOWisraHcwHr%2BABa92LdWJ%2B%2FdJ1ajBb1RqS2Q0g3nH7JbyZj88uqMWEwhElEMGcsp%2FlT0nprm0xsT%2BIpalAshWjaHeHk5ThDwczeOJKAvPkxygeo448amEHSoGRYhEh0mhavnlErbnaoXarChPSZA%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	captcha.js Show response www.metin-ilac.com/wp-content/bofasecureupdate/assets/js/	244 KB 57 KB	313ms 312ms	Script application/javascript	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.metin-ilac.com/wp-content/bofasecureupdate/assets/js/captcha.js Requested by Host: www.metin-ilac.com URL: https://www.metin-ilac.com/wp-content/bofasecureupdate/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f4814d70ed99897016a16fab78fde915de3c3c645d4c4858fbed14d661ef401d Request headers accept-language de-DE,de;q=0.9 Referer https://www.metin-ilac.com/wp-content/bofasecureupdate/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 19:56:04 GMT content-encoding br cf-cache-status MISS last-modified Sat, 15 Oct 2022 12:47:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mwq9k9RQcynAp2We%2B0JC3E0n3j9DBMb0d%2FTqLheKQbtAPApXObKcsvNEYVSj8dlVmdb5F%2BPcifLOHt1ZkbSVOANEmC80KHux6PQ73HBXfimAF15%2BpiJzO8BeSDbZxD%2FdUw3vNWhDvuSdWvVEgliRhIo%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cf-ray 75bb986dedfaca60-HAM alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	captcha.png www.metin-ilac.com/wp-content/bofasecureupdate/	12 KB 13 KB	439ms 438ms	Image image/png	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.metin-ilac.com/wp-content/bofasecureupdate/captcha.png?_1666036566468 Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15c37f16e7c740bd8a5dc670ca05568c117cb30d034940ad393710d2b7891460 Request headers accept-language de-DE,de;q=0.9 Referer https://www.metin-ilac.com/wp-content/bofasecureupdate/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers pragma no-cache date Mon, 17 Oct 2022 19:56:06 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pQcDnoIXju6Llew6bLTpso1MLvA5kqpJXloNvYjLYOLFHHr0aIrkpfB8V64RxsTRmZLJUqvlBQW0saGrXQ5R%2F8hCIf%2Bg45GFLBgHVFPHKyuyRgaSPORutGVkee%2BHMj2Mo%2FMV0OPzUucMqJN%2FYXZSFNM%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control no-store, no-cache, must-revalidate cf-ray 75bb987c8cef90da-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	2134651.png www.metin-ilac.com/wp-content/bofasecureupdate/	59 KB 59 KB	250ms 249ms	Image image/png	2a06:98c1:3120::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.metin-ilac.com/wp-content/bofasecureupdate/2134651.png Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3905e9fdf4b9d870e33262cb2a396965988200627f882c3c68925ee302b2d32e Request headers accept-language de-DE,de;q=0.9 Referer https://www.metin-ilac.com/wp-content/bofasecureupdate/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36 Response headers date Mon, 17 Oct 2022 19:56:06 GMT cf-cache-status REVALIDATED last-modified Sat, 15 Oct 2022 12:47:14 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YByYOtwHH%2FpovNlDi3y0AKrpnd2IfcJNi26Wld3g6m55MozMlGB%2BdmpKK8kmRgGbFWUOI04pcR8FuscxGu1ctXpHI02nMRigdm96PUOlT7ZFO0Je%2FM0m3nWOS8Lsn5iELwwenhMQv20M2J%2F50npRuXM%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cf-ray 75bb987c8cf590da-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| setImmediate function| clearImmediate function| Vue

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.metin-ilac.com/	1970-01-20 06:47:23	Name: cazanova Value: acfde6af5fdacad1865348fe9d00cad2de6798a7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

symposium.kedokteran.ums.ac.id
www.metin-ilac.com
103.226.174.244
2a06:98c1:3120::3
15c37f16e7c740bd8a5dc670ca05568c117cb30d034940ad393710d2b7891460
2e3fc978d46a004e403d9c1ba5776dd1163d58553bebbb664f4ad682d84b599c
3905e9fdf4b9d870e33262cb2a396965988200627f882c3c68925ee302b2d32e
f4814d70ed99897016a16fab78fde915de3c3c645d4c4858fbed14d661ef401d