2sotto.sa.com Open in urlscan Pro
103.83.194.13  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request home-secure-login.html Show response 2sotto.sa.com/AMIGO/	2 KB 2 KB	767ms 244ms	Document text/html	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash ffea263b11809896893d90c75b1cf92bd7e41f61ca4c307d1b0f439b7ec96a44 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 2081 Content-Type text/html Date Thu, 28 Sep 2023 18:33:04 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 31 Aug 2023 20:09:14 GMT Server Apache
GET H/1.1	200 OK	styles.css 2sotto.sa.com/AMIGO/css/	2 KB 2 KB	244ms 244ms	Stylesheet text/css	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://2sotto.sa.com/AMIGO/css/styles.css Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash 4dc720e2b2342883f95c6682db391e0f0a549c08f655dcd8e4220851451ab1d3 Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Thu, 31 Aug 2023 10:29:40 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 2086
GET H/1.1	200 OK	logo2.png 2sotto.sa.com/AMIGO/img/	3 KB 3 KB	246ms 246ms	Image image/png	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://2sotto.sa.com/AMIGO/img/logo2.png Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Thu, 31 Aug 2023 07:49:54 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2743
GET H/1.1	200 OK	person-fill.svg 2sotto.sa.com/AMIGO/img/	225 B 471 B	735ms 245ms	Image image/svg+xml	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://2sotto.sa.com/AMIGO/img/person-fill.svg Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash 04a8fcd1f1b1d6f7c15c43acde3f3b02f7f051fa23d9405c50e796fc71261047 Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Thu, 31 Aug 2023 09:34:02 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 225
GET H/1.1	200 OK	lock-fill.svg 2sotto.sa.com/AMIGO/img/	273 B 519 B	492ms 245ms	Image image/svg+xml	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://2sotto.sa.com/AMIGO/img/lock-fill.svg Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash 0f10dddf944201c60f75e896f8504e241b9c2764bcddc3f5041c981fb321e858 Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Thu, 31 Aug 2023 09:34:46 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 273
GET H/1.1	200 OK	main.js Show response 2sotto.sa.com/AMIGO/js/	121 B 375 B	488ms 244ms	Script application/javascript	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://2sotto.sa.com/AMIGO/js/main.js Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash 5b9a4f0657a5deae7131cd69785565c06039bfe87ff1c9934c6e89dd24ba5abe Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Thu, 14 Sep 2023 09:37:16 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 121
GET H/1.1	200 OK	wurfl.js Show response wurfl.io/	4 KB 2 KB	296ms 76ms	Script application/javascript	52.76.165.247 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://wurfl.io/wurfl.js Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.76.165.247 Singapore, Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-76-165-247.ap-southeast-1.compute.amazonaws.com Software / Resource Hash d83dca202a4e9e03f699c025878763187e6fe4c79553bab5022474c03b65b5be Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Content-Encoding br Accept-Ch Sec-Ch-Ua, Sec-Ch-Ua-Arch, Sec-Ch-Ua-Bitness, Sec-Ch-Ua-Full-Version, Sec-Ch-Ua-Full-Version-List, Sec-Ch-Ua-Mobile, Sec-Ch-Ua-Model, Sec-Ch-Ua-Platform, Sec-Ch-Ua-Platform-Version Cross-Origin-Opener-Policy cross-origin Cross-Origin-Embedder-Policy cross-origin Vary accept-encoding, user-agent, sec-ch-ua, sec-ch-ua-arch, sec-ch-ua-bitness, sec-ch-ua-full-version, sec-ch-ua-full-version-list, sec-ch-ua-mobile, sec-ch-ua-model, sec-ch-ua-platform, sec-ch-ua-platform-version Content-Type application/javascript Cache-Control no-cache Cross-Origin-Resource-Policy cross-origin Connection keep-alive Content-Length 1443
GET H/1.1	200 OK	form1.js Show response 2sotto.sa.com/AMIGO/js/	14 KB 14 KB	491ms 246ms	Script application/javascript	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://2sotto.sa.com/AMIGO/js/form1.js Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash 34e38504852233b2bf7824e3b694ede4758516c9624c3ae61b4091dffa24e3b3 Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Tue, 05 Sep 2023 06:54:50 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 13981
GET H/1.1	200 OK	script.js Show response 2sotto.sa.com/AMIGO/js/	16 KB 16 KB	733ms 244ms	Script application/javascript	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://2sotto.sa.com/AMIGO/js/script.js Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/home-secure-login.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash e6e3db44f67f68e91b6541f0afcc0a7ddd34842378101ac88b8411ffb1586edc Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/home-secure-login.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Tue, 05 Sep 2023 08:18:16 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 15883
GET H/1.1	200 OK	background.jpeg 2sotto.sa.com/AMIGO/img/	30 KB 30 KB	496ms 246ms	Image image/jpeg	103.83.194.13 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://2sotto.sa.com/AMIGO/img/background.jpeg Requested by Host: 2sotto.sa.com URL: https://2sotto.sa.com/AMIGO/css/styles.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 103.83.194.13 , India, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS server.meghe.ycce.edu Software Apache / Resource Hash 9298d9a0f05a61fb25d323f61415bc311a032343cda64619792c8f2be3729c32 Request headers accept-language jp-JP,jp;q=0.9 Referer https://2sotto.sa.com/AMIGO/css/styles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Thu, 28 Sep 2023 18:33:04 GMT Last-Modified Thu, 31 Aug 2023 09:42:40 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 30840

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banrural (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| WURFL undefined| WurflJSNavigatorUAData undefined| newEvent object| WURFLPromises function| _0x42874d function| _0x55d4c6 function| _0x3c32 function| _0x44e3 function| _0x5bbb function| _0x658a57 function| _0x397d function| showDollarValue function| _0x44bc76

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2sotto.sa.com
wurfl.io
103.83.194.13
52.76.165.247
04a8fcd1f1b1d6f7c15c43acde3f3b02f7f051fa23d9405c50e796fc71261047
0f10dddf944201c60f75e896f8504e241b9c2764bcddc3f5041c981fb321e858
34e38504852233b2bf7824e3b694ede4758516c9624c3ae61b4091dffa24e3b3
4dc720e2b2342883f95c6682db391e0f0a549c08f655dcd8e4220851451ab1d3
5b9a4f0657a5deae7131cd69785565c06039bfe87ff1c9934c6e89dd24ba5abe
9298d9a0f05a61fb25d323f61415bc311a032343cda64619792c8f2be3729c32
a6fe470e9b113281c6a7288dd3fe1798e02044344844162226c530efc3696bdd
d83dca202a4e9e03f699c025878763187e6fe4c79553bab5022474c03b65b5be
e6e3db44f67f68e91b6541f0afcc0a7ddd34842378101ac88b8411ffb1586edc
ffea263b11809896893d90c75b1cf92bd7e41f61ca4c307d1b0f439b7ec96a44