stop-virus.org - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 151.236.34.168, located in United Kingdom and belongs to SIMPLYTRANSIT, GB. The main domain is stop-virus.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 22nd 2020. Valid for: 3 months.

This is the only time stop-virus.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
5	151.236.34.168 151.236.34.168		29550 (SIMPLYTRA...) (SIMPLYTRANSIT)
5	1

5 151.236.34.168 (United Kingdom)

ASN29550 (SIMPLYTRANSIT, GB)
PTR: 151-236-34-168.static.as29550.net

stop-virus.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	stop-virus.org stop-virus.org	487 KB
5	1

	Domain	Requested by
5	stop-virus.org	stop-virus.org
5	1

This site contains no links.

Subject Issuer	Validity	Valid
stop-virus.org Let's Encrypt Authority X3	`2020-08-22` - `2020-11-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: AA3396E10F0C352242B2A0472D75E96E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

487 kB
Transfer

487 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request page.php Show response stop-virus.org/wp-includes/cea/Excel/	2 KB 1 KB	75ms 24ms	Document text/html	151.236.34.168 SIMPLYTRANSIT
General Check archive.org Show headers Download Go to Full URL https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 151.236.34.168 , United Kingdom, ASN29550 (SIMPLYTRANSIT, GB), Reverse DNS 151-236-34-168.static.as29550.net Software nginx / PHP/7.2.33 PleskLin Resource Hash `a9fb7aa2e8a52eb94eb5e71e73012b9c6e7a30004a594a9ff2128a88eaa20ae1` Request headers :method GET :authority stop-virus.org :scheme https :path /wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 server nginx date Wed, 16 Sep 2020 05:51:21 GMT content-type text/html; charset=UTF-8 content-length 976 x-powered-by PHP/7.2.33 PleskLin vary Accept-Encoding,User-Agent content-encoding gzip
GET H2	200	e1.png stop-virus.org/wp-includes/cea/Excel/images/	173 KB 173 KB	32ms 31ms	Image image/png	151.236.34.168 SIMPLYTRANSIT
General Check archive.org Show headers Download Go to Show image Full URL https://stop-virus.org/wp-includes/cea/Excel/images/e1.png Requested by Host: stop-virus.org URL: https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 151.236.34.168 , United Kingdom, ASN29550 (SIMPLYTRANSIT, GB), Reverse DNS 151-236-34-168.static.as29550.net Software nginx / PleskLin Resource Hash `fbcee5dfea91e44c2b8eb9b131fdab1c1cb0476c51f7913c999f62636fd8d8ad` Request headers Referer https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 05:51:21 GMT etag "5f604f28-2b229" last-modified Tue, 15 Sep 2020 05:20:40 GMT server nginx x-powered-by PleskLin content-type image/png status 200 cache-control max-age=10368000 accept-ranges bytes content-length 176681 expires max-age=A10368000, public
GET H2	200	e3.png stop-virus.org/wp-includes/cea/Excel/images/	166 KB 167 KB	64ms 63ms	Image image/png	151.236.34.168 SIMPLYTRANSIT
General Check archive.org Show headers Download Go to Show image Full URL https://stop-virus.org/wp-includes/cea/Excel/images/e3.png Requested by Host: stop-virus.org URL: https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 151.236.34.168 , United Kingdom, ASN29550 (SIMPLYTRANSIT, GB), Reverse DNS 151-236-34-168.static.as29550.net Software nginx / PleskLin Resource Hash `0f3977d802138e9b0ea76c44e0515bd1a45a7a0fb74691c1e820eb880b311973` Request headers Referer https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 05:51:21 GMT etag "5f604f28-299e4" last-modified Tue, 15 Sep 2020 05:20:40 GMT server nginx x-powered-by PleskLin content-type image/png status 200 cache-control max-age=10368000 accept-ranges bytes content-length 170468 expires max-age=A10368000, public
GET H2	200	e2.png stop-virus.org/wp-includes/cea/Excel/images/	145 KB 146 KB	61ms 60ms	Image image/png	151.236.34.168 SIMPLYTRANSIT
General Check archive.org Show headers Download Go to Show image Full URL https://stop-virus.org/wp-includes/cea/Excel/images/e2.png Requested by Host: stop-virus.org URL: https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 151.236.34.168 , United Kingdom, ASN29550 (SIMPLYTRANSIT, GB), Reverse DNS 151-236-34-168.static.as29550.net Software nginx / PleskLin Resource Hash `e2f3d9a3bdfe3c28782c18ac7559eabfa8b0be4a07709653eded13f9ed8de2eb` Request headers Referer https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 05:51:21 GMT etag "5f604f28-2453a" last-modified Tue, 15 Sep 2020 05:20:40 GMT server nginx x-powered-by PleskLin content-type image/png status 200 cache-control max-age=10368000 accept-ranges bytes content-length 148794 expires max-age=A10368000, public
GET H2	200	btn.png stop-virus.org/wp-includes/cea/Excel/images/	792 B 1005 B	61ms 61ms	Image image/png	151.236.34.168 SIMPLYTRANSIT
General Check archive.org Show headers Download Go to Show image Full URL https://stop-virus.org/wp-includes/cea/Excel/images/btn.png Requested by Host: stop-virus.org URL: https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 151.236.34.168 , United Kingdom, ASN29550 (SIMPLYTRANSIT, GB), Reverse DNS 151-236-34-168.static.as29550.net Software nginx / PleskLin Resource Hash `eface1e765d5861e8b074d3006c1c4fe4e7549e0f74cf958c32e92e453ef3828` Request headers Referer https://stop-virus.org/wp-includes/cea/Excel/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 05:51:21 GMT last-modified Tue, 15 Sep 2020 05:20:40 GMT server nginx x-powered-by PleskLin vary User-Agent content-type image/png status 200 x-accel-version 0.01 cache-control max-age=10368000 accept-ranges bytes content-length 792 expires max-age=A10368000, public

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

stop-virus.org
151.236.34.168
0f3977d802138e9b0ea76c44e0515bd1a45a7a0fb74691c1e820eb880b311973
a9fb7aa2e8a52eb94eb5e71e73012b9c6e7a30004a594a9ff2128a88eaa20ae1
e2f3d9a3bdfe3c28782c18ac7559eabfa8b0be4a07709653eded13f9ed8de2eb
eface1e765d5861e8b074d3006c1c4fe4e7549e0f74cf958c32e92e453ef3828
fbcee5dfea91e44c2b8eb9b131fdab1c1cb0476c51f7913c999f62636fd8d8ad

stop-virus.org Open in urlscan Pro 151.236.34.168 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

487 kBTransfer

487 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

stop-virus.org Open in urlscan Pro
151.236.34.168 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

487 kB
Transfer

487 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!