cp3.ultahost.com
Open in
urlscan Pro
79.133.41.61
Malicious Activity!
Public Scan
Submission: On November 09 via api — Scanned from CH
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 4th 2023. Valid for: 3 months.
This is the only time cp3.ultahost.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: United Overseas Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 79.133.41.61 79.133.41.61 | 44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net) | |
12 | 2 |
ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)
PTR: cp3.ultahost.com
cp3.ultahost.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
ultahost.com
cp3.ultahost.com |
61 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
12 | cp3.ultahost.com |
cp3.ultahost.com
|
12 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.uob.com.sg |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cp3.ultahost.com cPanel, Inc. Certification Authority |
2023-10-04 - 2024-01-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cp3.ultahost.com/~bzjqfzpp/
Frame ID: 5FFF91BFA0292DB063C5FC60B27F2532
Requests: 13 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
cp3.ultahost.com/~bzjqfzpp/ |
17 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.bea82d85053b390a.css
cp3.ultahost.com/~bzjqfzpp/Raiffeisen%20Login_files/ |
101 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
cp3.ultahost.com/~bzjqfzpp/ |
16 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
urlutil.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
103 B 133 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
util.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
7 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
digest.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
2 KB 578 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
md5.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sat.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
2 KB 622 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
3 KB 583 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tabbedlogin.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
5 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
placeholder.js
cp3.ultahost.com/~bzjqfzpp/Login_files/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: United Overseas Bank (Banking)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| getApplicationUrl object| b64 object| f64 function| b64Arrays function| arrayNew function| arrayNewEx function| toInt function| shr function| shl1 function| shl function| and function| or function| xor function| not function| add function| bytesToHexStr function| bytesToInts function| intsToBytes function| bytesToBase64 function| base64ToBytes function| stringToBytes function| bytesToString function| arrayCopy function| arrayTruncOrPad function| arrayConcat function| xorArray function| stringTrim function| Digest function| MD5 object| Placeholders0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cp3.ultahost.com
79.133.41.61
0c425ba558b13c29841d7d73398c07fdedc4500eb282e53f3fe2aecfc8a117d2
0e56aa330a8b1f1baec4b1b3d82d0a9c9f7bdb8533df292448f4f355bf5557f9
1103f5d3bfe4c2f772916021291c1a451ca6e68be44211c179dba8d527c51177
1fee20ec50b71a52a2ccba55b7831af6ae50bd15328dd8082b8feb458e3b4207
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
641e7760662b730e3e13a6783ff01d09a00c4a2ef1953c1d617212c074eb1a51
64cbad9ca8d7e55df23dcfd9d3ba3d12fcb064a4288faa47d6acb05b6f1cda0d
675f0fc6031006a0e93bad54822d08ac90a2de497e450b4f309aa77bc1abccd9
6eb0ed20039d0dd56ab3245b1a76a86b3e85f76e98211276cd5d3a2840071bc3
b3651813f9a0642593f7f3abe8c17a00c1d5d9d5127ae7028b74788d0df3086a
cb57b4e82157386e7d399664b9d5267402e56d4c6441bba0e606c532f95cfe82
d0289fa24df15cb98b80e087d045dcbd217ea56a7746f98f744c23264b2777b0
f0fd04e4c78a9678731fe3322b9dd59ffb4c7073266e984a2399a9e7ac7a9cd5