www.steptwoedu.in Open in urlscan Pro
2606:4700:30::681b:893c Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://srv161647.hoster-test.ru/jjjj/license.html
Effective URL:
https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany
Submission Tags: phishing malicious Search All
Submission: On October 29 via api (October 29th 2019, 8:57:04 pm UTC) from US

Summary HTTP 8 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:30::681b:893c, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.steptwoedu.in.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on September 20th 2019. Valid for: 6 months.

This is the only time www.steptwoedu.in was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1	31.28.24.120 31.28.24.120		12616 (HOSTING-MSK) (HOSTING-MSK)
1	151.101.14.90 151.101.14.90		54113 (FASTLY) (FASTLY - Fastly)
6	2606:4700:30:... 2606:4700:30::681b:893c		13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
8	3

1 31.28.24.120 (Moscow, Russian Federation)

ASN12616 (HOSTING-MSK, RU)
PTR: c10w.hoster.ru

srv161647.hoster-test.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.90 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

cdn.dribbble.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:30::681b:893c (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.steptwoedu.in	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	steptwoedu.in www.steptwoedu.in	41 KB
1	dribbble.com cdn.dribbble.com	857 KB
1	hoster-test.ru srv161647.hoster-test.ru	674 B
8	3

	Domain	Requested by
6	www.steptwoedu.in	www.steptwoedu.in
1	cdn.dribbble.com	srv161647.hoster-test.ru
1	srv161647.hoster-test.ru
8	3

This site contains no links.

Subject Issuer	Validity	Valid
*.dribbble.com DigiCert SHA2 Secure Server CA	`2018-07-24` - `2020-03-13`	2 years	crt.sh
sni230436.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-09-20` - `2020-03-28`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany
Frame ID: 4076558C912D013D881033272D6C73D1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://srv161647.hoster-test.ru/jjjj/license.html Page URL
https://www.steptwoedu.in/verification/service/Login/ Page URL
https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Page URL

Detected technologies

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

mod_fastcgi (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_fastcgi(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
headers server /mod_fastcgi(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

