al-baifg3.xyz Open in urlscan Pro
185.212.128.226 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://al-baifg3.xyz/danj/login.php
Submission: On June 21 via manual (June 21st 2021, 5:06:22 pm UTC) from US

Summary HTTP 10 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 185.212.128.226, located in Seychelles and belongs to INTERNET-IT, SC. The main domain is al-baifg3.xyz.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 18th 2021. Valid for: 3 months.

This is the only time al-baifg3.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
10	185.212.128.226 185.212.128.226		200313 (INTERNET-IT) (INTERNET-IT)
10	1

10 185.212.128.226 (Seychelles)

ASN200313 (INTERNET-IT, SC)
PTR: amazonservice167.ptr1.ru

al-baifg3.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	al-baifg3.xyz al-baifg3.xyz	326 KB
10	1

	Domain	Requested by
10	al-baifg3.xyz	al-baifg3.xyz
10	1

This site contains links to these domains. Also see Links.

Domain
www.uimn.org
www1.uimn.org

Subject Issuer	Validity	Valid
al-baifg3.xyz cPanel, Inc. Certification Authority	`2021-06-18` - `2021-09-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://al-baifg3.xyz/danj/login.php
Frame ID: C458690C2FAC1D0E7FBD27FDF3E6F5C1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Ruxit (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /ruxitagentjs/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

326 kB
Transfer

324 kB
Size

6
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://www.uimn.org/applicants
Title: Information For Applicants

Search URL Search Domain Scan URL

URL: http://www.uimn.org/assets/HowToApplyForUI_tcm1068-193561.pdf
Title: How to Apply

Search URL Search Domain Scan URL

URL: http://www.uimn.org/applicants/help-support/info-handbook/info-handbook-intro.jsp
Title: Information Handbook

Search URL Search Domain Scan URL

URL: http://www.uimn.org/applicants/videos/
Title: Video Library

Search URL Search Domain Scan URL

URL: http://www.uimn.org/applicants/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www1.uimn.org/ui_applicant/staticcontent/Accessibility_Statement.htm
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www1.uimn.org/ui_applicant/staticcontent/PrivacyStatement.htm
Title: Privacy and security

Search URL Search Domain Scan URL

URL: https://www1.uimn.org/ui_applicant/staticcontent/prelim_Web_Page_Settings_Generic.html
Title: System requirements

