URL: http://induimperial.com/wp-zeus//cp.php?m=login
Submission Tags: c2 malware zeus Search All
Submission: On April 22 via api from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 167.114.219.245, located in Montreal, Canada and belongs to OVH, FR. The main domain is induimperial.com.
This is the only time induimperial.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 167.114.219.245 16276 (OVH)
2 1
Apex Domain
Subdomains
Transfer
2 induimperial.com
induimperial.com
2 KB
2 1
Domain Requested by
2 induimperial.com induimperial.com
2 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://induimperial.com/wp-zeus//cp.php?m=login
Frame ID: 5095634072FD8CCA7C24899751AE7615
Requests: 2 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

2 kB
Transfer

5 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set cp.php
induimperial.com/wp-zeus//
1 KB
1 KB
Document
General
Full URL
http://induimperial.com/wp-zeus//cp.php?m=login
Protocol
HTTP/1.1
Server
167.114.219.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
host2.ccomercialmedellin.com
Software
nginx /
Resource Hash
92f22817daca6e7ed293fc8120508d71d0d8528d648ea94e641772c305d6cab3

Request headers

Host
induimperial.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx
Date
Wed, 22 Apr 2020 17:22:39 GMT
Content-Type
text/html; charset=utf-8
Content-Length
579
Connection
keep-alive
Set-Cookie
ref=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/wp-zeus p=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/wp-zeus u=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/wp-zeus
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, pre-check=0, post-check=0
Pragma
no-cache
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
style.css
induimperial.com/wp-zeus//theme/
3 KB
1 KB
Stylesheet
General
Full URL
http://induimperial.com/wp-zeus//theme/style.css
Requested by
Host: induimperial.com
URL: http://induimperial.com/wp-zeus//cp.php?m=login
Protocol
HTTP/1.1
Server
167.114.219.245 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
host2.ccomercialmedellin.com
Software
nginx /
Resource Hash
5551cd459eb889cc473b33eb9f55a64e3ec888925e581f207c3bf1ed04e1aae6

Request headers

Referer
http://induimperial.com/wp-zeus//cp.php?m=login
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 22 Apr 2020 17:22:39 GMT
Content-Encoding
gzip
Last-Modified
Mon, 09 Jun 2014 13:29:28 GMT
Server
nginx
Vary
Accept-Encoding,User-Agent
Content-Type
text/css; charset=UTF-8
Cache-Control
public
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
878
Expires
Wed, 15 Apr 2020 20:00:00 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

induimperial.com
167.114.219.245
5551cd459eb889cc473b33eb9f55a64e3ec888925e581f207c3bf1ed04e1aae6
92f22817daca6e7ed293fc8120508d71d0d8528d648ea94e641772c305d6cab3