bb-stylo.ddnsking.com Open in urlscan Pro
50.17.8.120 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bb-stylo.ddnsking.com/
Effective URL:
https://bb-stylo.ddnsking.com/mobi_two.php
Submission: On October 28 via api (October 28th 2023, 4:40:29 am UTC) from US — Scanned from US

Summary HTTP 28 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 1 countries across 5 domains to perform 28 HTTP transactions. The main IP is 50.17.8.120, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is bb-stylo.ddnsking.com.
TLS certificate: Issued by ZeroSSL RSA Domain Secure Site CA on October 28th 2023. Valid for: 3 months.

This is the only time bb-stylo.ddnsking.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco do Brasil (Banking)

Domain & IP information

	IP Address		AS Autonomous System
5	50.17.8.120 50.17.8.120		14618 (AMAZON-AES) (AMAZON-AES)
6	2606:4700:303... 2606:4700:3035::ac43:c06d		13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4006:821::200a		15169 (GOOGLE) (GOOGLE)
28	4

5 50.17.8.120 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-17-8-120.compute-1.amazonaws.com

bb-stylo.ddnsking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:3035::ac43:c06d (United States)

ASN13335 (CLOUDFLARENET, US)

selimdoyranli.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:821::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	selimdoyranli.com selimdoyranli.com	160 KB
5	ddnsking.com bb-stylo.ddnsking.com	60 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
0	jquery.com Failed code.jquery.com Failed
0	bootstrapcdn.com Failed maxcdn.bootstrapcdn.com Failed
28	5

	Domain	Requested by
6	selimdoyranli.com	bb-stylo.ddnsking.com
5	bb-stylo.ddnsking.com	bb-stylo.ddnsking.com
2	fonts.googleapis.com	bb-stylo.ddnsking.com
0	code.jquery.com Failed	bb-stylo.ddnsking.com
0	maxcdn.bootstrapcdn.com Failed	bb-stylo.ddnsking.com
28	5

This site contains no links.

Subject Issuer	Validity	Valid
bb-stylo.ddnsking.com ZeroSSL RSA Domain Secure Site CA	`2023-10-28` - `2024-01-26`	3 months	crt.sh
selimdoyranli.com GTS CA 1P5	`2023-09-05` - `2023-12-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-09` - `2024-01-01`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bb-stylo.ddnsking.com/mobi_two.php
Frame ID: 101BCC337CB366B231A07C2DAC326A40
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

-

Page URL History Show full URLs

https://bb-stylo.ddnsking.com/ Page URL
https://bb-stylo.ddnsking.com/mobi.php?HXNi Page URL
https://bb-stylo.ddnsking.com/mobi_two.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

28
Requests

46 %
HTTPS

67 %
IPv6

5
Domains

5
Subdomains

4
IPs

1
Countries

222 kB
Transfer

699 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bb-stylo.ddnsking.com/ Page URL
https://bb-stylo.ddnsking.com/mobi.php?HXNi Page URL
https://bb-stylo.ddnsking.com/mobi_two.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
bb-stylo.ddnsking.com/ 384 B
638 B 676ms
577ms Document
text/html 50.17.8.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bb-stylo.ddnsking.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 50.17.8.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-8-120.compute-1.amazonaws.com
Software: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4 / PHP/8.2.4
Resource Hash: 3d760f53efee6927f9349e94ca07a5b7d3da8f76baaab7b33d74617a807e187a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 384
Content-Type: text/html; charset=UTF-8
Date: Sat, 28 Oct 2023 04:40:24 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
X-Powered-By: PHP/8.2.4

GET
H/1.1 200
OK mobi.php Show response
bb-stylo.ddnsking.com/ 2 KB
2 KB 39ms
39ms Document
text/html 50.17.8.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 50.17.8.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-8-120.compute-1.amazonaws.com
Software: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4 / PHP/8.2.4
Resource Hash: 655313031be8b2d3719078fad37f7ec38c2c5b9032d3fa928212e73812e99792

Request headers

Referer: https://bb-stylo.ddnsking.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 1768
Content-Type: text/html; charset=UTF-8
Date: Sat, 28 Oct 2023 04:40:25 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
X-Powered-By: PHP/8.2.4

GET
H2 200 grid12.css
selimdoyranli.com/cdn/material-form/css/ 15 KB
2 KB 748ms
464ms Stylesheet
text/css 2606:4700:3035::ac43:c06d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://selimdoyranli.com/cdn/material-form/css/grid12.css
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c06d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48f232df5be9bbaf1f8357b1501ee2514d6dcc90876c5d8adae65fcb843ff88f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 04:40:26 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 07 Mar 2021 16:12:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5z2FuQgSvcLJEiRi92i92Lc8eeY9rjSKWWzhXSpMe%2FyREdO7BN0UmThq9B9ljegj0mVWjnZf5zzXwo7hOb96r4TOmH7g98i5aGJJhe0MsM5vkG0%2Fqm%2BWaRpokai1QHWgNq6vS58Epki2WPoNd1jNTg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 81d0802aaf0b4bcc-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 04 Nov 2023 04:40:25 GMT

