www.niqqita.com
Open in
urlscan Pro
72.52.136.11
Malicious Activity!
Public Scan
Submission: On December 29 via automatic, source phishtank
Summary
This is the only time www.niqqita.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 72.52.136.11 72.52.136.11 | 32244 (LIQUIDWEB) (LIQUIDWEB - Liquid Web) | |
1 | 54.148.84.95 54.148.84.95 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 151.101.114.110 151.101.114.110 | 54113 (FASTLY) (FASTLY - Fastly) | |
1 | 162.247.242.18 162.247.242.18 | 23467 (NEWRELIC-...) (NEWRELIC-AS-1 - New Relic) | |
10 | 4 |
ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US)
PTR: host.calibreserverus01.com
www.niqqita.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com
www.sitepoint.com |
ASN54113 (FASTLY - Fastly, US)
js-agent.newrelic.com |
ASN23467 (NEWRELIC-AS-1 - New Relic, US)
PTR: bam-6.nr-data.net
bam.nr-data.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
niqqita.com
www.niqqita.com |
|
1 |
nr-data.net
bam.nr-data.net |
|
1 |
newrelic.com
js-agent.newrelic.com |
|
1 |
sitepoint.com
www.sitepoint.com |
|
10 | 4 |
Domain | Requested by | |
---|---|---|
7 | www.niqqita.com |
www.niqqita.com
|
1 | bam.nr-data.net |
js-agent.newrelic.com
|
1 | js-agent.newrelic.com |
www.niqqita.com
|
1 | www.sitepoint.com |
www.niqqita.com
|
10 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sitepoint.com SSL.com Premium EV CA |
2017-06-13 - 2018-08-15 |
a year | crt.sh |
f4.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2017-12-12 - 2018-05-04 |
5 months | crt.sh |
*.nr-data.net GeoTrust SSL CA - G3 |
2017-07-18 - 2018-03-17 |
8 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.niqqita.com/secureapproved/login.php
Frame ID: (949D37C4F539E9B877381FAD6521D59F)
Requests: 10 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
www.niqqita.com/secureapproved/ |
8 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MaskedPassword.js
www.sitepoint.com/examples/password/MaskedPassword/ |
17 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m4.png
www.niqqita.com/secureapproved/images/ |
372 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m1.png
www.niqqita.com/secureapproved/images/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m2.png
www.niqqita.com/secureapproved/images/ |
16 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m5.png
www.niqqita.com/secureapproved/images/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m6.png
www.niqqita.com/secureapproved/images/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
m3.png
www.niqqita.com/secureapproved/images/ |
914 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nr-1071.min.js
js-agent.newrelic.com/ |
23 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
5913f0811d
bam.nr-data.net/1/ |
57 B 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Excel / PDF download (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onafterprint object| onbeforeprint object| NREUM object| newrelic function| __nr_require function| MaskedPassword function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bam.nr-data.net
js-agent.newrelic.com
www.niqqita.com
www.sitepoint.com
151.101.114.110
162.247.242.18
54.148.84.95
72.52.136.11
2cfdb08c07395b0be65df154f068ade61c1bfad7e3e3e2d0e40b85319fa95825
3538d6b8b070c7878d9e8c66f5258e4fb3b5ee142ae8d75395706d4798ca1c6f
511577530b15e4b07bf1b4645622495a1af3d717372aced43761d6ad37bcb5c0
56097e8b7ceb27db42a5e102af6d11dfdcaee13d8716477a8e242b4957d7a280
91cbf536dcc9895d25413bbdd5432161013a793f68afad18582af19a8143820e
95dab2087c6f5c6266bbe82dc6aadcba47868ccd7797b3c971ae422443afdc9a
d18ff1f5951552c4c3ca60f70cadf5f304c93663e2ecd4a75f0023e918ee67ec
ef906cf714160ac58bef42e60a1ea75a8f68bb70ef4a959a1aaf3205780659be
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f91fa5e2edb890f8d03759d1ddcb600ee883d9e4c46cc0f3f8bccf05667ed0cc