kalbamall.ae
Open in
urlscan Pro
160.153.235.124
Malicious Activity!
Public Scan
Effective URL: https://kalbamall.ae/cai/bimo/particular/login.php
Submission: On February 20 via manual from ES — Scanned from ES
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 12th 2021. Valid for: 3 months.
This is the only time kalbamall.ae was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Caixabank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 184.168.98.120 184.168.98.120 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
2 9 | 160.153.235.124 160.153.235.124 | 21501 (GODADDY-AMS) (GODADDY-AMS) | |
2 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 5 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-184-168-98-120.ip.secureserver.net
sbpackersmovers.co.in |
ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-235-124.ip.secureserver.net
kalbamall.ae |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
kalbamall.ae
2 redirects
kalbamall.ae |
1 MB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 197 |
25 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 610 |
32 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 250 |
31 KB |
1 |
sbpackersmovers.co.in
sbpackersmovers.co.in |
834 B |
13 | 5 |
Domain | Requested by | |
---|---|---|
9 | kalbamall.ae |
2 redirects
sbpackersmovers.co.in
kalbamall.ae |
2 | cdnjs.cloudflare.com |
kalbamall.ae
cdnjs.cloudflare.com |
2 | maxcdn.bootstrapcdn.com |
kalbamall.ae
|
1 | ajax.googleapis.com |
kalbamall.ae
|
1 | sbpackersmovers.co.in | |
13 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
kalbamall.ae cPanel, Inc. Certification Authority |
2021-12-12 - 2022-03-12 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-01-29 - 2023-01-29 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-02-07 - 2022-05-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://kalbamall.ae/cai/bimo/particular/login.php
Frame ID: 0CC36D86428A4DBAA882E2C968A17945
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Log InPage URL History Show full URLs
- http://sbpackersmovers.co.in/salina/ Page URL
-
https://kalbamall.ae/cai/bimo
HTTP 301
https://kalbamall.ae/cai/bimo/ HTTP 302
https://kalbamall.ae/cai/bimo/particular/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://sbpackersmovers.co.in/salina/ Page URL
-
https://kalbamall.ae/cai/bimo
HTTP 301
https://kalbamall.ae/cai/bimo/ HTTP 302
https://kalbamall.ae/cai/bimo/particular/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sbpackersmovers.co.in/salina/ |
1 KB 834 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
kalbamall.ae/cai/bimo/particular/ Redirect Chain
|
5 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/css/ |
119 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.4.1/js/ |
39 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ |
57 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
kalbamall.ae/cai/bimo/assets/js/ |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
popper.min.js
kalbamall.ae/cai/bimo/assets/js/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
kalbamall.ae/cai/bimo/assets/js/ |
133 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fontawesome.min.js
kalbamall.ae/cai/bimo/assets/js/ |
1 MB 379 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
kalbamall.ae/cai/bimo/assets/js/ |
2 KB 963 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background5.png
kalbamall.ae/cai/bimo/particular/image/ |
1010 KB 1010 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-regular-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/ |
13 KB 14 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Caixabank (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone function| $ function| jQuery function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| dash function| cc_date function| date_of_birth1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kalbamall.ae/ | Name: PHPSESSID Value: 08685e754232e3b941a608064fd1deea |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
kalbamall.ae
maxcdn.bootstrapcdn.com
sbpackersmovers.co.in
160.153.235.124
184.168.98.120
2606:4700::6810:135e
2606:4700::6812:bcf
2a00:1450:4001:831::200a
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a
2caa6404ddb0de2b9d191b1e2c8b5c35c68ca48f2a9521140bbf83b27c063700
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
343321b35bae9531b1d1220cf6edbf6435e610d67aede8faca2ad395063b71e7
36412ea33dfa11322f3efe6312c2daa4a838928185ea634446bbb940e04ef6f3
4d403e36797cc0135f0a79ebd2436ad0d537125825c2ec28977e88593cd63ff8
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
f460a0198dd83df619dbe5089458bb63b80f63dcdf8e7fbdf8ac648e03bdc23a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa85880600a527ff022db65d7d7bebacce3b2335b9c815bca4c59606688d66fc