www.patraglobal.com Open in urlscan Pro
45.196.103.238 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.patraglobal.com/2019/0308/c9257a144753/page.htm
Submission: On August 13 via automatic, source openphish (August 13th 2019, 12:21:35 pm UTC)

Summary HTTP 44 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 44 HTTP transactions. The main IP is 45.196.103.238, located in Johannesburg, South Africa and belongs to DXTL-HK DXTL Tseung Kwan O Service, HK. The main domain is www.patraglobal.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 1st 2019. Valid for: 3 months.

This is the only time www.patraglobal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bet365 (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
12	45.196.103.238 45.196.103.238	134548 (DXTL-HK D...) (DXTL-HK DXTL Tseung Kwan O Service)
1	2606:4700:30:... 2606:4700:30::681f:43c1	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
44	3

12 45.196.103.238 (Johannesburg, South Africa)

ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK)

www.patraglobal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681f:43c1 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.36bet.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	patraglobal.com www.patraglobal.com	45 KB
1	36bet.org www.36bet.org
0	bdstatic.com Failed zz.bdstatic.com Failed
0	baidu.com Failed hm.baidu.com Failed
0	njmu.edu.cn Failed www.njmu.edu.cn Failed
44	5

	Domain	Requested by
12	www.patraglobal.com	www.patraglobal.com
1	www.36bet.org	www.patraglobal.com
0	zz.bdstatic.com Failed	www.patraglobal.com
0	hm.baidu.com Failed	www.patraglobal.com
0	www.njmu.edu.cn Failed	www.patraglobal.com
44	5

This site contains no links.

Subject Issuer	Validity	Valid
114shuma.com Let's Encrypt Authority X3	`2019-08-01` - `2019-10-30`	3 months	crt.sh
sni254516.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-06-21` - `2019-12-28`	6 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm
Frame ID: 46AE570D483795E0F24B95119BCB53F1
Requests: 43 HTTP requests in this frame

Frame: https://www.36bet.org/
Frame ID: 5E3C0DF3BB224205ABA199F24BD2129B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

44
Requests

30 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

45 kB
Transfer

165 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

https://www.patraglobal.com/_upload/site/00/09/9/logo.png HTTP 302
http://www.njmu.edu.cn/_upload/site/00/09/9/logo.png

Request Chain 17

https://www.patraglobal.com/_upload/article/images/2a/f4/88f1fabd449b88e37c1698167fd2/d2621d97-89ba-410b-8efc-415a4748426e.png HTTP 302
http://www.njmu.edu.cn/_upload/article/images/2a/f4/88f1fabd449b88e37c1698167fd2/d2621d97-89ba-410b-8efc-415a4748426e.png

Request Chain 18

https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/bx.png HTTP 302
http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/bx.png

Request Chain 34

https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/top.png HTTP 302
http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/top.png

Request Chain 36

https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/logo-bg.png HTTP 302
http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/logo-bg.png

Request Chain 37

https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/sous.png HTTP 302
http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/sous.png

Request Chain 38

https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/nav.png HTTP 302
http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/nav.png