88 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

899 kB
Transfer

982 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://srv161647.hoster-test.ru/jjjj/license.html Page URL
https://www.steptwoedu.in/verification/service/Login/ Page URL
https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	license.html Show response srv161647.hoster-test.ru/jjjj/	290 B 674 B	225ms 43ms	Document text/html	31.28.24.120 HOSTING-MSK
General Check archive.org Show headers Download Go to Full URL http://srv161647.hoster-test.ru/jjjj/license.html Protocol HTTP/1.1 Server 31.28.24.120 Moscow, Russian Federation, ASN12616 (HOSTING-MSK, RU), Reverse DNS c10w.hoster.ru Software Apache/2.4.6 (CentOS) mod_fastcgi/mod_fastcgi-SNAP-0910052141 / Resource Hash `656d9f3145c64e3b1ce3431bd1c8acb0c48df42295f275d872851170520e0584` Request headers Host srv161647.hoster-test.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers Date Tue, 29 Oct 2019 20:56:48 GMT Server Apache/2.4.6 (CentOS) mod_fastcgi/mod_fastcgi-SNAP-0910052141 Last-Modified Tue, 29 Oct 2019 20:19:35 GMT ETag "122-5961255bd30d8" Accept-Ranges bytes Content-Length 290 Content-Type text/html; charset=UTF-8 X-Cache MISS from t0.hoster.ru X-Cache-Lookup HIT from t0.hoster.ru:6666 Connection keep-alive
GET H2	200	paypal.gif cdn.dribbble.com/users/766394/screenshots/2980343/	856 KB 857 KB	68ms 17ms	Image image/gif	151.101.14.90 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.dribbble.com/users/766394/screenshots/2980343/paypal.gif Requested by Host: srv161647.hoster-test.ru URL: http://srv161647.hoster-test.ru/jjjj/license.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.90 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software AmazonS3 / Resource Hash Request headers Sec-Fetch-Mode no-cors Referer http://srv161647.hoster-test.ru/jjjj/license.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers x-amz-version-id puzUH_wtbi_2jH.kwNlgQhtnW3ZD9rr7 via 1.1 5d8c59c4e33ff30f6610982ac8ad0232.cloudfront.net (CloudFront), 1.1 varnish etag "202ceeb9441b3be5965549bc1ec318da" age 478960 x-cache Miss from cloudfront, HIT status 200 content-length 876912 x-served-by cache-fra19148-FRA last-modified Fri, 23 Sep 2016 01:51:23 GMT server AmazonS3 x-timer S1572382608.192903,VS0,VE11 date Tue, 29 Oct 2019 20:56:48 GMT vary Cookie content-type image/gif expires Wed, 23 Sep 2026 00:00:16 GMT cache-control max-age=315576000 x-amz-cf-pop FRA50-C1 accept-ranges bytes x-amz-cf-id nK4Sclwx3wFzptqfIpupervqKYxqdHIT72irNRdT4NiDhCMV6s-WgQ== x-cache-hits 1
GET H2	200	/ Show response www.steptwoedu.in/verification/service/Login/	242 B 599 B	1867ms 1781ms	Document text/html	2606:4700:30::681b:893c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.steptwoedu.in/verification/service/Login/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:893c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PHP/5.3.29 Resource Hash `f410c9bc54de6701ca2d0ef2ffb51a378ca067adc8ec8fc043d43f94bf0653a5` Request headers :method GET :authority www.steptwoedu.in :scheme https :path /verification/service/Login/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 sec-fetch-mode navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer http://srv161647.hoster-test.ru/jjjj/license.html accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Sec-Fetch-Mode navigate Referer http://srv161647.hoster-test.ru/jjjj/license.html Response headers status 200 date Tue, 29 Oct 2019 20:56:50 GMT content-type text/html; charset-UTF-8 set-cookie __cfduid=d78cab149dd9c60755a03ff38195c5d6b1572382608; expires=Wed, 28-Oct-20 20:56:48 GMT; path=/; domain=.steptwoedu.in; HttpOnly PHPSESSID=2cfsjo8earq0cit84e1uei2pv0; path=/ x-powered-by PHP/5.3.29 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 public pragma no-cache vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 52d80ee63e435982-VIE content-encoding br
GET H2	200	Primary Request signin.php Show response www.steptwoedu.in/verification/service/Login/	3 KB 1 KB	1012ms 1012ms	Document text/html	2606:4700:30::681b:893c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Requested by Host: www.steptwoedu.in URL: https://www.steptwoedu.in/verification/service/Login/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:893c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PHP/5.3.29 Resource Hash `da059a0a8b6a75706d91f45a5489b45bed88ef381a5063068abc378aebacf526` Request headers :method GET :authority www.steptwoedu.in :scheme https :path /verification/service/Login/signin.php?code=DE&id=52691000&country=Germany pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 sec-fetch-mode navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site same-origin referer https://www.steptwoedu.in/verification/service/Login/ accept-encoding gzip, deflate, br cookie __cfduid=d78cab149dd9c60755a03ff38195c5d6b1572382608; PHPSESSID=2cfsjo8earq0cit84e1uei2pv0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Sec-Fetch-Mode navigate Referer https://www.steptwoedu.in/verification/service/Login/ Response headers status 200 date Tue, 29 Oct 2019 20:56:51 GMT content-type text/html; charset-UTF-8 x-powered-by PHP/5.3.29 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 public pragma no-cache vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 52d80ef1ce105982-VIE content-encoding br