GET
H/1.1 200
OK style2.css
bb-stylo.ddnsking.com/css/ 5 KB
6 KB 39ms
37ms Stylesheet
text/css 50.17.8.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bb-stylo.ddnsking.com/css/style2.css
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 50.17.8.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-8-120.compute-1.amazonaws.com
Software: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4 /
Resource Hash: 866bf79b51ebf3e4a90702b1d2aac6eedaa68d5a26da8ed447c5d6c5fa9207d5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/mobi.php?HXNi
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sat, 28 Oct 2023 04:40:25 GMT
Last-Modified: Sat, 25 Feb 2017 21:06:46 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
ETag: "1575-549613953c580"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5493

GET
H2 200 jquery-ui.css
selimdoyranli.com/cdn/material-form/css/ 35 KB
8 KB 754ms
470ms Stylesheet
text/css 2606:4700:3035::ac43:c06d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://selimdoyranli.com/cdn/material-form/css/jquery-ui.css
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c06d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cecf5c59ff7c288bf90cc6221756bd9612464308557b92ca54f27d1cd108f3cd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 04:40:26 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 07 Mar 2021 16:12:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BFaFvraccSzgxTx1aNReSSjP6EIX67l5CMX6gj%2Fi0j26uPfXLp6u3%2BoInVHI6xDKHPQn52J4WfeuZjwRc%2BlQY%2BBaEBqXYnoagobKbVsm8JujP1ei837p8k%2BXDvvXFt2RfUd3L44R%2FkgLkdh1%2FovKyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 81d0802aaf0d4bcc-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 04 Nov 2023 04:40:25 GMT

GET
H2 200 animate.css
selimdoyranli.com/cdn/material-form/css/ 43 KB
4 KB 756ms
473ms Stylesheet
text/css 2606:4700:3035::ac43:c06d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://selimdoyranli.com/cdn/material-form/css/animate.css
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c06d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b27f83f127198d94a7222427706162e02b97948eb6fa9a02db5882902feb3fd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 04:40:26 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 07 Mar 2021 16:12:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dV3qrbSo4347dsoKLTVnyRYDTSs8JqMkNce0tLAvieQTz0Kb9864a6QazGgFBWnB6lQRG1TURJL2OqftkIlVkDZ9qEKuNxArapisQ%2Bpy6DrBj9d%2ByQyUUXWaff34u2%2FbsG9NStKYV56xn%2F70ezNJCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=604800
cf-ray: 81d0802aaf0c4bcc-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 04 Nov 2023 04:40:25 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
1 KB 99ms
39ms Stylesheet
text/css 2607:f8b0:4006:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 28 Oct 2023 04:40:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 28 Oct 2023 02:57:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 28 Oct 2023 04:40:25 GMT

GET
H2 200 icon
fonts.googleapis.com/ 569 B
439 B 101ms
41ms Stylesheet
text/css 2607:f8b0:4006:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 28 Oct 2023 04:40:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 28 Oct 2023 04:40:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 28 Oct 2023 04:40:25 GMT

GET
H2 200 jquery.min.js Show response
selimdoyranli.com/cdn/material-form/js/ 82 KB
30 KB 895ms
612ms Script
application/javascript 2606:4700:3035::ac43:c06d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://selimdoyranli.com/cdn/material-form/js/jquery.min.js
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c06d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 04:40:26 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 07 Mar 2021 16:13:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DRTEHzPqevxKcRKmppbKBBFQ%2Fhm6Wnmp6W0K2NpgfZuTl2OPosoQ74nZdnT051F0uVPYTJakhwpS5VplJfdmH8MM%2BpIvULOGmu0yzVudR%2BAClL5l%2FoVuqvUqi1lZ9uvjAlR3%2FfQ6%2BFwETugREU9P4g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 81d0802aaf104bcc-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 04 Nov 2023 04:40:25 GMT

GET
H2 200 custom.js Show response
selimdoyranli.com/cdn/material-form/js/ 727 B
857 B 742ms
460ms Script
application/javascript 2606:4700:3035::ac43:c06d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://selimdoyranli.com/cdn/material-form/js/custom.js
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c06d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdb58c53dcca10d1a800a7584b59de544058f612cd3714e9d8d17d7311735b4f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 04:40:26 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 07 Mar 2021 16:13:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6rKnjbJvvIIDmNdcfgO1ze%2BdYfTGYvh6YvM6ZfLubYm1fnnHIYGTjL1BfDMegq%2FLnbdFl%2FaHqFYKSknRc249VdLv9IelQAyAiek51Kd9%2B21dfwGsn1%2F5wEX7Zv%2Fcn%2BbPDIMdo%2F7jkamvxZm%2BDtmViA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 81d0802aaf0f4bcc-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 04 Nov 2023 04:40:25 GMT

