bkj.qhz.mybluehost.me Open in urlscan Pro
50.87.253.17 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no
Effective URL:
https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/
Submission: On May 21 via api (May 21st 2024, 8:46:26 pm UTC) from US — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 50.87.253.17, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is bkj.qhz.mybluehost.me.
TLS certificate: Issued by R3 on May 19th 2024. Valid for: 3 months.

This is the only time bkj.qhz.mybluehost.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: BankID (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 8	50.87.253.17 50.87.253.17		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
7	2

8 50.87.253.17 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box2150.bluehost.com

bkj.qhz.mybluehost.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	mybluehost.me 1 redirects bkj.qhz.mybluehost.me	35 KB
7	1

	Domain	Requested by
8	bkj.qhz.mybluehost.me	1 redirects bkj.qhz.mybluehost.me
7	1

This site contains no links.

Subject Issuer	Validity	Valid
mail.bkj.qhz.mybluehost.me R3	`2024-05-19` - `2024-08-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/
Frame ID: 62F81D9BBB59694B0B590DCBD16F6A6B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BankID

Page URL History Show full URLs

http://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no HTTP 307
https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no HTTP 301
https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

35 kB
Transfer

100 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no HTTP 307
https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no HTTP 301
https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Redirect Chain http://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/	21 KB 8 KB	439ms 439ms	Document text/html	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software nginx/1.21.6 / Resource Hash `3d74e2403dabcb5f98cbbeb9c8a808a15488b46eb2d7698396924015f66e4e6f` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers accept-ranges bytes cache-control max-age=7200 content-encoding gzip content-length 8457 content-type text/html date Tue, 21 May 2024 20:46:21 GMT expires Tue, 21 May 2024 22:46:21 GMT host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== last-modified Sat, 29 Jul 2023 08:28:43 GMT server nginx/1.21.6 vary Accept-Encoding x-newfold-cache-level 2 x-proxy-cache MISS x-server-cache true Redirect headers cache-control max-age=7200 content-length 275 content-type text/html; charset=iso-8859-1 date Tue, 21 May 2024 20:46:21 GMT expires Tue, 21 May 2024 22:46:21 GMT host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== location https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ server nginx/1.21.6 x-proxy-cache EXPIRED x-server-cache true
GET H2	200	common_auth.css bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/	9 KB 3 KB	218ms 217ms	Stylesheet text/css	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/common_auth.css Requested by Host: bkj.qhz.mybluehost.me URL: https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software Apache / Resource Hash `5d4ff4117e8f7f9da541cba635327a05770499b79e51e32e679c2923a4bc27b2` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 21 May 2024 20:46:21 GMT content-encoding gzip last-modified Sat, 29 Jul 2023 08:28:43 GMT server Apache vary Accept-Encoding x-newfold-cache-level 2 content-type text/css cache-control max-age=86400 accept-ranges bytes host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 2634 expires Wed, 22 May 2024 20:46:21 GMT
GET H2	200	bidm.css bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/	42 KB 7 KB	412ms 412ms	Stylesheet text/css	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/bidm.css Requested by Host: bkj.qhz.mybluehost.me URL: https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software Apache / Resource Hash `31412635ed02fd2c9a9ac4c4d9093c0601a687cfe305aba0dea75c1943d7dd72` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 21 May 2024 20:46:21 GMT content-encoding gzip last-modified Sat, 29 Jul 2023 08:28:43 GMT server Apache vary Accept-Encoding x-newfold-cache-level 2 content-type text/css cache-control max-age=86400 accept-ranges bytes host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 7105 expires Wed, 22 May 2024 20:46:21 GMT
