gilvantur.com
Open in
urlscan Pro
192.169.81.210
Public Scan
URL:
http://gilvantur.com/site/bot/login.php
Submission Tags: c2 malware oski Search All
Submission: On January 24 via api from US — Scanned from DE
Submission Tags: c2 malware oski Search All
Submission: On January 24 via api from US — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 192.169.81.210, located in
United States and
belongs to LIMESTONENETWORKS, US.
The main domain is gilvantur.com.
This is the only time gilvantur.com was scanned on urlscan.io!
This is the only time gilvantur.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 192.169.81.210 192.169.81.210 | 46475 (LIMESTONE...) (LIMESTONENETWORKS) | |
| 4 | 2a00:1450:400... 2a00:1450:400d:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 12 | 2 |
8
192.169.81.210
(United States)
ASN46475 (LIMESTONENETWORKS, US)
PTR: host.sdserver28.com
ASN46475 (LIMESTONENETWORKS, US)
PTR: host.sdserver28.com
| gilvantur.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
gilvantur.com
gilvantur.com |
1 MB |
| 4 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
3 KB |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | gilvantur.com |
gilvantur.com
|
| 4 | fonts.googleapis.com |
gilvantur.com
|
| 12 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1C3 |
2023-01-02 - 2023-03-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://gilvantur.com/site/bot/login.php
Frame ID: BA71FDDCE15C8F4EC1FA8227183391C0
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
LoginDetected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.php(?:$|\?)
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Ionicons
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]+ionicons(?:\.min)?\.css
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login.php
gilvantur.com/site/bot/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
all.min.css
gilvantur.com/site/bot/Template/lib/fortawesome/fontawesome-free/css/ |
68 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ionicons.min.css
gilvantur.com/site/bot/Template/lib/ionicons/css/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dashforge.css
gilvantur.com/site/bot/Template/assets/css/ |
1 MB 1 MB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dashforge.dashboard.css
gilvantur.com/site/bot/Template/assets/css/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
img15.png
gilvantur.com/site/bot/Template/img/ |
156 KB 156 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
10 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
2 KB 627 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
3 KB 504 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
3 KB 594 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
IBMPlexSans-Medium-Latin1.woff2
gilvantur.com/site/bot/Template/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
IBMPlexSans-Regular-Latin1.woff2
gilvantur.com/site/bot/Template/ |
16 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| gilvantur.com/ | Name: PHPSESSID Value: a41515b4b38b70f1e6ccaec67d284c46 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
gilvantur.com
192.169.81.210
2a00:1450:400d:808::200a
13ef2138a78980eb9bca620d5bd803782d00ca49f0670a71d5a83cd4855fc319
2c734ee8e4088246ab6eacbb8d1668abc28c3a0a3d2d8ff0b7b8fa360fd322a1
479b0205141db78ba1ef5ad5ec198fc60423d503648b6e28469e672823ae41f3
4c307b8a6c94c602aa6bcb54ff46ef860f2dcd005eb17861fc25cec79bb8e4a7
52d19d23087cab4754d99e1b93eef0c81607dbe0e235928d00d0ec3e89fac2e0
5ef043454b128260dda530a42312fbb985505034036cd3f3ea23cfe324a7905b
74fabab9aa073e8686526c0cd9c5b6667a754d31b072c2fa87fe987524a6e2be
76b95d11419676ddf34f10d441ab91048bcc14466c93bb9577c8987f1dc5bf28
783df311b44dc77a7d3569341d1dd4d0948edc3fdfa375d1d997dfe7aaef8663
dd2059dd98af175f39c3480a0e0db9b47370d3b11ab0eeb69100532abd389718
e0c8ebe383ce65c702e6a6032212b97205d58393e6e53db89cc3eb3670e8e684