![](/screenshots/5fa03fc3-771a-4a37-ab42-271dbf9f1be1.png)
colored.clientwebservices.com
Open in
urlscan Pro
64.37.52.152
Malicious Activity!
Public Scan
Effective URL: https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/k7mry3n2gbl9jdsil8yxni51zt.php?a=ZXJ1d2Fpb...
Submission: On September 30 via manual from SA — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 25th 2021. Valid for: 3 months.
This is the only time colored.clientwebservices.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 185.107.232.127 185.107.232.127 | 200484 (SENDINBLU...) (SENDINBLUE-ASN) | |
2 | 172.67.208.48 172.67.208.48 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.16.95.65 104.16.95.65 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 34.149.57.217 34.149.57.217 | 15169 (GOOGLE) (GOOGLE) | |
1 6 | 64.37.52.152 64.37.52.152 | 33182 (DIMENOC) (DIMENOC) | |
2 3 | 212.118.156.43 212.118.156.43 | 25019 (SAUDINETS...) (SAUDINETSTC-AS) | |
12 | 7 |
ASN15169 (GOOGLE, US)
PTR: 217.57.149.34.bc.googleusercontent.com
in-automate.sendinblue.com |
ASN33182 (DIMENOC, US)
PTR: exact.nsjet.com
colored.clientwebservices.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
clientwebservices.com
1 redirects
colored.clientwebservices.com |
1 MB |
3 |
stc.com.sa
2 redirects
stc.com.sa www.stc.com.sa |
4 KB |
2 |
sibautomation.com
sibautomation.com |
2 KB |
1 |
sendinblue.com
in-automate.sendinblue.com |
70 B |
1 |
cloudflareinsights.com
static.cloudflareinsights.com |
5 KB |
1 |
traveler-assistance.net
r.traveler-assistance.net |
1 KB |
12 | 6 |
Domain | Requested by | |
---|---|---|
6 | colored.clientwebservices.com |
1 redirects
r.traveler-assistance.net
colored.clientwebservices.com |
2 | www.stc.com.sa |
1 redirects
colored.clientwebservices.com
|
2 | sibautomation.com |
r.traveler-assistance.net
static.cloudflareinsights.com |
1 | stc.com.sa | 1 redirects |
1 | in-automate.sendinblue.com |
sibautomation.com
|
1 | static.cloudflareinsights.com |
sibautomation.com
|
1 | r.traveler-assistance.net | |
12 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-10 - 2022-07-09 |
a year | crt.sh |
in-automate.sendinblue.com R3 |
2021-09-24 - 2021-12-23 |
3 months | crt.sh |
colored.clientwebservices.com R3 |
2021-08-25 - 2021-11-23 |
3 months | crt.sh |
*.stc.com.sa DigiCert SHA2 Secure Server CA |
2020-02-16 - 2022-02-16 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/k7mry3n2gbl9jdsil8yxni51zt.php?a=ZXJ1d2FpbGlAc3RjLmNvbS5zYQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=ZXJ1d2FpbGlAc3RjLmNvbS5zYQ==&loginID=&.
Frame ID: 6FC3FA1427CD50E75DBE2E62FD079DAC
Requests: 3 HTTP requests in this frame
Frame:
https://sibautomation.com/cm.html?id=1479137
Frame ID: A3753DD85CC4F5FB109CB524EAD02BE7
Requests: 5 HTTP requests in this frame
Frame:
https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/ova.php?a=ZXJ1d2FpbGlAc3RjLmNvbS5zYQ==&i=0&c=
Frame ID: 3686D82FD49CDA0EA6CB14EAAE0EAE7A
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/5fa03fc3-771a-4a37-ab42-271dbf9f1be1.png)
Page Title
Mail Login [Session Expired]Page URL History Show full URLs
- http://r.traveler-assistance.net/tr/cl/RmduKdCApxS89XPvuKE5PEru8EoIwjWW_4XoYIA3VTW1i7aqmYi9vSfgWXup7qH6RE4Jp_... Page URL
-
https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/index.php?x=x&a=eruwai...