GET H2	200	3625.css bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/	4 KB 1006 B	213ms 213ms	Stylesheet text/css	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/3625.css Requested by Host: bkj.qhz.mybluehost.me URL: https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software Apache / Resource Hash `304c378b4700d25f783a2a7d6142c0b4d9dd9df890722064788eee96a12999d8` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 21 May 2024 20:46:21 GMT content-encoding gzip last-modified Sat, 29 Jul 2023 08:28:43 GMT server Apache vary Accept-Encoding x-newfold-cache-level 2 content-type text/css cache-control max-age=86400 accept-ranges bytes host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 963 expires Wed, 22 May 2024 20:46:21 GMT
GET H2	200	logo2.svg bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/	2 KB 2 KB	404ms 404ms	Image image/svg+xml	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/logo2.svg Requested by Host: bkj.qhz.mybluehost.me URL: https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software Apache / Resource Hash `ed26bb550b9c5d5a9550a73fab2e5fc6820659a3119c6cba0a81eb7720392d64` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 21 May 2024 20:46:21 GMT last-modified Sat, 29 Jul 2023 08:26:35 GMT server Apache x-newfold-cache-level 2 content-type image/svg+xml cache-control max-age=86400 accept-ranges bytes host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 1974 expires Wed, 22 May 2024 20:46:21 GMT
GET H2	200	logo1.png bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/	12 KB 12 KB	212ms 212ms	Image image/png	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/logo1.png Requested by Host: bkj.qhz.mybluehost.me URL: https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software Apache / Resource Hash `7fbcb3628e9d79d89e9350ee5d075818cf0f6763d5fa8763ea78c13902d6691b` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 21 May 2024 20:46:21 GMT last-modified Sat, 29 Jul 2023 08:28:43 GMT server Apache x-newfold-cache-level 2 content-type image/png cache-control max-age=86400 accept-ranges bytes host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 11908 expires Wed, 22 May 2024 20:46:21 GMT
GET DATA	200 OK	truncated /	9 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f4eb244555324863a9067686a9e08c9bd7db827ed8dd9a0de8a3cdbc32b66437` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	240 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `254868d92f9456d518064051d29f9ff0532bf9a5da291b06f8accb0900e40072` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	172 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	logo2.svg bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/	2 KB 2 KB	223ms 222ms	Other image/svg+xml	50.87.253.17 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/index_fichiers/logo2.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 50.87.253.17 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box2150.bluehost.com Software Apache / Resource Hash `ed26bb550b9c5d5a9550a73fab2e5fc6820659a3119c6cba0a81eb7720392d64` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://bkj.qhz.mybluehost.me/wp-includes/certificates/vippsnew/no/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Tue, 21 May 2024 20:46:22 GMT last-modified Sat, 29 Jul 2023 08:26:35 GMT server Apache x-newfold-cache-level 2 content-type image/svg+xml cache-control max-age=86400 accept-ranges bytes host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== content-length 1974 expires Wed, 22 May 2024 20:46:22 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: BankID (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bkj.qhz.mybluehost.me
50.87.253.17
254868d92f9456d518064051d29f9ff0532bf9a5da291b06f8accb0900e40072
304c378b4700d25f783a2a7d6142c0b4d9dd9df890722064788eee96a12999d8
31412635ed02fd2c9a9ac4c4d9093c0601a687cfe305aba0dea75c1943d7dd72
3d74e2403dabcb5f98cbbeb9c8a808a15488b46eb2d7698396924015f66e4e6f
4dca530d4682ddf6f4b9053173c007f95875c2634a6b61c9573d93fc21483766
5d4ff4117e8f7f9da541cba635327a05770499b79e51e32e679c2923a4bc27b2
7fbcb3628e9d79d89e9350ee5d075818cf0f6763d5fa8763ea78c13902d6691b
ed26bb550b9c5d5a9550a73fab2e5fc6820659a3119c6cba0a81eb7720392d64
f4eb244555324863a9067686a9e08c9bd7db827ed8dd9a0de8a3cdbc32b66437

bkj.qhz.mybluehost.me Open in urlscan Pro 50.87.253.17 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

35 kBTransfer

100 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

bkj.qhz.mybluehost.me Open in urlscan Pro
50.87.253.17 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

35 kB
Transfer

100 kB
Size

0
Cookies

7 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!