ficohsa400.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:1a83::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ficohsa400.000webhostapp.com/
Submission: On June 03 via api (June 3rd 2023, 10:03:08 pm UTC) from JP — Scanned from NL

Summary HTTP 7 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2a02:4780:dead:1a83::1, located in United States and belongs to AWEX, CY. The main domain is ficohsa400.000webhostapp.com.

This is the only time ficohsa400.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ficohsa (Banking)

Domain & IP information

	IP Address	AS Autonomous System
6	2a02:4780:dea... 2a02:4780:dead:1a83::1	204915 (AWEX) (AWEX)
1	2606:4700::68... 2606:4700::6811:a229	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	3

6 2a02:4780:dead:1a83::1 (United States)

ASN204915 (AWEX, CY)

ficohsa400.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:a229 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.000webhost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	000webhostapp.com ficohsa400.000webhostapp.com	622 KB
1	000webhost.com cdn.000webhost.com — Cisco Umbrella Rank: 101500	2 KB
7	2

	Domain	Requested by
6	ficohsa400.000webhostapp.com	ficohsa400.000webhostapp.com
1	cdn.000webhost.com	ficohsa400.000webhostapp.com
7	2

This site contains links to these domains. Also see Links.

Domain
www.000webhost.com

Subject Issuer	Validity	Valid
*.000webhost.com Sectigo RSA Domain Validation Secure Server CA	`2023-01-10` - `2024-02-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://ficohsa400.000webhostapp.com/
Frame ID: 57B880DA7D4009F0CA58BBE91A4C9AB5
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Información

Page Statistics

7
Requests

14 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

634 kB
Transfer

1545 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.000webhost.com/?utm_source=000webhostapp&utm_campaign=000_logo&utm_medium=website&utm_content=footer_img

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ficohsa400.000webhostapp.com/ 783 KB
102 KB 289ms
124ms Document
text/html 2a02:4780:dead:1a83::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://ficohsa400.000webhostapp.com/

Protocol

HTTP/1.1

Server

2a02:4780:dead:1a83::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

7d8586b028f6a29a89640302fdbbee3700952094fafa7df75ade77aa13612789

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sat, 03 Jun 2023 22:03:03 GMT
Server: awex
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Request-ID: dfdd49d4cec1734d70fd8d8ef3575477
X-Xss-Protection: 1; mode=block

GET
H/1.1 200
OK styles.b1d6cdcc40a888de1051.bundle.css
ficohsa400.000webhostapp.com/css/ 149 KB
48 KB 247ms
124ms Stylesheet
text/css 2a02:4780:dead:1a83::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://ficohsa400.000webhostapp.com/css/styles.b1d6cdcc40a888de1051.bundle.css

Requested by

Host: ficohsa400.000webhostapp.com
URL: http://ficohsa400.000webhostapp.com/

Protocol

HTTP/1.1

Server

2a02:4780:dead:1a83::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://ficohsa400.000webhostapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sat, 03 Jun 2023 22:03:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 May 2022 15:55:47 GMT
Server: awex
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: 3ce467e5e89fe021aacb2d2404a37b17

GET
H/1.1 200
OK prismaWeb.css
ficohsa400.000webhostapp.com/css/ 123 KB
20 KB 124ms
124ms Stylesheet
text/css 2a02:4780:dead:1a83::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://ficohsa400.000webhostapp.com/css/prismaWeb.css?v=6.0.939&_=1635530307

Requested by

Host: ficohsa400.000webhostapp.com
URL: http://ficohsa400.000webhostapp.com/

Protocol

HTTP/1.1

Server

2a02:4780:dead:1a83::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://ficohsa400.000webhostapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sat, 03 Jun 2023 22:03:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 May 2022 15:55:45 GMT
Server: awex
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: 0b648cf3685c8b4b7695a74c41f4eece

GET
H/1.1 200
OK 13f6ebd6-3a21-4455-8ac2-f131aaf35295.jpg
ficohsa400.000webhostapp.com/img/ 26 KB
26 KB 242ms
121ms Image
image/jpeg 2a02:4780:dead:1a83::1
AWEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://ficohsa400.000webhostapp.com/img/13f6ebd6-3a21-4455-8ac2-f131aaf35295.jpg

Requested by

Host: ficohsa400.000webhostapp.com
URL: http://ficohsa400.000webhostapp.com/

Protocol

HTTP/1.1

Server

2a02:4780:dead:1a83::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://ficohsa400.000webhostapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sat, 03 Jun 2023 22:03:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 May 2022 15:55:47 GMT
Server: awex
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26472
X-Xss-Protection: 1; mode=block
X-Request-ID: b5ada96a587171e4bd83ab50b35a86f7

