urlscan.io logo urlscan.io
SecurityTrails logo

banauehotelandyouthhostel.com Open in urlscan Pro
103.131.95.99  Public Scan

Go To Rescan Add Verdict Report
URL: https://banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv/tcvjhlosof.php
Submission: On October 03 via manual from PH — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 103.131.95.99, located in Philippines and belongs to WEB-COM-AS-AP Web.com.ph Inc., PH. The main domain is banauehotelandyouthhostel.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 18th 2021. Valid for: 3 months.
This is the only time banauehotelandyouthhostel.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 103.131.95.99 17448 (WEB-COM-A...)
2 104.21.11.6 13335 (CLOUDFLAR...)
3 2
Domain Requested by
2 anonymousfox.mx banauehotelandyouthhostel.com
1 banauehotelandyouthhostel.com
3 2

This site contains links to these domains. Also see Links.

Domain
www.google.com
www.exploit-db.com
anonymousfox.info
Subject Issuer Validity Valid
banauehotelandyouthhostel.com
cPanel, Inc. Certification Authority		 2021-08-18 -
2021-11-16		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-02-11 -
2022-02-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv/tcvjhlosof.php
Frame ID: F169643976E2EB9F4EE054FEA6A90D3A
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

banauehotelandyouthhostel.com - FoxWSO v1.2

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

215 kB
Transfer

230 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set tcvjhlosof.php
banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv/ 		22 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv/tcvjhlosof.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
103.131.95.99 , Philippines, ASN17448 (WEB-COM-AS-AP Web.com.ph Inc., PH),
Reverse DNS
vs02.tieza.gov.ph
Software
Apache /
Resource Hash
9aefe6dc10b514ed8d8c0470f73e200df4ddacafce611b90928ed3f614340bfd

Request headers

Host
banauehotelandyouthhostel.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sun, 03 Oct 2021 11:19:02 GMT
Server
Apache
Set-Cookie
b7662116a49daf03d541ff24f12d52a3key=c7e7172c7781b034963ef5178f1479dd
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
5254
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
line2.png
anonymousfox.mx/_@images/ 		180 KB
181 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://anonymousfox.mx/_@images/line2.png
Requested by
Host: banauehotelandyouthhostel.com
URL: https://banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv/tcvjhlosof.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.11.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a328d2826e286d2127ca40bfb5489cc0b5f15cecf0f55687fe79b735ab354afc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://banauehotelandyouthhostel.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 03 Oct 2021 11:19:03 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
452171
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
184528
last-modified
Thu, 11 Feb 2021 18:57:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yl6wPAb5fop7sKaXpJ8%2B3TkG0eQeISRytERbDfS8iViBKbKTlW0De2zAMJxBTDNJm28d7oxIht3HzRB5Ge5sy354gPUB82YoSGRlWe8r%2BWCGK1Pcvw7W5ngU%2BcOaialjfqk%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6985c5f96ef25b68-FRA
expires
Tue, 05 Oct 2021 05:42:52 GMT
logo.png
anonymousfox.mx/_@images/ 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://anonymousfox.mx/_@images/logo.png
Requested by
Host: banauehotelandyouthhostel.com
URL: https://banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv/tcvjhlosof.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.11.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b015b80f935892595e37496b08a0f28a20ad1aabeec0c54bafa954d97ffeb5b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://banauehotelandyouthhostel.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date
Sun, 03 Oct 2021 11:19:03 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
544402
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
28470
last-modified
Thu, 11 Feb 2021 18:52:27 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7wZqek978xY3BJTvom%2FEB2LOKoQr9U8tRS8PIPFeV5RNMx1rGjCXoJKqtjw0baruzY2RFcM8w2zSv4E%2BHfPB7KgYZebUsxVPacUedlMujw5VsjYwvIKpiGrbbrtif1KqhNA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6985c5f96ef35b68-FRA
expires
Mon, 04 Oct 2021 04:05:41 GMT

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster string| c_ string| a_ string| charset_ string| p1_ string| p2_ string| p3_ object| d function| encrypt function| utf8_encode function| base64_encode function| set function| g function| a function| sr function| processReqChange function| sa

1 Cookies

Domain/Path Name / Value
banauehotelandyouthhostel.com/wp-content/plugins/dehhwalzqv Name: b7662116a49daf03d541ff24f12d52a3key
Value: c7e7172c7781b034963ef5178f1479dd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anonymousfox.mx
banauehotelandyouthhostel.com
103.131.95.99
104.21.11.6
8b015b80f935892595e37496b08a0f28a20ad1aabeec0c54bafa954d97ffeb5b
9aefe6dc10b514ed8d8c0470f73e200df4ddacafce611b90928ed3f614340bfd
a328d2826e286d2127ca40bfb5489cc0b5f15cecf0f55687fe79b735ab354afc