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response al-baifg3.xyz/danj/	20 KB 20 KB	195ms 60ms	Document text/html	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `ff6aaacc888d53ab6bf0f6864ae94ba281f305b95df3e629e0a097612e9aea4c` Request headers Host al-baifg3.xyz Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Show response al-baifg3.xyz/danj/index_files/	206 KB 207 KB	138ms 56ms	Script application/javascript	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://al-baifg3.xyz/danj/index_files/ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `8a25a83ddf46a9940a7210f66d030d2750ef263f89a5da813ecfe6961c69b4e3` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://al-baifg3.xyz/danj/login.php Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:48 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 211386
GET H/1.1	200 OK	ui.css al-baifg3.xyz/danj/index_files/	13 KB 13 KB	79ms 56ms	Stylesheet text/css	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://al-baifg3.xyz/danj/index_files/ui.css Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://al-baifg3.xyz/danj/login.php Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 12925
GET H/1.1	200 OK	util.js.download Show response al-baifg3.xyz/danj/index_files/	6 KB 6 KB	158ms 53ms	Script application/javascript	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://al-baifg3.xyz/danj/index_files/util.js.download Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `93e8e837bd1f524a4379996066a315761ed610be5cedbca5cf4ef80696324a84` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://al-baifg3.xyz/danj/login.php Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:48 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5697
GET H/1.1	200 OK	spacer.gif al-baifg3.xyz/danj/index_files/	43 B 283 B	59ms 58ms	Image image/gif	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Show image Full URL https://al-baifg3.xyz/danj/index_files/spacer.gif Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://al-baifg3.xyz/danj/login.php Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:48 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43
GET H/1.1	200 OK	Unemployment%20Insurance%20Logo%20RGB-websites-projects.png al-baifg3.xyz/danj/index_files/	77 KB 77 KB	58ms 58ms	Image image/png	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Show image Full URL https://al-baifg3.xyz/danj/index_files/Unemployment%20Insurance%20Logo%20RGB-websites-projects.png Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://al-baifg3.xyz/danj/login.php Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:48 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 78822
GET H/1.1	200 OK	b_start.gif al-baifg3.xyz/danj/index_files/	856 B 1 KB	53ms 52ms	Image image/gif	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Show image Full URL https://al-baifg3.xyz/danj/index_files/b_start.gif Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `f3ca101abe3776929aa7723f2bcb2174c1e3a21d38fd8e3528906ae16161eb43` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://al-baifg3.xyz/danj/login.php Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:48 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 856
GET H/1.1	200 OK	b_login.gif al-baifg3.xyz/danj/index_files/	679 B 921 B	55ms 54ms	Image image/gif	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Show image Full URL https://al-baifg3.xyz/danj/index_files/b_login.gif Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/login.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `d14cc5be04b3ab95d8a382547e988d3536875528a0b195b1dcacc26989d24e46` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host al-baifg3.xyz Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://al-baifg3.xyz/danj/login.php Cookie dtCookie=v_4_srv_-2D68_sn_VI7MRCVRNT8JI1ETRQQ08BL2B5S22NG9; rxVisitor=1624295166838CEARFOTLV8774HEHHNH3491MRCABM150; dtSa=-; dtLatC=68; rxvt=1624296966848\|1624295166839; dtPC=-68$95166833_71h1vNRBMEFMRQUUJSMBAFGVFWCHSDMARPWCP-0e1 Connection keep-alive Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 21 Jun 2021 17:05:49 GMT Last-Modified Sat, 19 Jun 2021 19:33:50 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 679
POST H/1.1	404 Not Found	rb_bf91035bph Show response al-baifg3.xyz/ui_javascripts/	315 B 515 B	56ms 55ms	XHR text/html	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://al-baifg3.xyz/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D68_sn_VI7MRCVRNT8JI1ETRQQ08BL2B5S22NG9&svrid=-68&flavor=post&vi=NRBMEFMRQUUJSMBAFGVFWCHSDMARPWCP-0&modifiedSince=1623365518865&rf=https%3A%2F%2Fal-baifg3.xyz%2Fdanj%2Flogin.php&bp=3&app=06fe4f82790bea7d&crc=2248375905&en=sstvhqbf&end=1 Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/index_files/ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Sec-Fetch-Mode cors Origin https://al-baifg3.xyz Accept-Encoding gzip, deflate, br Accept-Language en-US Sec-Fetch-Dest empty Cookie dtCookie=v_4_srv_-2D68_sn_VI7MRCVRNT8JI1ETRQQ08BL2B5S22NG9; rxVisitor=1624295166838CEARFOTLV8774HEHHNH3491MRCABM150; dtSa=-; dtLatC=68; rxvt=1624296966939\|1624295166839; dtPC=-68$95166833_71h-vNRBMEFMRQUUJSMBAFGVFWCHSDMARPWCP-0e1 Connection keep-alive Content-Length 1488 Pragma no-cache Host al-baifg3.xyz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept / Cache-Control no-cache Referer https://al-baifg3.xyz/danj/login.php Sec-Fetch-Site same-origin Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Mon, 21 Jun 2021 17:05:50 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
POST H/1.1	404 Not Found	rb_bf91035bph Show response al-baifg3.xyz/ui_javascripts/	315 B 515 B	53ms 53ms	XHR text/html	185.212.128.226 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://al-baifg3.xyz/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D68_sn_VI7MRCVRNT8JI1ETRQQ08BL2B5S22NG9&svrid=-68&flavor=post&vi=NRBMEFMRQUUJSMBAFGVFWCHSDMARPWCP-0&modifiedSince=1623365518865&rf=https%3A%2F%2Fal-baifg3.xyz%2Fdanj%2Flogin.php&bp=3&app=06fe4f82790bea7d&crc=3660375550&en=sstvhqbf&end=1 Requested by Host: al-baifg3.xyz URL: https://al-baifg3.xyz/danj/index_files/ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.212.128.226 , Seychelles, ASN200313 (INTERNET-IT, SC), Reverse DNS amazonservice167.ptr1.ru Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Sec-Fetch-Mode cors Origin https://al-baifg3.xyz Accept-Encoding gzip, deflate, br Accept-Language en-US Sec-Fetch-Dest empty Cookie dtCookie=v_4_srv_-2D68_sn_VI7MRCVRNT8JI1ETRQQ08BL2B5S22NG9; rxVisitor=1624295166838CEARFOTLV8774HEHHNH3491MRCABM150; dtSa=-; dtLatC=68; rxvt=1624296966939\|1624295166839; dtPC=-68$95166833_71h-vNRBMEFMRQUUJSMBAFGVFWCHSDMARPWCP-0e1 Connection keep-alive Content-Length 1328 Pragma no-cache Host al-baifg3.xyz User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept / Cache-Control no-cache Referer https://al-baifg3.xyz/danj/login.php Sec-Fetch-Site same-origin Referer https://al-baifg3.xyz/danj/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Mon, 21 Jun 2021 17:05:52 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 315 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Government (Government)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.al-baifg3.xyz/	1969-12-31 23:59:59	Name: dtPC Value: -68$95166833_71h2vNRBMEFMRQUUJSMBAFGVFWCHSDMARPWCP-0e1
.al-baifg3.xyz/	1969-12-31 23:59:59	Name: dtLatC Value: 68
.al-baifg3.xyz/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D68_sn_VI7MRCVRNT8JI1ETRQQ08BL2B5S22NG9
.al-baifg3.xyz/	1969-12-31 23:59:59	Name: dtSa Value: -
.al-baifg3.xyz/	1969-12-31 23:59:59	Name: rxvt Value: 1624296966939\|1624295166839
.al-baifg3.xyz/	1969-12-31 23:59:59	Name: rxVisitor Value: 1624295166838CEARFOTLV8774HEHHNH3491MRCABM150

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

al-baifg3.xyz
185.212.128.226
402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268
819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a25a83ddf46a9940a7210f66d030d2750ef263f89a5da813ecfe6961c69b4e3
93e8e837bd1f524a4379996066a315761ed610be5cedbca5cf4ef80696324a84
d14cc5be04b3ab95d8a382547e988d3536875528a0b195b1dcacc26989d24e46
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
f3ca101abe3776929aa7723f2bcb2174c1e3a21d38fd8e3528906ae16161eb43
ff6aaacc888d53ab6bf0f6864ae94ba281f305b95df3e629e0a097612e9aea4c

al-baifg3.xyz Open in urlscan Pro 185.212.128.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

326 kBTransfer

324 kBSize

6 Cookies

8 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

6 Cookies

Indicators

al-baifg3.xyz Open in urlscan Pro
185.212.128.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

326 kB
Transfer

324 kB
Size

6
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!