GET
H2 200 footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ 2 KB
2 KB 142ms
38ms Image
image/webp 2606:4700::6811:a229
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png

Requested by

Host: ficohsa400.000webhostapp.com
URL: http://ficohsa400.000webhostapp.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:a229 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://ficohsa400.000webhostapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 03 Jun 2023 22:03:04 GMT
strict-transport-security: max-age=2592000
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2391
cf-polished: origFmt=png, origSize=2046
content-disposition: inline; filename="footer-powered-by-000webhost-white2.webp"
x-hostinger-datacenter: srv
alt-svc: h3=":443"; ma=86400
content-length: 1696
x-xss-protection: 1; mode=block
cf-bgj: imgq:100,h2pri
last-modified: Fri, 26 May 2023 11:37:17 GMT
server: cloudflare
etag: "647099ed-7fe"
vary: Accept
x-frame-options: sameorigin
content-type: image/webp
cache-control: public, max-age=14400
x-hostinger-node: nl-srv-cdn1
accept-ranges: bytes
cf-ray: 7d1b3957ab3437e3-FRA
expires: Sun, 04 Jun 2023 02:03:04 GMT

GET
H/1.1 200
OK prisma_fonts.css
ficohsa400.000webhostapp.com/css/ 24 KB
3 KB 124ms
124ms Stylesheet
text/css 2a02:4780:dead:1a83::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://ficohsa400.000webhostapp.com/css/prisma_fonts.css

Requested by

Host: ficohsa400.000webhostapp.com
URL: http://ficohsa400.000webhostapp.com/css/prismaWeb.css?v=6.0.939&_=1635530307

Protocol

HTTP/1.1

Server

2a02:4780:dead:1a83::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

72ca6a1a823786bda7f07f866791b2467fd4099002c119bbf059e087c0a41042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://ficohsa400.000webhostapp.com/css/prismaWeb.css?v=6.0.939&_=1635530307
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sat, 03 Jun 2023 22:03:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 May 2022 15:55:45 GMT
Server: awex
Transfer-Encoding: chunked
Content-Type: text/css
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: a08d8346375a232a41fa6c8b019bf0ed

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: http://ficohsa400.000webhostapp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

Request headers

Referer: http://ficohsa400.000webhostapp.com/
Origin: http://ficohsa400.000webhostapp.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H/1.1 200
OK streamline.8d9b0fde522024284eb5.woff
ficohsa400.000webhostapp.com/css/ 423 KB
424 KB 124ms
124ms Font
application/font-woff 2a02:4780:dead:1a83::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://ficohsa400.000webhostapp.com/css/streamline.8d9b0fde522024284eb5.woff?19c5cw

Requested by

Host: ficohsa400.000webhostapp.com
URL: http://ficohsa400.000webhostapp.com/css/styles.b1d6cdcc40a888de1051.bundle.css

Protocol

HTTP/1.1

Server

2a02:4780:dead:1a83::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

de92addf1d219707113509bb73a873421db6d02c74f254b0223e9689671ab1a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ficohsa400.000webhostapp.com/css/styles.b1d6cdcc40a888de1051.bundle.css
Origin: http://ficohsa400.000webhostapp.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Sat, 03 Jun 2023 22:03:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 23 May 2022 15:55:46 GMT
Server: awex
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 433328
X-Xss-Protection: 1; mode=block
X-Request-ID: f39ca6c588b89a79e656fc13fcf8f405

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ficohsa (Banking)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.000webhost.com
ficohsa400.000webhostapp.com
2606:4700::6811:a229
2a02:4780:dead:1a83::1
49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e
72ca6a1a823786bda7f07f866791b2467fd4099002c119bbf059e087c0a41042
7d8586b028f6a29a89640302fdbbee3700952094fafa7df75ade77aa13612789
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0
b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd
de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1
de92addf1d219707113509bb73a873421db6d02c74f254b0223e9689671ab1a6
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

ficohsa400.000webhostapp.com Open in urlscan Pro 2a02:4780:dead:1a83::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

7 Requests

14 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

634 kBTransfer

1545 kBSize

0 Cookies

1 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

ficohsa400.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:1a83::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

14 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

634 kB
Transfer

1545 kB
Size

0
Cookies

7 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!