44 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set page.htm Show response www.patraglobal.com/2019/0308/c9257a144753/	25 KB 9 KB	1175ms 365ms	Document text/html	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34 ASP.NET Resource Hash `94bc98d88f338f6577bce282cbd405b14deaf0072af98d6fa9228dd0843a2105` Request headers Host www.patraglobal.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site none Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-Type text/html; charset=gbk Content-Encoding gzip Expires Thu, 19 Nov 1981 08:52:00 GMT Vary Accept-Encoding Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34 ASP.NET Set-Cookie PHPSESSID=4kkl21ftd1kiqtsrlha6r4ddb4; path=/ Date Tue, 13 Aug 2019 12:14:42 GMT Content-Length 8721
GET H/1.1	200 OK	system.css www.patraglobal.com/_css/_system/	30 B 539 B	350ms 349ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_css/_system/system.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `48ff48c9f5ee148356163feae8daa755a2f58c8840d442a915b915119430ce60` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:43 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 147 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	1.css www.patraglobal.com/_upload/site/1/style/1/	273 B 737 B	1230ms 343ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_upload/site/1/style/1/1.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `6d1ffaef164bd6b08ebeb127af9ca724b2f06b7804ef1db60ba067dc79f5e1e2` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:43 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 345 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	18.css www.patraglobal.com/_upload/site/00/09/9/style/18/	16 B 527 B	5138ms 347ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_upload/site/00/09/9/style/18/18.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `aa3241d6752dafe8a2e26c414fbcb73967ad3f2ca67e8cf90bedc1f45cc7109f` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:48 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 135 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	simplenews.css www.patraglobal.com/_js/_portletPlugs/simpleNews/css/	18 KB 5 KB	7219ms 350ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_js/_portletPlugs/simpleNews/css/simplenews.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `d645991c9250ead8d283d022bb7bbdc1b64ef483c49d0e36ca274fc104e115b4` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:50 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 4625 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	datepicker.css www.patraglobal.com/_js/_portletPlugs/datepicker/css/	6 KB 2 KB	7565ms 346ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_js/_portletPlugs/datepicker/css/datepicker.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `848c4f09f7240db20c24088f54372ddec47d51c3784f930e67bdf7562d7781c5` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:50 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 1832 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	sudyNav.css www.patraglobal.com/_js/_portletPlugs/sudyNavi/css/	2 KB 1 KB	7911ms 344ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_js/_portletPlugs/sudyNavi/css/sudyNav.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `8ddace15ae47e074d6bc28a1d1f1cc22ed7bdac59c34ba4a37c8727126dfb4bd` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:50 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection close Content-Length 702 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET		jquery.min.js www.patraglobal.com/_js/	0 0

GET		jquery.sudy.wp.visitcount.js www.patraglobal.com/_js/	0 0

GET		jquery.datepicker.js www.patraglobal.com/_js/_portletPlugs/datepicker/js/	0 0

GET		datepicker_lang_HK.js www.patraglobal.com/_js/_portletPlugs/datepicker/js/	0 0

GET		jquery.sudyNav.js www.patraglobal.com/_js/_portletPlugs/sudyNavi/	0 0

GET		extends.js www.patraglobal.com/_upload/tpl/03/ca/970/template970/extends/	0 0

GET H/1.1	200 OK	style.css www.patraglobal.com/_upload/tpl/03/ca/970/template970/	35 KB 11 KB	10084ms 623ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/style.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `03ca79b1eb9e095077f0fa14e9676a71d8f3c3ab2a0761cc1548ad66f40bee0c` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:52 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 10941 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	mobile.css www.patraglobal.com/_upload/tpl/03/ca/970/template970/	8 KB 3 KB	10433ms 348ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/mobile.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `2eb3e068a78e3a2d40d92a94fc56986db17c10cd67ab20f4cac7762998d7c6e3` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:52 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 2500 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	media.css www.patraglobal.com/_upload/tpl/03/ca/970/template970/	14 KB 4 KB	10784ms 351ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/media.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `a0bac23d49a8b4971e140951d6b706e8ee6ed4098fd98e7d0ee131bb970eaf21` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:54 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 4218 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	200 OK	jq.js Show response www.patraglobal.com/	1 KB 2 KB	13567ms 346ms	Script application/javascript	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/jq.js Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash `466304970f8ec06645255466cc26222fcb0477e4abfb1807fdc55885925c3656` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 13 Aug 2019 12:14:56 GMT Content-Encoding gzip Last-Modified Fri, 12 Jul 2019 10:31:17 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "f3df7ef09c38d51:0" Vary Accept-Encoding Content-Type application/javascript Accept-Ranges bytes Content-Length 1270
GET		logo.png www.njmu.edu.cn/_upload/site/00/09/9/ Redirect Chain https://www.patraglobal.com/_upload/site/00/09/9/logo.png http://www.njmu.edu.cn/_upload/site/00/09/9/logo.png	0 0

