URL: https://cp3.ultahost.com/~bzjqfzpp/
Submission: On November 09 via api — Scanned from CH

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 79.133.41.61, located in Germany and belongs to DE-FIRSTCOLO www.first-colo.net, DE. The main domain is cp3.ultahost.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 4th 2023. Valid for: 3 months.
This is the only time cp3.ultahost.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: United Overseas Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
12 79.133.41.61 44066 (DE-FIRSTC...)
12 2
Apex Domain
Subdomains
Transfer
12 ultahost.com
cp3.ultahost.com
61 KB
12 1
Domain Requested by
12 cp3.ultahost.com cp3.ultahost.com
12 1

This site contains links to these domains. Also see Links.

Domain
www.uob.com.sg
Subject Issuer Validity Valid
cp3.ultahost.com
cPanel, Inc. Certification Authority
2023-10-04 -
2024-01-02
3 months crt.sh

This page contains 1 frames:

Primary Page: https://cp3.ultahost.com/~bzjqfzpp/
Frame ID: 5FFF91BFA0292DB063C5FC60B27F2532
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

Raiffeisen LoginLogin

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

61 kB
Transfer

255 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
cp3.ultahost.com/~bzjqfzpp/
17 KB
7 KB
Document
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed / PHP/7.4.33
Resource Hash
d0289fa24df15cb98b80e087d045dcbd217ea56a7746f98f744c23264b2777b0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
de-CH,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 09 Nov 2023 06:54:47 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
styles.bea82d85053b390a.css
cp3.ultahost.com/~bzjqfzpp/Raiffeisen%20Login_files/
101 KB
13 KB
Stylesheet
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Raiffeisen%20Login_files/styles.bea82d85053b390a.css
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
0c425ba558b13c29841d7d73398c07fdedc4500eb282e53f3fe2aecfc8a117d2

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Sat, 02 Sep 2023 19:15:46 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
13548
expires
Thu, 16 Nov 2023 06:54:47 GMT
common.css
cp3.ultahost.com/~bzjqfzpp/
16 KB
3 KB
Stylesheet
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/common.css
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
641e7760662b730e3e13a6783ff01d09a00c4a2ef1953c1d617212c074eb1a51

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Thu, 09 Nov 2023 04:48:41 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
3191
expires
Thu, 16 Nov 2023 06:54:47 GMT
jquery.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
85 KB
29 KB
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/jquery.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29665
expires
Thu, 16 Nov 2023 06:54:47 GMT
urlutil.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
103 B
133 B
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/urlutil.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
6eb0ed20039d0dd56ab3245b1a76a86b3e85f76e98211276cd5d3a2840071bc3

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
103
expires
Thu, 16 Nov 2023 06:54:47 GMT
util.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
7 KB
2 KB
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/util.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
1103f5d3bfe4c2f772916021291c1a451ca6e68be44211c179dba8d527c51177

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1816
expires
Thu, 16 Nov 2023 06:54:47 GMT
digest.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
2 KB
578 B
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/digest.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
1fee20ec50b71a52a2ccba55b7831af6ae50bd15328dd8082b8feb458e3b4207

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
545
expires
Thu, 16 Nov 2023 06:54:47 GMT
md5.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
8 KB
2 KB
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/md5.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
0e56aa330a8b1f1baec4b1b3d82d0a9c9f7bdb8533df292448f4f355bf5557f9

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1754
expires
Thu, 16 Nov 2023 06:54:47 GMT
sat.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
2 KB
622 B
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/sat.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
f0fd04e4c78a9678731fe3322b9dd59ffb4c7073266e984a2399a9e7ac7a9cd5

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
589
expires
Thu, 16 Nov 2023 06:54:47 GMT
login.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
3 KB
583 B
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/login.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
cb57b4e82157386e7d399664b9d5267402e56d4c6441bba0e606c532f95cfe82

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
550
expires
Thu, 16 Nov 2023 06:54:47 GMT
tabbedlogin.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
5 KB
1 KB
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/tabbedlogin.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
675f0fc6031006a0e93bad54822d08ac90a2de497e450b4f309aa77bc1abccd9

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
1289
expires
Thu, 16 Nov 2023 06:54:47 GMT
placeholder.js
cp3.ultahost.com/~bzjqfzpp/Login_files/
6 KB
2 KB
Script
General
Full URL
https://cp3.ultahost.com/~bzjqfzpp/Login_files/placeholder.js
Requested by
Host: cp3.ultahost.com
URL: https://cp3.ultahost.com/~bzjqfzpp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
79.133.41.61 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
cp3.ultahost.com
Software
LiteSpeed /
Resource Hash
64cbad9ca8d7e55df23dcfd9d3ba3d12fcb064a4288faa47d6acb05b6f1cda0d

Request headers

accept-language
de-CH,de;q=0.9
Referer
https://cp3.ultahost.com/~bzjqfzpp/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Thu, 09 Nov 2023 06:54:47 GMT
content-encoding
br
last-modified
Tue, 31 May 2022 20:56:56 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
2179
expires
Thu, 16 Nov 2023 06:54:47 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b3651813f9a0642593f7f3abe8c17a00c1d5d9d5127ae7028b74788d0df3086a

Request headers

accept-language
de-CH,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: United Overseas Bank (Banking)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery function| getApplicationUrl object| b64 object| f64 function| b64Arrays function| arrayNew function| arrayNewEx function| toInt function| shr function| shl1 function| shl function| and function| or function| xor function| not function| add function| bytesToHexStr function| bytesToInts function| intsToBytes function| bytesToBase64 function| base64ToBytes function| stringToBytes function| bytesToString function| arrayCopy function| arrayTruncOrPad function| arrayConcat function| xorArray function| stringTrim function| Digest function| MD5 object| Placeholders

0 Cookies