testmyhack.ihrnigeria.org
23.94.30.178 Malicious Activity!

Go To Rescan
Add Verdict Report

URL:
http://testmyhack.ihrnigeria.org/
Submission: On January 26 via manual (January 26th 2023, 9:19:39 am UTC) from DK — Scanned from DK

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 8 HTTP transactions. The main IP is 23.94.30.178, located in United States and belongs to AS-COLOCROSSING, US. The main domain is testmyhack.ihrnigeria.org.

This is the only time testmyhack.ihrnigeria.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Uniswap (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
6	23.94.30.178 23.94.30.178	36352 (AS-COLOCR...) (AS-COLOCROSSING)
1	2606:4700::68... 2606:4700::6812:1636	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1a2e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	4

6 23.94.30.178 (United States)

ASN36352 (AS-COLOCROSSING, US)
PTR: wgh8.wghservers.com

testmyhack.ihrnigeria.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1636 (United States)

ASN13335 (CLOUDFLARENET, US)

app.uniswap.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1a2e (United States)

ASN13335 (CLOUDFLARENET, US)

registry.walletconnect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	ihrnigeria.org testmyhack.ihrnigeria.org	1 MB
1	walletconnect.com registry.walletconnect.com — Cisco Umbrella Rank: 983144	47 KB
1	uniswap.org app.uniswap.org — Cisco Umbrella Rank: 419693	223 KB
8	3

	Domain	Requested by
6	testmyhack.ihrnigeria.org	testmyhack.ihrnigeria.org
1	registry.walletconnect.com	testmyhack.ihrnigeria.org
1	app.uniswap.org	testmyhack.ihrnigeria.org
8	3

This site contains no links.

Subject Issuer	Validity	Valid
app.uniswap.org R3	`2022-11-19` - `2023-02-17`	3 months	crt.sh
*.walletconnect.com GTS CA 1P5	`2023-01-09` - `2023-04-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://testmyhack.ihrnigeria.org/
Frame ID: ADA656CC89CCAC2CBE72826DE69AEBAD
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

25 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

1498 kB
Transfer

5580 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
testmyhack.ihrnigeria.org/ 80 KB
22 KB 272ms
120ms Document
text/html 23.94.30.178
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://testmyhack.ihrnigeria.org/
Protocol: HTTP/1.1
Server: 23.94.30.178 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: wgh8.wghservers.com
Software: Apache /
Resource Hash: cb7090ffaf13c6033524f885d43d754875f957923eab2398c7310eebab140d64

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36
accept-language: da-DK,da;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 22319
Content-Type: text/html
Date: Thu, 26 Jan 2023 09:19:39 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Thu, 11 Aug 2022 02:32:53 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent

GET
H/1.1 200
OK moralis.min.js Show response
testmyhack.ihrnigeria.org/js/ 3 MB
563 KB 244ms
133ms Script
application/javascript 23.94.30.178
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://testmyhack.ihrnigeria.org/js/moralis.min.js
Requested by: Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/
Protocol: HTTP/1.1
Server: 23.94.30.178 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: wgh8.wghservers.com
Software: Apache /
Resource Hash: 63d6d8e911889b53746f02fadd3239499c9a08efc26522f6f2590fd9dc93af3f

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Thu, 26 Jan 2023 09:19:39 GMT
Content-Encoding: gzip
Last-Modified: Thu, 19 May 2022 23:50:16 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99

GET
H2 200 Inter-roman.var.woff2
app.uniswap.org/fonts/ 222 KB
223 KB 283ms
202ms Font
font/woff2 2606:4700::6812:1636
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app.uniswap.org/fonts/Inter-roman.var.woff2

Requested by

Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1636 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d2d2d11234d0d74c0ed3e9727ef07ac8422cbd5b356296b0f87f679c9f74ce83

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' https://www.google-analytics.com https://www.googletagmanager.com 'unsafe-inline'; report-uri https://uniswaplabs.report-uri.com/r/t/csp/reportOnly
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://testmyhack.ihrnigeria.org/
Origin: http://testmyhack.ihrnigeria.org
accept-language: da-DK,da;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 09:19:39 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-security-policy: script-src 'self' https://www.google-analytics.com https://www.googletagmanager.com 'unsafe-inline'; report-uri https://uniswaplabs.report-uri.com/r/t/csp/reportOnly
content-length: 227688
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "ee543a54bc453ac712fc863e69a68013"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JfhAGrhArhlaCHfKqUfHfGtriguqHXj2TP%2BxRKO2Pc7KDBYwGkmPNmzmWM1jcvhsDVHbFpCAsPCTEzAh0oTypHLo%2FdxHle5RGcusg7RI%2FnsW%2BQFrypGnZTEro1ID48wlnnDqfVZNkQ9IQ5Ny%2FyY%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 78f82b11a8319968-FRA
expires: Thu, 26 Jan 2023 13:19:39 GMT

