ns1.nuwebhosting.com
Open in
urlscan Pro
45.56.116.102
Malicious Activity!
Public Scan
Submission: On April 14 via automatic, source openphish
Summary
This is the only time ns1.nuwebhosting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 45.56.116.102 45.56.116.102 | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
1 | 199.59.243.120 199.59.243.120 | 53665 (BODIS-1) (BODIS-1 - Bodis) | |
9 | 2 |
ASN63949 (LINODE-AP Linode, LLC, US)
PTR: mercury.nuwebhosting.com
ns1.nuwebhosting.com |
ASN53665 (BODIS-1 - Bodis, LLC, US)
googlejquery.eb2a.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
nuwebhosting.com
ns1.nuwebhosting.com |
370 KB |
1 |
eb2a.com
googlejquery.eb2a.com |
|
9 | 2 |
Domain | Requested by | |
---|---|---|
8 | ns1.nuwebhosting.com |
ns1.nuwebhosting.com
|
1 | googlejquery.eb2a.com |
ns1.nuwebhosting.com
|
9 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://ns1.nuwebhosting.com/~verificb/data/websec-ConfirminfoStep.php?Go=_Reason=Limited&CC=Netherlands&_SESSION=f5959373a56548806338b2d165c45ccb
Frame ID: 12423.1
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
websec-ConfirminfoStep.php
ns1.nuwebhosting.com/~verificb/data/ |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.2.min.js
ns1.nuwebhosting.com/~verificb/data/data/ |
94 KB 94 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
ns1.nuwebhosting.com/~verificb/data/data/css1/js/ |
199 KB 199 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
ns1.nuwebhosting.com/~verificb/data/data/css/ |
37 KB 37 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-2.6.1.js
ns1.nuwebhosting.com/~verificb/data/data/js/ |
4 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo_paypal_106x29.png
ns1.nuwebhosting.com/~verificb/data/data/css1/img/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
war.png
ns1.nuwebhosting.com/~verificb/data/data/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
recp.php
googlejquery.eb2a.com/ |
1 KB 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pp_favicon_x.ico
ns1.nuwebhosting.com/~verificb/data/data/ |
5 KB 5 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
googlejquery.eb2a.com
ns1.nuwebhosting.com
199.59.243.120
45.56.116.102
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667
7ba2630cd7d5b177b49e59cf3cccd083afd2f84a4bc8f25a48c7d7720da23101
9db203e0808fbb44eff30606e1306685398f19298dd89451be19cf1969fec78e
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ab39e6288837a25d62b740906db369081f38978b23570148c28ed41f509d4fe2
d2ecf3fa08b4424b719379ea2c621fc0c9d7824656331976d2c9b02d48addf29
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8f6a59d5b15df98bd338dd810b4d00edd7187f616c92fc8b4d00e0cec1dd1e7
eb88136e19b714c7552dbfb56075d578e872c4f5760d810ba3fade8ad011e3e8