www.login-alerts.info

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 111.90.149.37, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is www.login-alerts.info.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 23rd 2020. Valid for: 3 months.

This is the only time www.login-alerts.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	111.90.149.37 111.90.149.37	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.104.229.127 172.104.229.127	63949 (LINODE-AP...) (LINODE-AP Linode)
6	3

4 111.90.149.37 (Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: attsecur.nl

www.login-alerts.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.104.229.127 (Philadelphia, United States)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1805-127.members.linode.com

pagecdn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	login-alerts.info www.login-alerts.info	1002 KB
1	pagecdn.io pagecdn.io	1 KB
1	cloudflare.com cdnjs.cloudflare.com	78 KB
6	3

	Domain	Requested by
4	www.login-alerts.info	www.login-alerts.info
1	pagecdn.io	www.login-alerts.info
1	cdnjs.cloudflare.com	www.login-alerts.info
6	3

This site contains no links.

Subject Issuer	Validity	Valid
login-alerts.info Let's Encrypt Authority X3	`2020-03-23` - `2020-06-21`	3 months	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
pagecdn.io Sectigo RSA Domain Validation Secure Server CA	`2019-05-11` - `2021-05-10`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www.login-alerts.info/
Frame ID: D058786275E220499A55A8D4F52BA561
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1082 kB
Transfer

1282 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.login-alerts.info/ 6 KB
2 KB 1452ms
658ms Document
text/html 111.90.149.37
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.login-alerts.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.149.37 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: attsecur.nl
Software: Apache/2.4.10 (Debian) /
Resource Hash: e318feb97efca7ec8d6a47d6edf738e1ec21f0556c35f4b0110bb77f320182a0

Request headers

Host: www.login-alerts.info
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Mon, 23 Mar 2020 02:16:37 GMT
Server: Apache/2.4.10 (Debian)
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1898
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 274 KB
78 KB 17ms
16ms Script
application/javascript 2606:4700::6811:4004
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.js

Requested by

Host: www.login-alerts.info
URL: https://www.login-alerts.info/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://www.login-alerts.info/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 23 Mar 2020 02:16:38 GMT
content-encoding: br
cf-cache-status: HIT
age: 12511142
cf-ray: 5784a6c77fb39724-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Wed, 01 May 2019 21:45:59 GMT
server: cloudflare
etag: W/"5cca1397-4472c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Sat, 13 Mar 2021 02:16:38 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

GET
H2 200 jquery.cookie.js Show response
pagecdn.io/lib/jquery-cookie/v1.4.1/ 3 KB
1 KB 178ms
40ms Script
application/javascript 172.104.229.127
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://pagecdn.io/lib/jquery-cookie/v1.4.1/jquery.cookie.js

Requested by

Host: www.login-alerts.info
URL: https://www.login-alerts.info/

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

172.104.229.127 Philadelphia, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

li1805-127.members.linode.com

Software

nginx /

Resource Hash

b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.login-alerts.info/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 23 Mar 2020 02:16:38 GMT
content-encoding: br
x-content-type-options: nosniff
x-cdn: PageCDN
access-control-allow-origin: *
x-cache: HIT
status: 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-length: 1119
x-response-time: 0.000s
last-modified: Thu, 08 Aug 2019 06:36:38 GMT
server: nginx
vary: Accept-Encoding
content-type: application/javascript
x-backend-time: 0.000159s
cache-control: public, max-age=573834744, immutable
timing-allow-origin: *
expires: Thu, 19 Nov 2037 03:14:08 GMT

GET
H/1.1 200
OK ex.png
www.login-alerts.info/index_files/ 8 KB
8 KB 197ms
197ms Image
image/png 111.90.149.37
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login-alerts.info/index_files/ex.png
Requested by: Host: www.login-alerts.info
URL: https://www.login-alerts.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.149.37 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: attsecur.nl
Software: Apache/2.4.10 (Debian) /
Resource Hash: 5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4

Request headers

Referer: https://www.login-alerts.info/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 23 Mar 2020 02:16:38 GMT
Last-Modified: Mon, 23 Mar 2020 01:27:49 GMT
Server: Apache/2.4.10 (Debian)
ETag: "1ff4-5a17b8b0d81c6"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 8180

GET
H/1.1 200
OK loading.gif
www.login-alerts.info/ 79 KB
79 KB 394ms
196ms Image
image/gif 111.90.149.37
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login-alerts.info/loading.gif
Requested by: Host: www.login-alerts.info
URL: https://www.login-alerts.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.149.37 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: attsecur.nl
Software: Apache/2.4.10 (Debian) /
Resource Hash: b6c73aac01291f298f8131f9122b06771288be885c0fb0231b256420bcedd88c

Request headers

Referer: https://www.login-alerts.info/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 23 Mar 2020 02:16:38 GMT
Last-Modified: Mon, 23 Mar 2020 01:27:51 GMT
Server: Apache/2.4.10 (Debian)
ETag: "13a30-5a17b8b265565"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 80432

GET
H/1.1 200
OK background.png
www.login-alerts.info/img/ 913 KB
913 KB 400ms
194ms Image
image/png 111.90.149.37
SHINJIRU-MY-AS-AP...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.login-alerts.info/img/background.png
Requested by: Host: www.login-alerts.info
URL: https://www.login-alerts.info/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 111.90.149.37 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS: attsecur.nl
Software: Apache/2.4.10 (Debian) /
Resource Hash: 8203de566302471c517351d8f7391e74a24cb93c1d0089917068e0e4eb551bb7

Request headers

Referer: https://www.login-alerts.info/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Mon, 23 Mar 2020 02:16:38 GMT
Last-Modified: Mon, 23 Mar 2020 01:27:46 GMT
Server: Apache/2.4.10 (Debian)
ETag: "e43f0-5a17b8ada9264"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 934896

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
pagecdn.io
www.login-alerts.info
111.90.149.37
172.104.229.127
2606:4700::6811:4004
5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55
5cfa556160a353d37185d8cbcf478f97b215f7d57d9821f20981bd0a4ad1fdd4
8203de566302471c517351d8f7391e74a24cb93c1d0089917068e0e4eb551bb7
b6c73aac01291f298f8131f9122b06771288be885c0fb0231b256420bcedd88c
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
e318feb97efca7ec8d6a47d6edf738e1ec21f0556c35f4b0110bb77f320182a0

www.login-alerts.info Open in urlscan Pro 111.90.149.37 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

1082 kBTransfer

1282 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

www.login-alerts.info Open in urlscan Pro
111.90.149.37 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1082 kB
Transfer

1282 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!