icri.iria.org.in
Open in
urlscan Pro
103.149.165.99
Malicious Activity!
Public Scan
Effective URL: https://icri.iria.org.in/wp-content/uploads/login/
Submission: On April 29 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 21st 2023. Valid for: 3 months.
This is the only time icri.iria.org.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BDO Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.72.49.79 52.72.49.79 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 2606:4700:20:... 2606:4700:20::ac43:4b7a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2606:4700:20:... 2606:4700:20::681a:dc9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 103.149.165.99 103.149.165.99 | 140155 (HOSTNET-A...) (HOSTNET-AS-IN The Pinnacle Group Inc) | |
1 | 2a00:1288:84:... 2a00:1288:84:803::4000 | 203219 (YAHOO-AMA) (YAHOO-AMA) | |
13 | 2 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-49-79.compute-1.amazonaws.com
www.bdosecurityadvisory.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
iria.org.in
icri.iria.org.in |
101 KB |
2 |
t.ly
2 redirects
t.ly — Cisco Umbrella Rank: 187736 |
2 KB |
1 |
yusercontent.com
ecp.yusercontent.com — Cisco Umbrella Rank: 6682 |
6 KB |
1 |
bdosecurityadvisory.com
1 redirects
www.bdosecurityadvisory.com |
231 B |
13 | 4 |
Domain | Requested by | |
---|---|---|
12 | icri.iria.org.in |
icri.iria.org.in
|
2 | t.ly | 2 redirects |
1 | ecp.yusercontent.com |
icri.iria.org.in
|
1 | www.bdosecurityadvisory.com | 1 redirects |
13 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
icri.iria.org.in R3 |
2023-03-21 - 2023-06-19 |
3 months | crt.sh |
*.ec.yimg.com DigiCert SHA2 High Assurance Server CA |
2023-03-01 - 2023-05-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://icri.iria.org.in/wp-content/uploads/login/
Frame ID: DE444384A289C81B4A79E6B1A125AAF7
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.bdosecurityadvisory.com/verify/
HTTP 301
http://t.ly/il26 HTTP 301
https://t.ly/il26 HTTP 301
https://icri.iria.org.in/lead.html Page URL
- https://icri.iria.org.in/wp-content/uploads/login/ Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.bdosecurityadvisory.com/verify/
HTTP 301
http://t.ly/il26 HTTP 301
https://t.ly/il26 HTTP 301
https://icri.iria.org.in/lead.html Page URL
- https://icri.iria.org.in/wp-content/uploads/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.bdosecurityadvisory.com/verify/ HTTP 301
- http://t.ly/il26 HTTP 301
- https://t.ly/il26 HTTP 301
- https://icri.iria.org.in/lead.html
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
lead.html
icri.iria.org.in/ Redirect Chain
|
1 KB 671 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mail
ecp.yusercontent.com/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
icri.iria.org.in/wp-content/uploads/login/ |
19 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginid.css
icri.iria.org.in/wp-content/uploads/login/styles/css/ |
51 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
component.style.css
icri.iria.org.in/wp-content/uploads/login/styles/css/ |
16 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base.css
icri.iria.org.in/wp-content/uploads/login/styles/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
variables_root.js
icri.iria.org.in/wp-content/uploads/login/js_scripts/ |
220 B 273 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
icri.iria.org.in/wp-content/uploads/login/js_scripts/ |
551 B 364 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
profile-white.png
icri.iria.org.in/wp-content/uploads/login/styles/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bdo-logo.jpg
icri.iria.org.in/wp-content/uploads/login/styles/ |
35 KB 36 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-white.png
icri.iria.org.in/wp-content/uploads/login/styles/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad.png
icri.iria.org.in/wp-content/uploads/login/styles/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_right.png
icri.iria.org.in/wp-content/uploads/login/styles/ |
141 B 310 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BDO Bank (Banking)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
t.ly/ | Name: XSRF-TOKEN Value: eyJpdiI6IlhDZ2tOcEFSVUpnY2t1eFVGdVMveUE9PSIsInZhbHVlIjoiMUkzbmhxbTkwTjBYL2V4cG04T1Z4RE9WYWptODE2TXBDZktqRzkzTzRsZzFkY3MvVlBQNXkzUVVhV3FFaWdmbmRYU05CZGdTR2swc0RxdmplSVJNdkduRUY0VTBkd2x1Z2Fzank3WHVYVm9ZamZjNnFIOXNSNlB1QnNvKzZRQ0wiLCJtYWMiOiI4OTQ5NmZmZjMyZjNmNGY4ZTVkMzNlNTIyNTdiYmVmMzQxZjg5ZjNiNGI2MDAyZGM1YmQzZmI2OTNiZGE3NDJkIiwidGFnIjoiIn0%3D |
|
t.ly/ | Name: tly_session Value: eyJpdiI6IjYzZHpacWFzVlNra1VPbFh3SGc3eUE9PSIsInZhbHVlIjoieThwS1MvcUwwSGo1YW53RUdBSTVGcFlOZEIrMTh0d3RYK3pKWjFGQjdRcXRDekkrK0tiY2RKME5pc09QYjh3ams4eHNXM3VjdFRka2VLV3l3TXpUdnB6L0F5QTZZckl2YktvRlVlY2pFY05FNEU2M21YaE4zd1JJeFZhaFNENzQiLCJtYWMiOiJmOWQ5NDdjNGE2NTAyNjM0ZjJlZjM0MGQ4ODczOTAzMDA5Nzc5YWIxNmY4YjBiZWVmNDRhMTVlNDgyOGE3ODVhIiwidGFnIjoiIn0%3D |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ecp.yusercontent.com
icri.iria.org.in
t.ly
www.bdosecurityadvisory.com
103.149.165.99
2606:4700:20::681a:dc9
2606:4700:20::ac43:4b7a
2a00:1288:84:803::4000
52.72.49.79
1d375086b20f5cf17e00aaf17c9e8baa340a4a7fc6c3031c0438fcbc93cd3454
3e72af5babd1f7f1077a4091d1ced174710e72a7bd5047a8826bd5dac5412cce
405caefefce16bf6f766e7303eafb32b02da9a8be6d2e1c965e51ddbae41b852
5225eebca373ae103c2e83513cb277b4eecd319df532a4bb41868a20341e71fe
649ce520b09e82f86af594afb5c8d0c2f70773fab60d8261d6dbec6cf4230d17
77c0bd6969615670ebfa974cf73555ba238c28cfc88709213aa4f38aac51ca40
87534d6fca3569b9f8188cd4568df780732664b62f428e0819922dc9cb5ec1c1
89c148d43aaf043cc8caadbf3156de61bd1e91a3f0890bbc4baa15e5b5398e7b
a55ca6a778491f49d9376f2151920fadef7f5465805e11738c6ddc3f3886d850
ae7e6478a048387cc9faa5d97f7fe80b92eda486f40f54a75c168b1928246d1d
b18e02c3c784c27cb0db8ce9131cd9ccd24306971baf2057b61539562717bd38
cb1fbc8aa63167714073d9da502863cb2356c7d7a2ec250e4959e898f536ff19
e36e7573aa4f407a93704b899df4baa00c632328e56eaa951e8339b0b09d39a8