GET		d2621d97-89ba-410b-8efc-415a4748426e.png www.njmu.edu.cn/_upload/article/images/2a/f4/88f1fabd449b88e37c1698167fd2/ Redirect Chain https://www.patraglobal.com/_upload/article/images/2a/f4/88f1fabd449b88e37c1698167fd2/d2621d97-89ba-410b-8efc-415a4748426e.png http://www.njmu.edu.cn/_upload/article/images/2a/f4/88f1fabd449b88e37c1698167fd2/d2621d97-89ba-410b-8efc-415a4748426e.png	0 0

GET		bx.png www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/ Redirect Chain https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/bx.png http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/bx.png	0 0

GET		comcus.js www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/	0 0

GET		list.js www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/	0 0

GET		main.js www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/	0 0

GET		app.js www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/	0 0

GET		_visitcount www.patraglobal.com/	0 0

GET H/1.1	200 OK	system_editor.css www.patraglobal.com/_css/_system/	57 KB 7 KB	10799ms 365ms	Stylesheet text/css	45.196.103.238 DXTL-HK DXTL Tseu...
General Check archive.org Show headers Download Go to Full URL https://www.patraglobal.com/_css/_system/system_editor.css Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 45.196.103.238 Johannesburg, South Africa, ASN134548 (DXTL-HK DXTL Tseung Kwan O Service, HK), Reverse DNS Software Microsoft-IIS/8.5 / PHP/5.6.34, ASP.NET Resource Hash `734f3013e12cddf5f38bcc3959576b71aa44f12fbd6d926f48355ddf5d590223` Request headers Sec-Fetch-Mode no-cors Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 13 Aug 2019 12:14:54 GMT Content-Encoding gzip Server Microsoft-IIS/8.5 X-Powered-By PHP/5.6.34, ASP.NET Vary Accept-Encoding Content-Type text/css;charset=gbk Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length 6312 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET		jquery.min.js www.njmu.edu.cn/_js/	0 0

GET		jquery.sudy.wp.visitcount.js www.njmu.edu.cn/_js/	0 0

GET		jquery.datepicker.js www.njmu.edu.cn/_js/_portletPlugs/datepicker/js/	0 0

GET		datepicker_lang_HK.js www.njmu.edu.cn/_js/_portletPlugs/datepicker/js/	0 0

GET		jquery.sudyNav.js www.njmu.edu.cn/_js/_portletPlugs/sudyNavi/	0 0

GET		extends.js www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/extends/	0 0

GET H2	200	/ www.36bet.org/ Frame 5E3C	0 0	396ms 329ms	Document text/html	2606:4700:30::681f:43c1 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.36bet.org/ Requested by Host: www.patraglobal.com URL: https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681f:43c1 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers :method GET :authority www.36bet.org :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://www.patraglobal.com/2019/0308/c9257a144753/page.htm Response headers status 200 date Tue, 13 Aug 2019 12:21:14 GMT content-type text/html set-cookie __cfduid=df1c98ccf75a3bd2eeff5a31aea02cbb61565698874; expires=Wed, 12-Aug-20 12:21:14 GMT; path=/; domain=.36bet.org; HttpOnly last-modified Fri, 26 Jul 2019 04:55:30 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 505aa5cdcb9b273c-FRA content-encoding br
GET		hm.js hm.baidu.com/	0 0

GET		push.js zz.bdstatic.com/linksubmit/	0 0

GET		top.png www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/ Redirect Chain https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/top.png http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/top.png	0 0

GET		menu-icon-arrow-white.png www.patraglobal.com/_upload/tpl/03/ca/970/template970/css/img/	0 0

GET		logo-bg.png www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/ Redirect Chain https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/logo-bg.png http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/logo-bg.png	0 0

GET		sous.png www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/ Redirect Chain https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/sous.png http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/sous.png	0 0

GET		nav.png www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/ Redirect Chain https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/images/nav.png http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/nav.png	0 0