GET
H/1.1 200
OK jquery.min.js Show response
testmyhack.ihrnigeria.org/js/ 87 KB
30 KB 126ms
121ms Script
application/javascript 23.94.30.178
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://testmyhack.ihrnigeria.org/js/jquery.min.js
Requested by: Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/
Protocol: HTTP/1.1
Server: 23.94.30.178 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: wgh8.wghservers.com
Software: Apache /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Thu, 26 Jan 2023 09:19:39 GMT
Content-Encoding: gzip
Last-Modified: Sat, 23 Apr 2022 15:49:01 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 30902

GET
H/1.1 200
OK web3provider.min.js Show response
testmyhack.ihrnigeria.org/js/ 730 KB
221 KB 247ms
132ms Script
application/javascript 23.94.30.178
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://testmyhack.ihrnigeria.org/js/web3provider.min.js
Requested by: Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/
Protocol: HTTP/1.1
Server: 23.94.30.178 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: wgh8.wghservers.com
Software: Apache /
Resource Hash: 1db31bd72954a6d0dd472016a4956d397f2002e8d95d941ae60ea178acfd2f54

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Thu, 26 Jan 2023 09:19:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 18 May 2022 20:51:34 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK web3.min.js Show response
testmyhack.ihrnigeria.org/js/ 1 MB
388 KB 249ms
133ms Script
application/javascript 23.94.30.178
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://testmyhack.ihrnigeria.org/js/web3.min.js
Requested by: Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/
Protocol: HTTP/1.1
Server: 23.94.30.178 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: wgh8.wghservers.com
Software: Apache /
Resource Hash: bfccb9edd2658df7f22748f618a36f42c45e0320c79b361b0ff7d00be836e1f7

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Thu, 26 Jan 2023 09:19:39 GMT
Content-Encoding: gzip
Last-Modified: Wed, 18 May 2022 20:51:03 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK main.js Show response
testmyhack.ihrnigeria.org/js/ 10 KB
4 KB 234ms
118ms Script
application/javascript 23.94.30.178
AS-COLOCROSSING

General

Check archive.org

Show headers Download Go to

Full URL: http://testmyhack.ihrnigeria.org/js/main.js
Requested by: Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/
Protocol: HTTP/1.1
Server: 23.94.30.178 , United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS: wgh8.wghservers.com
Software: Apache /
Resource Hash: bd8f15349a84c2e67e37de0f0c0d97d473fb6ac2ed1c80d045d69f024fa4a07d

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Date: Thu, 26 Jan 2023 09:19:39 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Oct 2022 17:37:03 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3898

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc1944a3d800b5cbede23e8acdf984598757033c891d54fbfdaab6f0644b4e32

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 10c4f65b73abe9ef08880f16511bee7073ca990525b66eb29647498d7698f8a4

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 wallets Show response
registry.walletconnect.com/api/v2/ 270 KB
47 KB 244ms
157ms Fetch
application/json 2606:4700::6812:1a2e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://registry.walletconnect.com/api/v2/wallets
Requested by: Host: testmyhack.ihrnigeria.org
URL: http://testmyhack.ihrnigeria.org/js/web3provider.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1a2e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 63268e92dd964a6b1e4c7dda92055c835af9f91cfa371de61727610277092f60

Request headers

accept-language: da-DK,da;q=0.9
Referer: http://testmyhack.ihrnigeria.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.119 Safari/537.36

Response headers

date: Thu, 26 Jan 2023 09:19:41 GMT
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=21600, s-maxage=7200
x-robots-tag: noindex
cf-ray: 78f82b197c1b9189-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Uniswap (Crypto Exchange)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.uniswap.org
registry.walletconnect.com
testmyhack.ihrnigeria.org
23.94.30.178
2606:4700::6812:1636
2606:4700::6812:1a2e
10c4f65b73abe9ef08880f16511bee7073ca990525b66eb29647498d7698f8a4
1db31bd72954a6d0dd472016a4956d397f2002e8d95d941ae60ea178acfd2f54
63268e92dd964a6b1e4c7dda92055c835af9f91cfa371de61727610277092f60
63d6d8e911889b53746f02fadd3239499c9a08efc26522f6f2590fd9dc93af3f
bd8f15349a84c2e67e37de0f0c0d97d473fb6ac2ed1c80d045d69f024fa4a07d
bfccb9edd2658df7f22748f618a36f42c45e0320c79b361b0ff7d00be836e1f7
cb7090ffaf13c6033524f885d43d754875f957923eab2398c7310eebab140d64
cc1944a3d800b5cbede23e8acdf984598757033c891d54fbfdaab6f0644b4e32
d2d2d11234d0d74c0ed3e9727ef07ac8422cbd5b356296b0f87f679c9f74ce83
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

testmyhack.ihrnigeria.org Open in urlscan Pro 23.94.30.178 Malicious Activity!

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

25 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

1498 kBTransfer

5580 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

0 Cookies

Indicators

testmyhack.ihrnigeria.org
23.94.30.178 Malicious Activity!

Screenshot
Live screenshot

Full Image

8
Requests

25 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

1498 kB
Transfer

5580 kB
Size

0
Cookies

8 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!