prestige-art.ehost.tj Open in urlscan Pro
79.170.188.73  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://epicindiagroup.com/1/Ds5c/ Page URL
2. http://prestige-art.ehost.tj/2/ Page URL
3. http://prestige-art.ehost.tj/1/ Page URL
4. http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response epicindiagroup.com/1/Ds5c/	107 B 777 B	423ms 388ms	Document text/html	2606:4700:3036::6815:5cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://epicindiagroup.com/1/Ds5c/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::6815:5cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.12 Resource Hash 574e3e4bd7f76e918f444824e10d3c59fed418b0278479bf5f5dd7807c65ff97 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers :method GET :authority epicindiagroup.com :scheme https :path /1/Ds5c/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 25 Jan 2021 11:32:42 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d59b0471c0912b4035dd70f0545d585c21611574362; expires=Wed, 24-Feb-21 11:32:42 GMT; path=/; domain=.epicindiagroup.com; HttpOnly; SameSite=Lax; Secure x-powered-by PHP/7.4.12 x-frame-options SAMEORIGIN x-mod-pagespeed 1.13.35.2-0 vary Accept-Encoding cache-control max-age=0, no-cache, s-maxage=10 cf-cache-status DYNAMIC cf-request-id 07daea58580000d6f9c5145000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bA8q0Kf7TZxrMwsAHZPtvC8SNN07n6o6rMkdtiznIPvuKxBdd9zdPAmzyZSlnE9jvdUnRAdXuM2uBBIE3t1yJ1gBC%2B5GP%2F%2FvnmLi2NLBjDPEK0eVORvFutEXFqSFd%2Fg%3D"}],"group":"cf-nel","max_age":604800} nel {"max_age":604800,"report_to":"cf-nel"} server cloudflare cf-ray 6171acd3b8ecd6f9-FRA content-encoding br
GET H/1.1	200 OK	/ Show response prestige-art.ehost.tj/2/	108 B 342 B	669ms 651ms	Document text/html	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Full URL http://prestige-art.ehost.tj/2/ Requested by Host: epicindiagroup.com URL: https://epicindiagroup.com/1/Ds5c/ Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / PHP/5.5.9-1ubuntu4.29 Resource Hash e89dcf1cdb9d1ecf56234e62fe89d123af01492c51550e4b5400f33206912c66 Request headers Host prestige-art.ehost.tj Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:42 GMT Server Apache/2.4.7 X-Powered-By PHP/5.5.9-1ubuntu4.29 Vary Accept-Encoding Content-Encoding gzip Content-Length 115 Connection close Content-Type text/html
GET H/1.1	200 OK	/ Show response prestige-art.ehost.tj/1/	194 B 413 B	666ms 649ms	Document text/html	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Full URL http://prestige-art.ehost.tj/1/ Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/2/ Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / PHP/5.5.9-1ubuntu4.29 Resource Hash c17dcf7db96be4eda1b11d68c36702114b239663caf684d6734cc98a3cb72dac Request headers Host prestige-art.ehost.tj Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://prestige-art.ehost.tj/2/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://prestige-art.ehost.tj/2/ Response headers Date Mon, 25 Jan 2021 11:32:43 GMT Server Apache/2.4.7 X-Powered-By PHP/5.5.9-1ubuntu4.29 Vary Accept-Encoding Content-Encoding gzip Content-Length 186 Connection close Content-Type text/html
GET H/1.1	200 OK	Primary Request loading.php Show response prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/	10 KB 4 KB	1506ms 1489ms	Document text/html	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/1/ Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / PHP/5.5.9-1ubuntu4.29 Resource Hash 07e2a54d80d9bc9183ff2835f0cae5a762ee19fd70777f63c869388bd605ddca Request headers Host prestige-art.ehost.tj Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://prestige-art.ehost.tj/1/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://prestige-art.ehost.tj/1/ Response headers Date Mon, 25 Jan 2021 11:32:44 GMT Server Apache/2.4.7 X-Powered-By PHP/5.5.9-1ubuntu4.29 Vary Accept-Encoding Content-Encoding gzip Content-Length 3713 Connection close Content-Type text/html
GET H/1.1	200 OK	styles-banque.css prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/	7 KB 2 KB	1013ms 995ms	Stylesheet text/css	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/styles-banque.css Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / Resource Hash 6af9f456461e1e7cb540894145e5abebf98048b7b99cc54b44ef286d308c06e4 Request headers Referer http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:45 GMT Content-Encoding gzip Last-Modified Mon, 25 Jan 2021 11:14:05 GMT Server Apache/2.4.7 ETag "1c12-5b9b7a2d978d9-gzip" Vary Accept-Encoding Content-Type text/css Connection close Accept-Ranges bytes Content-Length 1304
GET H/1.1	200 OK	authentication.js Show response prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/	4 KB 1 KB	1038ms 1020ms	Script application/javascript	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/authentication.js Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / Resource Hash 8d2e096568eb4978e21e8cf7bc52982bd4a2bc9b10c90a3af504a468bdc4f64a Request headers Referer http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:45 GMT Content-Encoding gzip Last-Modified Mon, 25 Jan 2021 11:14:05 GMT Server Apache/2.4.7 ETag "eeb-5b9b7a2d96939-gzip" Vary Accept-Encoding Content-Type application/javascript Connection close Accept-Ranges bytes Content-Length 876
GET H/1.1	200 OK	logo.png prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/	5 KB 5 KB	827ms 810ms	Image image/png	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Show image Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/logo.png Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / Resource Hash deedc1faecf1f585890bb43e5d2cabe5fb9f9365609a68931f7387bc11ba8cac Request headers Referer http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:46 GMT Last-Modified Mon, 25 Jan 2021 11:14:05 GMT Server Apache/2.4.7 ETag "1284-5b9b7a2d96939" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 4740
GET H/1.1	200 OK	visa-mastercard.gif prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/	16 KB 16 KB	731ms 715ms	Image image/gif	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Show image Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/visa-mastercard.gif Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / Resource Hash 03b60bdf8d51111dd68222fda3d4b0debbaa0b05d5735a9d7c6b577fbea5d8ca Request headers Referer http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:46 GMT Last-Modified Mon, 25 Jan 2021 11:14:05 GMT Server Apache/2.4.7 ETag "3eec-5b9b7a2d96939" Content-Type image/gif Connection close Accept-Ranges bytes Content-Length 16108
GET H/1.1	200 OK	phone.png prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/	14 KB 14 KB	790ms 773ms	Image image/png	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Show image Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/phone.png Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / Resource Hash 9b495b8b4e8fc5da2af75331e90db747f86cff2008172e6044296c3fd96a26d7 Request headers Referer http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:46 GMT Last-Modified Mon, 25 Jan 2021 11:14:05 GMT Server Apache/2.4.7 ETag "379a-5b9b7a2d978d9" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 14234
GET H/1.1	200 OK	giphy1.gif prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/	39 KB 40 KB	778ms 761ms	Image image/gif	79.170.188.73 BABILON-AS
General Check archive.org Show headers Download Go to Show image Full URL http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/css/giphy1.gif Requested by Host: prestige-art.ehost.tj URL: http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php Protocol HTTP/1.1 Server 79.170.188.73 , Tajikistan, ASN24722 (BABILON-AS, TJ), Reverse DNS mewr.gov.tj Software Apache/2.4.7 / Resource Hash e151cbf0bb7146f48f1a5f6533580fa0a8379ac13f2a1c6a392622f4db41d2a5 Request headers Referer http://prestige-art.ehost.tj/wp-admin/includes/%20-facture.DS88996/V78F54VSD54CS54X45/ovh/741da6af1fd4536/loading.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 25 Jan 2021 11:32:46 GMT Last-Modified Mon, 25 Jan 2021 11:14:05 GMT Server Apache/2.4.7 ETag "9d13-5b9b7a2d96939" Content-Type image/gif Connection close Accept-Ranges bytes Content-Length 40211

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OVH (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated boolean| _is_ajsp_running_ number| _csrff_cancel_onload_ function| showHelp function| init function| center function| init_foc function| controle_date function| controle_zipcode function| controle_sms function| submitWait function| showHelpWflow function| showHelpPhoneWflow function| startTimer function| checkSecond

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

epicindiagroup.com
prestige-art.ehost.tj
2606:4700:3036::6815:5cb
79.170.188.73
03b60bdf8d51111dd68222fda3d4b0debbaa0b05d5735a9d7c6b577fbea5d8ca
07e2a54d80d9bc9183ff2835f0cae5a762ee19fd70777f63c869388bd605ddca
574e3e4bd7f76e918f444824e10d3c59fed418b0278479bf5f5dd7807c65ff97
6af9f456461e1e7cb540894145e5abebf98048b7b99cc54b44ef286d308c06e4
8d2e096568eb4978e21e8cf7bc52982bd4a2bc9b10c90a3af504a468bdc4f64a
9b495b8b4e8fc5da2af75331e90db747f86cff2008172e6044296c3fd96a26d7
c17dcf7db96be4eda1b11d68c36702114b239663caf684d6734cc98a3cb72dac
deedc1faecf1f585890bb43e5d2cabe5fb9f9365609a68931f7387bc11ba8cac
e151cbf0bb7146f48f1a5f6533580fa0a8379ac13f2a1c6a392622f4db41d2a5
e89dcf1cdb9d1ecf56234e62fe89d123af01492c51550e4b5400f33206912c66