GET
H2 200 jquery-ui.js Show response
selimdoyranli.com/cdn/material-form/js/ 460 KB
115 KB 1146ms
864ms Script
application/javascript 2606:4700:3035::ac43:c06d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://selimdoyranli.com/cdn/material-form/js/jquery-ui.js
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:c06d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c8e8d7408611519ceda4e759ae9987834a17addc8f0028241ffed7fb0113612

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 28 Oct 2023 04:40:26 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 07 Mar 2021 16:13:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6GrP6ZSJgPNS8p9fqW8I64PRGKpT8RoUVtcYg8VvPMm%2B0ui99zzpTjsCkNd28PdUv3kPiDjUyRxjaF41LEjnkHyBaM64QUn9VYTDauvANac5%2B7zo%2By7UKd5PIwXq0O2ZqDBdwdsv9qe1V25g5vE%2B%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=604800
cf-ray: 81d0802aaf0e4bcc-BUF
alt-svc: h3=":443"; ma=86400
expires: Sat, 04 Nov 2023 04:40:25 GMT

GET bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/ 0
0

GET jquery-1.11.1.min.js
code.jquery.com/ 0
0

GET bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/ 0
0

GET
H/1.1 200
OK int.png
bb-stylo.ddnsking.com/img/ 49 KB
50 KB 38ms
38ms Image
image/png 50.17.8.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bb-stylo.ddnsking.com/img/int.png
Requested by: Host: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/css/style2.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 50.17.8.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-8-120.compute-1.amazonaws.com
Software: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4 /
Resource Hash: af66820441c52dd6918e822d7246eca4dc82b968b6cfecfd67562fb273dcd7ab

Request headers

accept-language: en-US,en;q=0.9
Referer: https://bb-stylo.ddnsking.com/css/style2.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Sat, 28 Oct 2023 04:40:26 GMT
Last-Modified: Sat, 25 Feb 2017 21:06:16 GMT
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
ETag: "c52b-54961378a0200"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 50475

GET
H/1.1 200
OK Primary Request mobi_two.php
bb-stylo.ddnsking.com/ 2 KB
2 KB 78ms
78ms Document
text/html 50.17.8.120
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bb-stylo.ddnsking.com/mobi_two.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 50.17.8.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-8-120.compute-1.amazonaws.com
Software: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4 / PHP/8.2.4
Resource Hash

Request headers

Referer: https://bb-stylo.ddnsking.com/mobi.php?HXNi
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 2284
Content-Type: text/html; charset=UTF-8
Date: Sat, 28 Oct 2023 04:40:29 GMT
Keep-Alive: timeout=5, max=96
Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4
X-Powered-By: PHP/8.2.4

GET grid12.css
selimdoyranli.com/cdn/material-form/css/ 0
0

GET styles.css
bb-stylo.ddnsking.com/css/ 0
0

GET jquery-ui.css
selimdoyranli.com/cdn/material-form/css/ 0
0

GET animate.css
selimdoyranli.com/cdn/material-form/css/ 0
0

GET css
fonts.googleapis.com/ 0
0

GET icon
fonts.googleapis.com/ 0
0

GET jquery.min.js
selimdoyranli.com/cdn/material-form/js/ 0
0

GET custom.js
selimdoyranli.com/cdn/material-form/js/ 0
0

GET jquery-ui.js
selimdoyranli.com/cdn/material-form/js/ 0
0

GET bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/ 0
0

GET jquery-1.11.1.min.js
code.jquery.com/ 0
0

GET bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: maxcdn.bootstrapcdn.com
URL: http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css

Domain: code.jquery.com
URL: http://code.jquery.com/jquery-1.11.1.min.js

Domain: maxcdn.bootstrapcdn.com
URL: http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js

Domain: selimdoyranli.com
URL: https://selimdoyranli.com/cdn/material-form/css/grid12.css

Domain: bb-stylo.ddnsking.com
URL: https://bb-stylo.ddnsking.com/css/styles.css

Domain: selimdoyranli.com
URL: https://selimdoyranli.com/cdn/material-form/css/jquery-ui.css

Domain: selimdoyranli.com
URL: https://selimdoyranli.com/cdn/material-form/css/animate.css

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700

Domain: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons

Domain: selimdoyranli.com
URL: https://selimdoyranli.com/cdn/material-form/js/jquery.min.js

