![](/screenshots/c20ff9dd-54f2-4820-b18a-a242dfa829cd.png)
saadmaslouh.com
Open in
urlscan Pro
208.91.198.242
Malicious Activity!
Public Scan
Effective URL: http://saadmaslouh.com/e/app/access.php
Submission: On October 25 via manual from DE — Scanned from DE
Summary
This is the only time saadmaslouh.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 14 | 208.91.198.242 208.91.198.242 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
17 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: plesk-web12.webhostbox.net
saadmaslouh.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
saadmaslouh.com
2 redirects
saadmaslouh.com |
2 MB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 373 |
108 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 925 |
30 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 250 |
6 KB |
17 | 4 |
Domain | Requested by | |
---|---|---|
14 | saadmaslouh.com |
2 redirects
saadmaslouh.com
|
3 | cdn.jsdelivr.net |
saadmaslouh.com
|
1 | code.jquery.com |
saadmaslouh.com
|
1 | cdnjs.cloudflare.com |
saadmaslouh.com
|
17 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://saadmaslouh.com/e/app/access.php
Frame ID: 339B6925315097D2933743CFD2B014F2
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/c20ff9dd-54f2-4820-b18a-a242dfa829cd.png)
Page Title
ING LoginPage URL History Show full URLs
-
http://saadmaslouh.com/e/?r=1&u=N5KDvz%2FBv_vlm%2FlKKZNl%2FI_xl
HTTP 302
http://saadmaslouh.com/e/app/index.php HTTP 302
http://saadmaslouh.com/e/app/access.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://saadmaslouh.com/e/?r=1&u=N5KDvz%2FBv_vlm%2FlKKZNl%2FI_xl
HTTP 302
http://saadmaslouh.com/e/app/index.php HTTP 302
http://saadmaslouh.com/e/app/access.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
access.php
saadmaslouh.com/e/app/ Redirect Chain
|
35 KB 35 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BusyIndicator-ver-D96AC53727CDA7F131E86944079EBDA2.css
saadmaslouh.com/e/app/assets/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bundle.ibbr-ver-A1BC03D6FA9731EE7E461042EC133352.css
saadmaslouh.com/e/app/assets/ |
1 MB 1 MB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qrl-ver-A4288F3F0CE7F5C60C76A005C363B0A2.svg
saadmaslouh.com/e/app/assets/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
qrlhint-ver-916FDE8A4CA8095FC339D6829D7D6723.png
saadmaslouh.com/e/app/assets/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.24.0/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cdn.jsdelivr.net/npm/vue/dist/ |
424 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue-loading.min.js
cdn.jsdelivr.net/npm/vue-loading-overlay@3.4.2/dist/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue-loading.css
cdn.jsdelivr.net/npm/vue-loading-overlay@3/dist/ |
539 B 969 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
x.js
saadmaslouh.com/e/app/ |
335 KB 336 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
INGMeWeb-Regular.html
saadmaslouh.com/e/app/assets// |
29 KB 29 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ING_Deutschland_NoClaim.svg
saadmaslouh.com/e/app/assets/ |
16 KB 16 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
INGMeWeb-Bold.html
saadmaslouh.com/e/app/assets// |
30 KB 30 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons.woff
saadmaslouh.com/e/app/assets// |
32 KB 32 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
x.php
saadmaslouh.com/e/x/y/ |
1 B 268 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
x.php
saadmaslouh.com/e/x/y/ |
1 B 268 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| axios function| Vue object| VueLoading function| $ function| jQuery object| app object| casVue1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
saadmaslouh.com/ | Name: PHPSESSID Value: tbvre0qkfumcau3ho4rfbh329p |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
saadmaslouh.com
208.91.198.242
2606:4700::6810:5814
2606:4700::6811:180e
2a04:4e42:200::649
0933103d2fc6be40a320b018df24c105ad1b9dd2375f2a3a730ceda33802118c
131d1ca390a6c78cfc5107889980dbd155184886cc0dd81400478d1330b805fe
305948d72ce8577a386f77079dacdb6841f18668f64cc7865a196a0624e5b5a8
3fc18c3d98c4245afbb3d987be0fc53041681dfcd5903381fe34179048c2a520
553fc093f4b619f0f355bf89e4d885c25eb88df06997e5a58eb3d11947e0b385
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
7839e05340b0af281eca6dd53d7a7ac0cd3205b9d2f12b180ee45b89567ebef4
963713702294c12c60ee25875eac53286b39cd67cadbdd27fe7048444cab82bb
9a214e9df938fbc09d96e47ae4dbe031d7a581647a87c38ec371bc2a2d4dc7cf
9d0ce0dd87e2d9bc4171914be7b288f8388ce7c26dc58e0a465a82760e899914
ab03c9e735ac9f1ccdeb350a42df96c5e53df2b535bd427491a4d820565c4076
aed6ac78b8249a9c7cff0030f3b921ee9f771cb1684164f3e679e1023a4d5c69
ba77709584dcf757de9d2d8c3a9fc34bbaa9ad10570d32b54852ec4e6c7b0782
faaea7851c7a24f953eb27e05839d125c4123e17b668e324552191a2be9aa224
fb6ebe23316c03fd8d25e871bfdd9c41eb77e14115f5a01e3e0d97b94617779e
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e