healthfiles.co.in
Open in
urlscan Pro
166.62.28.122
Malicious Activity!
Public Scan
Effective URL: http://healthfiles.co.in/oky/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt...
Submission Tags: @jcybersec_
Submission: On July 15 via api from GB
Summary
This is the only time healthfiles.co.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 166.62.28.122 166.62.28.122 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:815::200e | 15169 (GOOGLE) (GOOGLE) | |
14 | 5 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-28-122.ip.secureserver.net
healthfiles.co.in |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
healthfiles.co.in
healthfiles.co.in |
332 KB |
2 |
google-analytics.com
www.google-analytics.com |
18 KB |
1 |
googleapis.com
fonts.googleapis.com |
589 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
11 | healthfiles.co.in |
healthfiles.co.in
|
2 | www.google-analytics.com |
healthfiles.co.in
|
1 | fonts.googleapis.com |
healthfiles.co.in
|
14 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
upload.video.google.com GTS CA 1O1 |
2020-06-17 - 2020-09-09 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://healthfiles.co.in/oky/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: 5550A0C04F936D6B8706717362549180
Requests: 6 HTTP requests in this frame
Frame:
http://healthfiles.co.in/oky/Excel/xl/link/Excel/PO/log.php?mylove=
Frame ID: B17997898C72F0E2351A992EB3892831
Requests: 1 HTTP requests in this frame
Frame:
http://healthfiles.co.in/oky/Excel/xl/link/Excel/PO/l0gins.php?mylove=
Frame ID: 1C5F026298366C4EB2B4CFADAEE08F8F
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://healthfiles.co.in/oky/Excel/xl/link/Excel/index.php?mylove= Page URL
- http://healthfiles.co.in/oky/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=6... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://healthfiles.co.in/oky/Excel/xl/link/Excel/index.php?mylove= Page URL
- http://healthfiles.co.in/oky/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- http://fonts.googleapis.com/css?family=Fauna+One|Muli HTTP 307
- https://fonts.googleapis.com/css?family=Fauna+One|Muli
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.php
healthfiles.co.in/oky/Excel/xl/link/Excel/ |
909 B 787 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif
healthfiles.co.in/oky/Excel/xl/link/Excel/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lintex.png
healthfiles.co.in/oky/Excel/xl/link/Excel/ |
119 KB 119 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
page.php
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ |
19 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pobg.gif
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ |
149 KB 149 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
log.php
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ Frame B179 |
657 B 625 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
l0gins.php
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ Frame 1C5F |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ga.js
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ Frame 1C5F |
42 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ Frame 1C5F |
94 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_popup.css
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ Frame 1C5F |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_popup.js
healthfiles.co.in/oky/Excel/xl/link/Excel/PO/ Frame 1C5F |
2 KB 921 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame 1C5F Redirect Chain
|
2 KB 589 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ga.js
www.google-analytics.com/ Frame 1C5F |
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
__utm.gif
www.google-analytics.com/r/ Frame 1C5F |
35 B 373 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 1C5F |
622 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| myVar function| myFunction function| showPage5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.healthfiles.co.in/ | Name: __utmb Value: 28200613.1.10.1594775131 |
|
.healthfiles.co.in/ | Name: __utmt Value: 1 |
|
.healthfiles.co.in/ | Name: __utmc Value: 28200613 |
|
.healthfiles.co.in/ | Name: __utmz Value: 28200613.1594775131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.healthfiles.co.in/ | Name: __utma Value: 28200613.2124277210.1594775131.1594775131.1594775131.1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
healthfiles.co.in
www.google-analytics.com
166.62.28.122
2a00:1450:4001:800::200a
2a00:1450:4001:806::200e
2a00:1450:4001:815::200e
06c16a259eae4270acd719c7aa7420b5e0b5104f65b325e47dc55a8d31343b7a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
4e2ed635abf0b2dcbac3ea04d16ccf58bb2195364d65b76190f03da0f43255c5
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19
59092cc82cd00a172b163d051befebb6521ae7cb79d2888a99b10fc3ab8f0eff
642b823bfda63344a1342fbc28bc61fde43119e208b77bffe545d2d4f0518e85
7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5
8180ef2d3d03fad302b169e59b768fadf177b947ffd376b7d2dfe06f3a23d73e
82f04c5d953b2ccb07f301b00299566e9a6efcc00a654259cd44ca71bb4db7fb
8308cd4f7dbe8a301e058f6ed215fdeca44bdec56c2ea2ff7d645bf631afe7b2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8ca3883a0ab4a909fe78d219e4d2380d3013ea3e0e83542d71cc0a0a759d3ac3
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
baa9df790a290c26723f44e85f9d8a09b08ef7a4409f7bd1f2804f5b3e30a4ae
c04cf09840411f295ff69f2918f3b47668034fecc79e11211d2cef3436c1c513
e9c6d9cac375cc5fb90af25b47287a11f77163ff788777143df127c074d661f6