URL: http://ilec.es/fowarding/login.php
Submission: On June 17 via automatic, source openphish

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 217.148.136.81, located in Spain and belongs to PROFESIONALHOSTING, ES. The main domain is ilec.es.
This is the only time ilec.es was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 9 217.148.136.81 200960 (PROFESION...)
7 1
Apex Domain
Subdomains
Transfer
9 ilec.es
ilec.es
www.ilec.es
611 KB
7 1
Domain Requested by
8 ilec.es 2 redirects ilec.es
1 www.ilec.es ilec.es
7 2

This site contains no links.

Subject Issuer Validity Valid

1970-01-01 -
1970-01-01
a few seconds crt.sh
ilec.es
Let's Encrypt Authority X3
2019-05-23 -
2019-08-21
3 months crt.sh

This page contains 1 frames:

Primary Page: http://ilec.es/fowarding/login.php
Frame ID: 650AB27B051951B10FF4A442C51AF11A
Requests: 7 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

14 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

1
IPs

1
Countries

611 kB
Transfer

609 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • http://ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f HTTP 301
  • https://ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f HTTP 301
  • https://www.ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
ilec.es/fowarding/
5 KB
5 KB
Document
General
Full URL
http://ilec.es/fowarding/login.php
Protocol
HTTP/1.1
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
Apache/2.4.39 /
Resource Hash
962e71852d823c3d28eb3fd3c2dddba1ed660e8eb35caa610e395bd4bf11bb39

Request headers

Host
ilec.es
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 15:01:49 GMT
Server
Apache/2.4.39
Upgrade
h2,h2c
Connection
Upgrade, close
Content-Length
5033
Content-Type
text/html; charset=UTF-8
conv.min.css
ilec.es/fowarding/css/
18 KB
18 KB
Stylesheet
General
Full URL
http://ilec.es/fowarding/css/conv.min.css
Requested by
Host: ilec.es
URL: http://ilec.es/fowarding/login.php
Protocol
HTTP/1.1
Security
, ,
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
Apache/2.4.39 /
Resource Hash
c2d5ac2e5a041d4925fd77de1880a678ad3638186f57e0970e0e081c6c8812d4

Request headers

Referer
http://ilec.es/fowarding/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 15:01:49 GMT
Last-Modified
Tue, 10 Jul 2018 02:59:30 GMT
Server
Apache/2.4.39
Upgrade
h2,h2c
Connection
Upgrade, close
Accept-Ranges
bytes
Content-Type
text/css
Content-Length
18000
lofo.png
ilec.es/fowarding/images/
20 KB
20 KB
Image
General
Full URL
http://ilec.es/fowarding/images/lofo.png
Requested by
Host: ilec.es
URL: http://ilec.es/fowarding/login.php
Protocol
HTTP/1.1
Security
, ,
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
Apache/2.4.39 /
Resource Hash
28716af890a232d0f275cb44df7c221e58930a57a9747259e9b676516edb8ca5

Request headers

Referer
http://ilec.es/fowarding/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 15:01:49 GMT
Last-Modified
Tue, 10 Jul 2018 05:59:34 GMT
Server
Apache/2.4.39
Upgrade
h2,h2c
Connection
Upgrade, close
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
20631
continue.png
ilec.es/fowarding/images/
495 B
733 B
Image
General
Full URL
http://ilec.es/fowarding/images/continue.png
Requested by
Host: ilec.es
URL: http://ilec.es/fowarding/login.php
Protocol
HTTP/1.1
Security
, ,
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
Apache/2.4.39 /
Resource Hash
97a4488434a10d406081498268d1c4452209922cf1c5802134ad9d3693c41112

Request headers

Referer
http://ilec.es/fowarding/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 15:01:49 GMT
Last-Modified
Thu, 05 Jul 2018 23:19:32 GMT
Server
Apache/2.4.39
Upgrade
h2,h2c
Connection
Upgrade, close
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
495
m7.png
ilec.es/fowarding/images/
500 B
738 B
Image
General
Full URL
http://ilec.es/fowarding/images/m7.png
Requested by
Host: ilec.es
URL: http://ilec.es/fowarding/login.php
Protocol
HTTP/1.1
Security
, ,
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
Apache/2.4.39 /
Resource Hash
0b0e8860dc323f2d3431b407330217eaa8ed3a0c022a6949fb0ba9008a5a0cff

Request headers

Referer
http://ilec.es/fowarding/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 15:01:49 GMT
Last-Modified
Mon, 31 Jul 2017 03:11:48 GMT
Server
Apache/2.4.39
Upgrade
h2,h2c
Connection
Upgrade, close
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
500
small.jpg
www.ilec.es/fowarding/images/
Redirect Chain
  • http://ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
  • https://ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
  • https://www.ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
0
0
Image
General
Full URL
https://www.ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
Requested by
Host: ilec.es
URL: http://ilec.es/fowarding/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://ilec.es/fowarding/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

date
Mon, 17 Jun 2019 15:01:50 GMT
server
Apache/2.4.39
x-redirect-by
WordPress
location
https://www.ilec.es/fowarding/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f
content-type
text/html; charset=UTF-8
status
301
cache-control
no-cache, must-revalidate, max-age=0
content-length
0
expires
Wed, 11 Jan 1984 05:00:00 GMT
t1.jpg
ilec.es/fowarding/images/
566 KB
566 KB
Image
General
Full URL
http://ilec.es/fowarding/images/t1.jpg?x=f5a9a9531b8f4bcc86eabb19472d15d5
Requested by
Host: ilec.es
URL: http://ilec.es/fowarding/login.php
Protocol
HTTP/1.1
Security
, ,
Server
217.148.136.81 , Spain, ASN200960 (PROFESIONALHOSTING, ES),
Reverse DNS
dns13681.phdns20.es
Software
Apache/2.4.39 /
Resource Hash
7764c38d71f5ee52d39f237f08b4e82b4715c73bfa0afbaee30a60b0dfd058ca

Request headers

Referer
http://ilec.es/fowarding/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 17 Jun 2019 15:01:49 GMT
Last-Modified
Tue, 15 Aug 2017 16:31:30 GMT
Server
Apache/2.4.39
Upgrade
h2,h2c
Connection
Upgrade, close
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
579468

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies