neftfcl.com Open in urlscan Pro
5.42.199.52  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://btpartner.fr/wpadmin.html Page URL
2. https://neftfcl.com/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	wpadmin.html Show response btpartner.fr/	64 B 179 B	159ms 28ms	Document text/html	185.49.20.102 INEONET-AS
General Check archive.org Show headers Download Go to Full URL https://btpartner.fr/wpadmin.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.49.20.102 , France, ASN197492 (INEONET-AS, FR), Reverse DNS webhost02.yulpa.io Software Apache / Resource Hash 587fe57cdd9068e434e2dd7cea9ac2dbc6dd1d1ce2a5aa56c598e4c895302f05 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers accept-ranges bytes cache-control public content-length 64 content-type text/html; charset=UTF-8 date Mon, 03 Oct 2022 16:09:42 GMT last-modified Sun, 02 Oct 2022 19:17:20 GMT server Apache
GET H2	200	Primary Request / Show response neftfcl.com/	764 B 607 B	1399ms 282ms	Document text/html	5.42.199.52
General Check archive.org Show headers Download Go to Full URL https://neftfcl.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.42.199.52 -, , ASN (), Reverse DNS Software nginx / PHP/8.0.23 PleskLin Resource Hash 38cf058b1abcc34ca278fc83c334742eddbbaa2cdb797817f9cbdd0c1fcf05ba Request headers Referer https://btpartner.fr/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Mon, 03 Oct 2022 16:09:47 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx x-powered-by PHP/8.0.23 PleskLin
GET H2	200	580b57fcd9996e24bc43c529.png assets.stickpng.com/images/	17 KB 18 KB	119ms 47ms	Image image/png	2606:4700:3038::6815:eb02
General Check archive.org Show headers Download Go to Show image Full URL https://assets.stickpng.com/images/580b57fcd9996e24bc43c529.png Requested by Host: neftfcl.com URL: https://neftfcl.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:eb02 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 218bc2b47bb718e6c65206f46f0c9791edcfdf5ccff6e6abcecb7637be7cf33b Request headers accept-language fr-FR,fr;q=0.9 Referer https://neftfcl.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers date Mon, 03 Oct 2022 16:09:48 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-request-id 06493XM4J8TYJDC9 age 2404 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 17322 x-amz-id-2 QrdGwkcBLb/TXLWfHbC0iuGRLgW/jlOrozJHPqM8g41tFZfl3Biml4OHGd7O9Nr9JXzt76Rq00Q= last-modified Sat, 22 Oct 2016 12:38:23 GMT server cloudflare etag "a1f673e7df715f16dae49f4874009082" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TaML3zju2usG9gMIY23p9Dyfz69tmzDZOMvS9WYg5nu9aBedWXfp801e%2FllPwj%2BCEf0BusL0S6KJc%2FP8gTkykzbQzoaszrtl6EmJfhlsc9J0vACO35PmPJJgoICEhrwv1A2nPBS%2F7wdRpR7LP5mUTmNQ"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 7546f1be7db05fbe-MRS
GET H2	200	antibot.js Show response neftfcl.com/	950 B 586 B	72ms 71ms	Script application/javascript	5.42.199.52
General Check archive.org Show headers Download Go to Full URL https://neftfcl.com/antibot.js Requested by Host: neftfcl.com URL: https://neftfcl.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 5.42.199.52 -, , ASN (), Reverse DNS Software nginx / PleskLin Resource Hash 9688e03d6aa3f6a5781822aaf87dd0cfb150c7a258434ed98ca12876b1a3340f Request headers accept-language fr-FR,fr;q=0.9 Referer https://neftfcl.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36 Response headers date Mon, 03 Oct 2022 16:09:48 GMT content-encoding br last-modified Fri, 05 Aug 2022 00:27:36 GMT x-accel-version 0.01 server nginx etag W/"3b6-5e5738866ee00" x-powered-by PleskLin content-type application/javascript

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			neftfcl.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: p7sud8k71v3h7m0pk7hq2ff376

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://neftfcl.com/ Message: Mixed Content: The page at 'https://neftfcl.com/' was loaded over HTTPS, but requested an insecure element 'http://assets.stickpng.com/images/580b57fcd9996e24bc43c529.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://neftfcl.com/ Message: Mixed Content: The page at 'https://neftfcl.com/' was loaded over HTTPS, but requested an insecure element 'http://assets.stickpng.com/images/580b57fcd9996e24bc43c529.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.stickpng.com
btpartner.fr
neftfcl.com
185.49.20.102
2606:4700:3038::6815:eb02
5.42.199.52
218bc2b47bb718e6c65206f46f0c9791edcfdf5ccff6e6abcecb7637be7cf33b
38cf058b1abcc34ca278fc83c334742eddbbaa2cdb797817f9cbdd0c1fcf05ba
587fe57cdd9068e434e2dd7cea9ac2dbc6dd1d1ce2a5aa56c598e4c895302f05
9688e03d6aa3f6a5781822aaf87dd0cfb150c7a258434ed98ca12876b1a3340f