biz139.inmotionhosting.com
Open in
urlscan Pro
216.194.168.38
Malicious Activity!
Public Scan
Effective URL: https://biz139.inmotionhosting.com/~better98/wp-admin/css/gtcard3/gtb/gtb/gt/gt/continue.php
Submission: On May 15 via api from BE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 29th 2019. Valid for: 2 years.
This is the only time biz139.inmotionhosting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: GTBank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 216.194.168.38 216.194.168.38 | 22611 (INMOTION) (INMOTION) | |
8 | 45.60.78.195 45.60.78.195 | 19551 (INCAPSULA) (INCAPSULA) | |
9 | 2 |
ASN22611 (INMOTION, US)
PTR: biz139.inmotionhosting.com
biz139.inmotionhosting.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
gtbank.com
ibank.gtbank.com |
21 KB |
2 |
inmotionhosting.com
1 redirects
biz139.inmotionhosting.com |
71 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
8 | ibank.gtbank.com |
biz139.inmotionhosting.com
|
2 | biz139.inmotionhosting.com | 1 redirects |
9 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
ibank.gtbank.com |
www.gtbank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.inmotionhosting.com Sectigo RSA Domain Validation Secure Server CA |
2019-10-29 - 2021-10-28 |
2 years | crt.sh |
ibank.gtbank.com DigiCert SHA2 Extended Validation Server CA |
2019-12-27 - 2022-02-01 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://biz139.inmotionhosting.com/~better98/wp-admin/css/gtcard3/gtb/gtb/gt/gt/continue.php
Frame ID: 4B90F9F86776A84DF706107014E4D88C
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://biz139.inmotionhosting.com/~better98/wp-admin/includes/bef.php
HTTP 302
https://biz139.inmotionhosting.com/~better98/wp-admin/css/gtcard3/gtb/gtb/gt/gt/continue.php Page URL
Detected technologies
FrontPage (Editors) ExpandDetected patterns
- meta generator /Microsoft FrontPage(?:\s((?:Express )?[\d.]+))?/i
- meta ProgId /^FrontPage\./i
PHP (Programming Languages) Expand
Detected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
47 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: CLICK TO VISIT
Search URL Search Domain Scan URL
Title: READ MORE
Search URL Search Domain Scan URL
Title: GET YOURS
Search URL Search Domain Scan URL
Title: GTBANK.COM
Search URL Search Domain Scan URL
Title: TERMS & CONDITIONS
Search URL Search Domain Scan URL
Title: WHISTLE BLOWER
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://biz139.inmotionhosting.com/~better98/wp-admin/includes/bef.php
HTTP 302
https://biz139.inmotionhosting.com/~better98/wp-admin/css/gtcard3/gtb/gtb/gt/gt/continue.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
continue.php
biz139.inmotionhosting.com/~better98/wp-admin/css/gtcard3/gtb/gtb/gt/gt/ Redirect Chain
|
70 KB 71 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
ibank.gtbank.com/ibank3/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ibtxt.png
ibank.gtbank.com/ibank3/img/ |
826 B 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
footbg.png
ibank.gtbank.com/ibank3/img/ |
331 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
info.png
ibank.gtbank.com/ibank3/img/ |
909 B 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gradbg.png
ibank.gtbank.com/ibank3/img/ |
183 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apps.png
ibank.gtbank.com/ibank3/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shield.png
ibank.gtbank.com/ibank3/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
token.png
ibank.gtbank.com/ibank3/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: GTBank (Banking)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
biz139.inmotionhosting.com
ibank.gtbank.com
216.194.168.38
45.60.78.195
2e4c633aec6812de304935dc93b8dfa3fa16176780832d362cc6340ecc832b84
53920bb8e98d002e6b57db8a516efe8835c6bda241020cc64ffad5ef4c5c28f9
736f03dc62c4d15eb44d93effa1b31bedfc4ad84db8f95d6e33eef2a8196b558
92027ff441180d1fe078e47cc39d2346ca895df87c3c928eb03323a5047e8794
9a7ca670add876603d9cfa2e106953f42d420ee481ff01ebabe686e97d902539
a6bcd752be34b36a77239beeb597fdb11f9e07d5be127ee523f03520d52d3ad2
aaeaf8ebf5b61080b3e1f7e675c85a42e051d4edb6183efb8968900198659dc2
b7fa39a9767692ee74840315b88d6d92a72b7a7dfa619aead9b954a39a2a92ee
cf6001507e4492235108f3cbc185d378be407cbada5bf6d556a110ad56295ecd