GET		comcus.js www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/	0 0

GET		list.js www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/	0 0

GET		main.js www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/	0 0

GET		app.js www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_js/jquery.min.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_js/jquery.sudy.wp.visitcount.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_js/_portletPlugs/datepicker/js/jquery.datepicker.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_js/_portletPlugs/datepicker/js/datepicker_lang_HK.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_js/_portletPlugs/sudyNavi/jquery.sudyNav.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/extends/extends.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/site/00/09/9/logo.png

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/article/images/2a/f4/88f1fabd449b88e37c1698167fd2/d2621d97-89ba-410b-8efc-415a4748426e.png

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/bx.png

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/comcus.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/list.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/main.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/js/app.js

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_visitcount?siteId=9&type=3&articleId=144753

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_js/jquery.min.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_js/jquery.sudy.wp.visitcount.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_js/_portletPlugs/datepicker/js/jquery.datepicker.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_js/_portletPlugs/datepicker/js/datepicker_lang_HK.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_js/_portletPlugs/sudyNavi/jquery.sudyNav.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/extends/extends.js

Domain: hm.baidu.com
URL: https://hm.baidu.com/hm.js?8bdb4b7e552d8a3cb45fb7ba6ecacf50

Domain: zz.bdstatic.com
URL: https://zz.bdstatic.com/linksubmit/push.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/top.png

Domain: www.patraglobal.com
URL: https://www.patraglobal.com/_upload/tpl/03/ca/970/template970/css/img/menu-icon-arrow-white.png

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/logo-bg.png

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/sous.png

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/images/nav.png

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/comcus.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/list.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/main.js

Domain: www.njmu.edu.cn
URL: http://www.njmu.edu.cn/_upload/tpl/03/ca/970/template970/js/app.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bet365 (Entertainment)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hm.baidu.com
www.36bet.org
www.njmu.edu.cn
www.patraglobal.com
zz.bdstatic.com
hm.baidu.com
www.njmu.edu.cn
www.patraglobal.com
zz.bdstatic.com
2606:4700:30::681f:43c1
45.196.103.238
03ca79b1eb9e095077f0fa14e9676a71d8f3c3ab2a0761cc1548ad66f40bee0c
2eb3e068a78e3a2d40d92a94fc56986db17c10cd67ab20f4cac7762998d7c6e3
466304970f8ec06645255466cc26222fcb0477e4abfb1807fdc55885925c3656
48ff48c9f5ee148356163feae8daa755a2f58c8840d442a915b915119430ce60
6d1ffaef164bd6b08ebeb127af9ca724b2f06b7804ef1db60ba067dc79f5e1e2
734f3013e12cddf5f38bcc3959576b71aa44f12fbd6d926f48355ddf5d590223
848c4f09f7240db20c24088f54372ddec47d51c3784f930e67bdf7562d7781c5
8ddace15ae47e074d6bc28a1d1f1cc22ed7bdac59c34ba4a37c8727126dfb4bd
94bc98d88f338f6577bce282cbd405b14deaf0072af98d6fa9228dd0843a2105
a0bac23d49a8b4971e140951d6b706e8ee6ed4098fd98e7d0ee131bb970eaf21
aa3241d6752dafe8a2e26c414fbcb73967ad3f2ca67e8cf90bedc1f45cc7109f
d645991c9250ead8d283d022bb7bbdc1b64ef483c49d0e36ca274fc104e115b4

www.patraglobal.com Open in urlscan Pro 45.196.103.238 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

44 Requests

30 %HTTPS

50 %IPv6

5 Domains

5 Subdomains

3 IPs

2 Countries

45 kBTransfer

165 kBSize

0 Cookies

0 Outgoing links

Redirected requests

44 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

www.patraglobal.com Open in urlscan Pro
45.196.103.238 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

44
Requests

30 %
HTTPS

50 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

45 kB
Transfer

165 kB
Size

0
Cookies

44 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!