GET H2	200	bootstrap.css www.steptwoedu.in/verification/service/Login/lib/css/	23 KB 5 KB	348ms 346ms	Stylesheet text/css	2606:4700:30::681b:893c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.steptwoedu.in/verification/service/Login/lib/css/bootstrap.css Requested by Host: www.steptwoedu.in URL: https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:893c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `ce840503a2c5167ccd9652602de6edd62158d068fd39aaa7e2bad5704c38ddd3` Request headers Sec-Fetch-Mode no-cors Referer https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers date Tue, 29 Oct 2019 20:56:51 GMT content-encoding br cf-cache-status MISS last-modified Mon, 07 Oct 2019 18:09:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type text/css status 200 cache-control public, max-age=86400 cf-ray 52d80ef82a635982-VIE expires Wed, 30 Oct 2019 20:56:51 GMT
GET H2	200	jquery.1.11.1.min.js Show response www.steptwoedu.in/verification/service/Login/lib/js/	94 KB 32 KB	489ms 488ms	Script application/javascript	2606:4700:30::681b:893c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.steptwoedu.in/verification/service/Login/lib/js/jquery.1.11.1.min.js Requested by Host: www.steptwoedu.in URL: https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:893c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441` Request headers Sec-Fetch-Mode no-cors Referer https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers date Tue, 29 Oct 2019 20:56:51 GMT content-encoding br cf-cache-status MISS last-modified Mon, 07 Oct 2019 18:09:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type application/javascript status 200 cache-control public, max-age=86400 cf-ray 52d80ef82a645982-VIE expires Wed, 30 Oct 2019 20:56:51 GMT
GET H2	200	login.js Show response www.steptwoedu.in/verification/service/Login/lib/js/	817 B 483 B	340ms 339ms	Script application/javascript	2606:4700:30::681b:893c Cloudflare
General Check archive.org Show headers Download Go to Full URL https://www.steptwoedu.in/verification/service/Login/lib/js/login.js Requested by Host: www.steptwoedu.in URL: https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:893c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `91555248b245023c08f525948e72f388c4d17f29cc34a34d2fca28e36835c9a9` Request headers Sec-Fetch-Mode no-cors Referer https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers date Tue, 29 Oct 2019 20:56:51 GMT content-encoding br cf-cache-status MISS last-modified Mon, 07 Oct 2019 18:09:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type application/javascript status 200 cache-control public, max-age=86400 cf-ray 52d80ef82a655982-VIE expires Wed, 30 Oct 2019 20:56:51 GMT
GET H2	200	logo.svg www.steptwoedu.in/verification/service/Login/lib/css/img/	5 KB 2 KB	321ms 321ms	Image image/svg+xml	2606:4700:30::681b:893c Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://www.steptwoedu.in/verification/service/Login/lib/css/img/logo.svg Requested by Host: www.steptwoedu.in URL: https://www.steptwoedu.in/verification/service/Login/signin.php?code=DE&id=52691000&country=Germany Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:30::681b:893c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Sec-Fetch-Mode no-cors Referer https://www.steptwoedu.in/verification/service/Login/lib/css/bootstrap.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.70 Safari/537.36 Response headers date Tue, 29 Oct 2019 20:56:51 GMT content-encoding br cf-cache-status MISS last-modified Mon, 07 Oct 2019 18:09:14 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type image/svg+xml status 200 cache-control public, max-age=86400 cf-ray 52d80efa5ba35982-VIE expires Wed, 30 Oct 2019 20:56:51 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.steptwoedu.in/	1970-01-19 13:31:58	Name: __cfduid Value: d809110993f38ddf80c978397b60b63ec1572382611

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.dribbble.com
srv161647.hoster-test.ru
www.steptwoedu.in
151.101.14.90
2606:4700:30::681b:893c
31.28.24.120
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
656d9f3145c64e3b1ce3431bd1c8acb0c48df42295f275d872851170520e0584
91555248b245023c08f525948e72f388c4d17f29cc34a34d2fca28e36835c9a9
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
ce840503a2c5167ccd9652602de6edd62158d068fd39aaa7e2bad5704c38ddd3
da059a0a8b6a75706d91f45a5489b45bed88ef381a5063068abc378aebacf526
f410c9bc54de6701ca2d0ef2ffb51a378ca067adc8ec8fc043d43f94bf0653a5