pii.lkl.mybluehost.me
Open in
urlscan Pro
162.241.30.175
Malicious Activity!
Public Scan
Effective URL: https://pii.lkl.mybluehost.me/dan/dd/3589fa0/Login.php
Submission: On February 27 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on January 22nd 2024. Valid for: 3 months.
This is the only time pii.lkl.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Danske Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 50.6.160.65 50.6.160.65 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
3 13 | 162.241.30.175 162.241.30.175 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2607:f8b0:400... 2607:f8b0:4006:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 4 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-160-65.unifiedlayer.com
escaperoomklagenfurt.com.lep.gpe.temporary.site |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5927.bluehost.com
pii.lkl.mybluehost.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
mybluehost.me
3 redirects
pii.lkl.mybluehost.me |
448 KB |
2 |
gstatic.com
fonts.gstatic.com |
40 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 32 |
1 KB |
1 |
temporary.site
escaperoomklagenfurt.com.lep.gpe.temporary.site |
226 B |
14 | 4 |
Domain | Requested by | |
---|---|---|
13 | pii.lkl.mybluehost.me |
3 redirects
pii.lkl.mybluehost.me
|
2 | fonts.gstatic.com |
pii.lkl.mybluehost.me
|
1 | fonts.googleapis.com |
pii.lkl.mybluehost.me
|
1 | escaperoomklagenfurt.com.lep.gpe.temporary.site | |
14 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.escaperoomklagenfurt.com R3 |
2024-02-27 - 2024-05-27 |
3 months | crt.sh |
autodiscover.pii.lkl.mybluehost.me R3 |
2024-01-22 - 2024-04-21 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pii.lkl.mybluehost.me/dan/dd/3589fa0/Login.php
Frame ID: 5D208690469245B0E1CC4F29ADD3DBCB
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
home-BrandPage URL History Show full URLs
- https://escaperoomklagenfurt.com.lep.gpe.temporary.site/ Page URL
-
https://pii.lkl.mybluehost.me/dan/dd/
HTTP 302
https://pii.lkl.mybluehost.me/dan/dd/3589fa0 HTTP 301
https://pii.lkl.mybluehost.me/dan/dd/3589fa0/ HTTP 302
https://pii.lkl.mybluehost.me/dan/dd/3589fa0/Login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://escaperoomklagenfurt.com.lep.gpe.temporary.site/ Page URL
-
https://pii.lkl.mybluehost.me/dan/dd/
HTTP 302
https://pii.lkl.mybluehost.me/dan/dd/3589fa0 HTTP 301
https://pii.lkl.mybluehost.me/dan/dd/3589fa0/ HTTP 302
https://pii.lkl.mybluehost.me/dan/dd/3589fa0/Login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
escaperoomklagenfurt.com.lep.gpe.temporary.site/ |
142 B 226 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Login.php
pii.lkl.mybluehost.me/dan/dd/3589fa0/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
182 KB 43 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
baguetteBox.css
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
500 B 274 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ImageRender.jpg
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
23 KB 23 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s1.png
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
22 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
s2.png
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
27 KB 27 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
underlog.png
pii.lkl.mybluehost.me/dan/dd/3589fa0/style/ |
320 KB 321 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_dJE3gnD_g.woff2
fonts.gstatic.com/s/montserrat/v18/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v18/ |
19 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Danske Bank (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
escaperoomklagenfurt.com.lep.gpe.temporary.site
fonts.googleapis.com
fonts.gstatic.com
pii.lkl.mybluehost.me
162.241.30.175
2607:f8b0:4006:81c::2003
2607:f8b0:4006:81c::200a
50.6.160.65
16a0b33679f25e5e47c4731d6fe450fd157f5fb7ea7cf710632f86da014bdd79
1fa53992ba85ec211855680d90ddd7dec6b10e6a0d48eea4a4b40055cbf41d56
2b26a74f3c0e529bc8fccfa6b1db8e083e738992266359fde1a5bd0aaa81cbc3
61fcaf60ecdf8d6b29bdc104701cdedfe094c6341c96b3a7d676fdc2bfd1db06
660c5b2f29f876267f130d0cf33a26bf2ea85c7bbaa450609b0027ef372c542d
683f5b803aec9e336fa2e847c10b4c52e241e08cf1b39c48f51ad8cf29abc6f4
881057bedbfb41fc0d4a695c7cf69363c791f4e4c186807e1579af956a417d34
b4478e68f43f1e8875fdd39be0970a1ffbf78934c4b31f63f3c4a84fbdeea315
bcfb8521f8f3a41426b3e075e44391f1d09c3ca8ec33b250da9d2b4593d3e457
d564ebadd34678ed4bbfb820d23fc4518d8e8e7e04253d0019413ff02d963c80
e9a5731bb4c701337e0411e77c6cbc5ebc0b100c9d36dde462801f82e03c5908
ea7d0e26556f5b72b0223547446bafc52347ec0b29cd27ea254cb0e37542e962
ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60