Domain: selimdoyranli.com
URL: https://selimdoyranli.com/cdn/material-form/js/custom.js

Domain: selimdoyranli.com
URL: https://selimdoyranli.com/cdn/material-form/js/jquery-ui.js

Domain: maxcdn.bootstrapcdn.com
URL: http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css

Domain: code.jquery.com
URL: http://code.jquery.com/jquery-1.11.1.min.js

Domain: maxcdn.bootstrapcdn.com
URL: http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco do Brasil (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi#91i2mW5Vn02LX8VSINXsFvTBD9yZB8UIoUdVO4BhDCrD4R9C50AJI8CQ3tHakNM/ihIlGOpJTbN-KhM#uN(Line 6) Message: Mixed Content: The page at 'https://bb-stylo.ddnsking.com/mobi.php?HXNi#91i2mW5Vn02LX8VSINXsFvTBD9yZB8UIoUdVO4BhDCrD4R9C50AJI8CQ3tHakNM/ihIlGOpJTbN-KhM#uN' was loaded over HTTPS, but requested an insecure stylesheet 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi#91i2mW5Vn02LX8VSINXsFvTBD9yZB8UIoUdVO4BhDCrD4R9C50AJI8CQ3tHakNM/ihIlGOpJTbN-KhM#uN Message: Mixed Content: The page at 'https://bb-stylo.ddnsking.com/mobi.php?HXNi#91i2mW5Vn02LX8VSINXsFvTBD9yZB8UIoUdVO4BhDCrD4R9C50AJI8CQ3tHakNM/ihIlGOpJTbN-KhM#uN' was loaded over HTTPS, but requested an insecure script 'http://code.jquery.com/jquery-1.11.1.min.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://bb-stylo.ddnsking.com/mobi.php?HXNi#91i2mW5Vn02LX8VSINXsFvTBD9yZB8UIoUdVO4BhDCrD4R9C50AJI8CQ3tHakNM/ihIlGOpJTbN-KhM#uN Message: Mixed Content: The page at 'https://bb-stylo.ddnsking.com/mobi.php?HXNi#91i2mW5Vn02LX8VSINXsFvTBD9yZB8UIoUdVO4BhDCrD4R9C50AJI8CQ3tHakNM/ihIlGOpJTbN-KhM#uN' was loaded over HTTPS, but requested an insecure script 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://bb-stylo.ddnsking.com/mobi_two.php(Line 6) Message: Mixed Content: The page at 'https://bb-stylo.ddnsking.com/mobi_two.php' was loaded over HTTPS, but requested an insecure stylesheet 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/css/bootstrap.min.css'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://bb-stylo.ddnsking.com/mobi_two.php Message: Mixed Content: The page at 'https://bb-stylo.ddnsking.com/mobi_two.php' was loaded over HTTPS, but requested an insecure script 'http://code.jquery.com/jquery-1.11.1.min.js'. This request has been blocked; the content must be served over HTTPS.
security	error	URL: https://bb-stylo.ddnsking.com/mobi_two.php Message: Mixed Content: The page at 'https://bb-stylo.ddnsking.com/mobi_two.php' was loaded over HTTPS, but requested an insecure script 'http://maxcdn.bootstrapcdn.com/bootstrap/3.3.0/js/bootstrap.min.js'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bb-stylo.ddnsking.com
code.jquery.com
fonts.googleapis.com
maxcdn.bootstrapcdn.com
selimdoyranli.com
bb-stylo.ddnsking.com
code.jquery.com
fonts.googleapis.com
maxcdn.bootstrapcdn.com
selimdoyranli.com
2606:4700:3035::ac43:c06d
2607:f8b0:4006:821::200a
50.17.8.120
0c8e8d7408611519ceda4e759ae9987834a17addc8f0028241ffed7fb0113612
2b27f83f127198d94a7222427706162e02b97948eb6fa9a02db5882902feb3fd
3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e
3d760f53efee6927f9349e94ca07a5b7d3da8f76baaab7b33d74617a807e187a
48f232df5be9bbaf1f8357b1501ee2514d6dcc90876c5d8adae65fcb843ff88f
5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd
655313031be8b2d3719078fad37f7ec38c2c5b9032d3fa928212e73812e99792
866bf79b51ebf3e4a90702b1d2aac6eedaa68d5a26da8ed447c5d6c5fa9207d5
af66820441c52dd6918e822d7246eca4dc82b968b6cfecfd67562fb273dcd7ab
bdb58c53dcca10d1a800a7584b59de544058f612cd3714e9d8d17d7311735b4f
cecf5c59ff7c288bf90cc6221756bd9612464308557b92ca54f27d1cd108f3cd
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c