HTTP 302
https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/k7mry3n2gbl9jdsil8yxni... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://r.traveler-assistance.net/tr/cl/RmduKdCApxS89XPvuKE5PEru8EoIwjWW_4XoYIA3VTW1i7aqmYi9vSfgWXup7qH6RE4Jp_kDc_JgwdsOoMM59nal0rDgiqWef3ItoSLO9VNdYMnb8znUYipHraL2kbLseRpcavOtgp7ypEGj1PoSYHoCJAM7z8v5tkPd02_PBk-noD215n-4HVtnTlX73sFEK9nMyYRa6ZToDxvSLxC7G74wsX2YP1ItFArIX6PM_YfCBLXkeg3Dx2OkXgefcb2OBARQ-Tdgv7i_BJcJg6ZJXqHEykfaNjEUiKi9fa6-6vsuwUDY3Jyex5mn6hLJzE84ClDqLFsoc_u5wphvBymZfLIrAt0JzUGwCAvEj3orj-0wmx5h8CGv Page URL
-
https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/index.php?x=x&a=eruwaili@stc.com.sa
HTTP 302
https://colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/k7mry3n2gbl9jdsil8yxni51zt.php?a=ZXJ1d2FpbGlAc3RjLmNvbS5zYQ==&.verify?service=nfpb=true&_pageLabel=smep_portal_page_login&timedOut=true&_nfls&c=&i=0&false=ZXJ1d2FpbGlAc3RjLmNvbS5zYQ==&loginID=&. Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 10- https://stc.com.sa/favicon.ico HTTP 301
- https://www.stc.com.sa//favicon.ico HTTP 301
- https://www.stc.com.sa/favicon.ico
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
RmduKdCApxS89XPvuKE5PEru8EoIwjWW_4XoYIA3VTW1i7aqmYi9vSfgWXup7qH6RE4Jp_kDc_JgwdsOoMM59nal0rDgiqWef3ItoSLO9VNdYMnb8znUYipHraL2kbLseRpcavOtgp7ypEGj1PoSYHoCJAM7z8v5tkPd02_PBk-noD215n-4HVtnTlX73sFEK9nMy...
r.traveler-assistance.net/tr/cl/ |
964 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cm.html
sibautomation.com/ Frame A375 |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.min.js
static.cloudflareinsights.com/ Frame A375 |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cm
in-automate.sendinblue.com/ Frame A375 |
0 70 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
k7mry3n2gbl9jdsil8yxni51zt.php
colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/ Redirect Chain
|
879 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
sibautomation.com/cdn-cgi/ Frame A375 |
0 58 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
rum
sibautomation.com/cdn-cgi/ Frame A375 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ova.php
colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/ Frame 3686 |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
default.jpg
colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/ico/bg/ |
1 MB 1 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/css/ Frame 3686 |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.js
colored.clientwebservices.com/vendor/phpunit/phpunit/src/Util/PHP/dir/CyptallDomain/ico/ Frame 3686 |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
www.stc.com.sa/ Frame 3686 Redirect Chain
|
15 KB 3 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- sibautomation.com
- URL
- https://sibautomation.com/cdn-cgi/rum?
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect boolean| originAgentCluster2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
sibautomation.com/ | Name: uuid Value: 203ffe64-0a5a-40be-8fca-aceae1240e01 |
|
colored.clientwebservices.com/ | Name: PHPSESSID Value: c524f7cfa47c72616d892424710ed9d4 |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
colored.clientwebservices.com
in-automate.sendinblue.com
r.traveler-assistance.net
sibautomation.com
static.cloudflareinsights.com
stc.com.sa
www.stc.com.sa
sibautomation.com
104.16.95.65
172.67.208.48
185.107.232.127
212.118.156.43
34.149.57.217
64.37.52.152
1144f9521d6feddb289a315933801069786137e7416ca58ec48718c09b241bdb
16e6ed2b09a0b8dae220695966d19b32ce183ad2417dba7987217a92fafe6fa7
1bcbd711541fce74fc4c58fce450956c507db9e1e9d83af8f13ed448e114f9a0
429be20281ea7898f50dd66406d9ac7c86888fa7bcc489fccbed76d676f8f164
9ad8b459ca1ffeedb50969500f1a95941b3b7487e8aed45d1146913de1ba9ab6
a128f0ff3bae6fee95ba54b71dccb70a85e8cf2c41bc7e17c0347f9d91ba4acf
a6baa596c961ffab09d260ba7d7c743114ff7016e13e853b9b0f25bceac17255
acd89c8dd5cc9cf47ee574302ec883993c33d419da8840ddb05763b857f1f09f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855