www.marwanabboud.eu
Open in
urlscan Pro
2001:4b98:dc0:51:216:3eff:fe81:e8c4
Malicious Activity!
Public Scan
Effective URL: https://www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/clients/login.php
Submission: On November 14 via manual from ES — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 11th 2021. Valid for: 3 months.
This is the only time www.marwanabboud.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Caixabank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 103.50.161.244 103.50.161.244 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
1 | 18.223.137.151 18.223.137.151 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 151.101.66.137 151.101.66.137 | 54113 (FASTLY) (FASTLY) | |
1 | 162.247.243.147 162.247.243.147 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 2001:4b98:dc0... 2001:4b98:dc0:51:216:3eff:fe81:e8c4 | 29169 (GANDI-AS ...) (GANDI-AS Domain name registrar - www.gandi.net) | |
2 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | () () | |
23 | 10 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-223-137-151.us-east-2.compute.amazonaws.com
pblister.partsbase.com |
ASN29169 (GANDI-AS Domain name registrar - www.gandi.net, FR)
www.marwanabboud.eu |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
marwanabboud.eu
www.marwanabboud.eu |
25 KB |
3 |
ccurl.in
2 redirects
ccurl.in |
953 B |
2 |
cloudflare.com
cdnjs.cloudflare.com |
358 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net |
47 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
nr-data.net
bam-cell.nr-data.net |
711 B |
1 |
newrelic.com
js-agent.newrelic.com |
13 KB |
1 |
partsbase.com
pblister.partsbase.com |
5 KB |
0 |
gstatic.com
Failed
fonts.gstatic.com Failed |
|
23 | 10 |
Domain | Requested by | |
---|---|---|
11 | www.marwanabboud.eu |
www.marwanabboud.eu
|
3 | ccurl.in | 2 redirects |
2 | cdnjs.cloudflare.com |
www.marwanabboud.eu
|
2 | cdn.jsdelivr.net |
www.marwanabboud.eu
|
1 | fonts.googleapis.com |
www.marwanabboud.eu
|
1 | code.jquery.com |
www.marwanabboud.eu
|
1 | bam-cell.nr-data.net |
js-agent.newrelic.com
|
1 | js-agent.newrelic.com |
pblister.partsbase.com
|
1 | pblister.partsbase.com |
ccurl.in
|
0 | fonts.gstatic.com Failed |
fonts.googleapis.com
|
23 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ccurl.in cPanel, Inc. Certification Authority |
2021-10-19 - 2022-01-17 |
3 months | crt.sh |
pblister.partsbase.com Amazon |
2021-04-08 - 2022-05-07 |
a year | crt.sh |
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021 |
2021-10-06 - 2022-11-07 |
a year | crt.sh |
*.nr-data.net DigiCert SHA2 Secure Server CA |
2020-02-05 - 2022-02-08 |
2 years | crt.sh |
marwanabboud.eu R3 |
2021-10-11 - 2022-01-09 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-03 - 2022-07-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/clients/login.php
Frame ID: E3A807FF5C5377086C175DE1A85B52C2
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
ParticularesPage URL History Show full URLs
-
http://ccurl.in/4uYRDF
HTTP 301
https://ccurl.in/index.php?/4uYRDF HTTP 301
https://ccurl.in/?/4uYRDF Page URL
- https://pblister.partsbase.com/wp-content/plugins/jetpack/ Page URL
- https://www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/clients/login.php Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ccurl.in/4uYRDF
HTTP 301
https://ccurl.in/index.php?/4uYRDF HTTP 301
https://ccurl.in/?/4uYRDF Page URL
- https://pblister.partsbase.com/wp-content/plugins/jetpack/ Page URL
- https://www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/clients/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://ccurl.in/4uYRDF HTTP 301
- https://ccurl.in/index.php?/4uYRDF HTTP 301
- https://ccurl.in/?/4uYRDF
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
ccurl.in/ Redirect Chain
|
245 B 452 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
pblister.partsbase.com/wp-content/plugins/jetpack/ |
11 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1212.min.js
js-agent.newrelic.com/ |
34 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1860100c41
bam-cell.nr-data.net/1/ |
49 B 711 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/clients/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
1860100c41
bam-cell.nr-data.net/events/1/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
helpers.css
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/css/ |
41 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo2.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header-right.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lock.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
key1.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
key2.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
left.png
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/imgs/ |
370 B 693 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/js/ |
82 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.js
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.1/js/ |
1 MB 355 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.payment.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
www.marwanabboud.eu/wp-content/plugins/wp-file-manager/lib/files/sp/assets/js/ |
154 B 496 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bam-cell.nr-data.net
- URL
- https://bam-cell.nr-data.net/events/1/1860100c41?a=385203830&v=1212.e95d35c&to=MlMANhdRX0AEUU1fDAsZNxAMH0ZDSFFWWBcAWBZNFVxEVAxcShkJAEISAwZbHloLVlxOTRVeEg%3D%3D&rst=3660&ck=1&ref=https://pblister.partsbase.com/wp-content/plugins/jetpack/
- Domain
- fonts.gstatic.com
- URL
- https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Caixabank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.nr-data.net/ | Name: JSESSIONID Value: 4cf46e4b0eb29851 |
|
www.marwanabboud.eu/ | Name: PHPSESSID Value: 9q0voe19d4mul8fhu94i0ngl5l |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bam-cell.nr-data.net
ccurl.in
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
js-agent.newrelic.com
pblister.partsbase.com
www.marwanabboud.eu
bam-cell.nr-data.net
fonts.gstatic.com
103.50.161.244
151.101.66.137
162.247.243.147
18.223.137.151
2001:4b98:dc0:51:216:3eff:fe81:e8c4
2001:4de0:ac18::1:a:3b
2606:4700::6810:135e
2606:4700::6810:5814
2a00:1450:4001:813::200a
01066344ed84a8cfc6518af2398dead9ce515b86e710c4ad301049541722ddd9
20a3ef6979bbe5e4de1afaecc703e1d34cbc5e3ceab36d378539506327692d72
21778a3a131fbbf7366d7f69a3a8d97df1f7c7a186268cf20962468daeed07ae
236901c09ca4b7b523f990fdd398e7ba4bd1b2f2c4afb1a4f1a7116a536ee6ba
243e7d9077b620eb71838d4b489c0aa63b453912cfa2ca71b5f68a08c69959e1
2e17d633851029691b889873b7bec28230da38513ce85c0d71c8128950f55ac8
30277798a8da9431f198fef016d6e49e584af254677ad8e22bd76b7917a8b0cb
5cd785f49ff5a788853a8b1bc12a366f9f728c640bfbf239910fcca688cf3bcf
6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37
8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01
90ccdef28bfc80ac34562bcc8c1eebf8363338b226d80927cdf4f74d337608ac
9723a6d5f5ea669e43fd75e6af8770704573ebc065e148c13c78c334654f9007
a615a2d7035f38f27a596dab3e5e562a7b4db64ba7e995a89972ff2db1c2c4d0
a83848cf5c3d96caefe490c19e41659609b3691dd4c531cf925016c084d8e1b0
aae8036cd65073fc9ac788da5e6a6bb6ba6510da581d071e47b72f5344bf5a89
e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e
f7468a451c18a2e791e1a02de984336e4e2476eac60b238101e7f97e3e47eae6
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765