URL: http://excaba.com/wp-content/magik/
Submission: On May 27 via manual from PL — Scanned from ES

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 217.76.132.218, located in Spain and belongs to IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE. The main domain is excaba.com.
This is the only time excaba.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
9 217.76.132.218 8560 (IONOS-AS ...)
9 2
Apex Domain
Subdomains
Transfer
9 excaba.com
excaba.com
394 KB
9 1
Domain Requested by
9 excaba.com excaba.com
9 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://excaba.com/wp-content/magik/
Frame ID: 34CF98B07C8304033A7497FD2EF7716C
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Webmail Portal Login

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

394 kB
Transfer

393 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
excaba.com/wp-content/magik/
14 KB
14 KB
Document
General
Full URL
http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
f6f68fb666e9f785c954e4ef71f24bac51685e198b7a0aaf3341fbde07ac97c6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Upgrade, Keep-Alive
Content-Length
13855
Content-Type
text/html; charset=UTF-8
Date
Fri, 27 May 2022 00:07:56 GMT
ETag
"361f-5d2cb5c29f180"
Keep-Alive
timeout=5, max=100
Last-Modified
Fri, 10 Dec 2021 14:15:50 GMT
Server
Apache
Upgrade
h2,h2c
26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
excaba.com/wp-content/magik/img/
55 KB
55 KB
Script
General
Full URL
http://excaba.com/wp-content/magik/img/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
759e0a1a0e85da19a0863978d2b3129a4d164b520af6ef0e34c7a03e041a7715

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/wp-content/magik/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:21:54 GMT
Server
Apache
ETag
"db2d-5d2c9c4b4dc80"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
56109
favicons.png
excaba.com/wp-content/magik/img/
492 B
787 B
Image
General
Full URL
http://excaba.com/wp-content/magik/img/favicons.png
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/wp-content/magik/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:23:58 GMT
Server
Apache
ETag
"1ec-5d2c9cc18f380"
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=5, max=100
Content-Length
492
26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
excaba.com/wp-content/magik/img/
55 KB
55 KB
Image
General
Full URL
http://excaba.com/wp-content/magik/img/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/wp-content/magik/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:21:54 GMT
Server
Apache
ETag
"db2d-5d2c9c4b4dc80"
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
image/png
Keep-Alive
timeout=5, max=100
Content-Length
56109
jquery-3.2.1.slim.min.js
excaba.com/wp-content/magik/js/
68 KB
68 KB
Script
General
Full URL
http://excaba.com/wp-content/magik/js/jquery-3.2.1.slim.min.js
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer
http://excaba.com/wp-content/magik/
Origin
http://excaba.com
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:25:52 GMT
Server
Apache
ETag
"10fdd-5d2c9d2e47400"
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
69597
popper.min.js
excaba.com/wp-content/magik/js/
19 KB
19 KB
Script
General
Full URL
http://excaba.com/wp-content/magik/js/popper.min.js
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Request headers

Referer
http://excaba.com/wp-content/magik/
Origin
http://excaba.com
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:26:08 GMT
Server
Apache
ETag
"4af4-5d2c9d3d89800"
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
19188
bootstrap.min.js
excaba.com/wp-content/magik/js/
48 KB
48 KB
Script
General
Full URL
http://excaba.com/wp-content/magik/js/bootstrap.min.js
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Request headers

Referer
http://excaba.com/wp-content/magik/
Origin
http://excaba.com
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:26:22 GMT
Server
Apache
ETag
"bf30-5d2c9d4ae3780"
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5, max=100
Content-Length
48944
jquery.min.js
excaba.com/wp-content/magik/js/
84 KB
84 KB
Script
General
Full URL
http://excaba.com/wp-content/magik/js/jquery.min.js
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/wp-content/magik/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:26:44 GMT
Server
Apache
ETag
"14e4a-5d2c9d5fde900"
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5, max=100
Content-Length
85578
bootstrap.minn.js
excaba.com/wp-content/magik/js/
50 KB
50 KB
Script
General
Full URL
http://excaba.com/wp-content/magik/js/bootstrap.minn.js
Requested by
Host: excaba.com
URL: http://excaba.com/wp-content/magik/
Protocol
HTTP/1.1
Server
217.76.132.218 , Spain, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
llgi819.servidoresdns.net
Software
Apache /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/wp-content/magik/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Fri, 27 May 2022 00:07:56 GMT
Last-Modified
Fri, 10 Dec 2021 12:36:08 GMT
Server
Apache
ETag
"c75f-5d2c9f79bde00"
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=5, max=100
Content-Length
51039
truncated
/
558 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
520 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

accept-language
es-ES,es;q=0.9
Referer
http://excaba.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| _0x29a3 function| _0x40b2 function| _0x2e20a0 string| hash number| n function| goNow function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

1 Console Messages

Source Level URL
Text
security error URL: http://excaba.com/wp-content/magik/
Message:
Refused to execute script from 'http://excaba.com/wp-content/magik/img/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png' because its MIME type ('image/png') is not executable.