![](/screenshots/cdf358d6-de40-4c8e-b55a-6abce70e6a41.png)
alpha.xelenz.education
Open in
urlscan Pro
3.7.184.189
Malicious Activity!
Public Scan
Effective URL: https://alpha.xelenz.education/wp-admin/educators/main/login.php?NESIN=990792811e949ec9144f8e1c27bff275&p=educators&session=165...
Submission: On July 06 via manual from US — Scanned from US
Summary
TLS certificate: Issued by R3 on May 20th 2022. Valid for: 3 months.
This is the only time alpha.xelenz.education was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Educators Credit Union (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 20 | 3.7.184.189 3.7.184.189 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2600:9000:202... 2600:9000:202c:2800:4:819e:800:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2606:4700::68... 2606:4700::6810:5514 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 104.17.127.190 104.17.127.190 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:80d::200a | 15169 (GOOGLE) (GOOGLE) | |
26 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-7-184-189.ap-south-1.compute.amazonaws.com
alpha.xelenz.education |
ASN16509 (AMAZON-02, US)
assets.orb.alkamitech.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
xelenz.education
2 redirects
alpha.xelenz.education |
137 KB |
3 |
ecu.com
onlinebanking.ecu.com — Cisco Umbrella Rank: 401193 |
18 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 429 |
48 KB |
2 |
alkamitech.com
assets.orb.alkamitech.com — Cisco Umbrella Rank: 27875 |
51 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 307 |
31 KB |
26 | 5 |
Domain | Requested by | |
---|---|---|
20 | alpha.xelenz.education |
2 redirects
alpha.xelenz.education
|
3 | onlinebanking.ecu.com |
alpha.xelenz.education
|
2 | cdn.jsdelivr.net |
alpha.xelenz.education
|
2 | assets.orb.alkamitech.com |
alpha.xelenz.education
assets.orb.alkamitech.com |
1 | ajax.googleapis.com |
alpha.xelenz.education
|
26 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ecu.com |
www04.timetrade.com |
www.apple.com |
play.google.com |
www.facebook.com |
twitter.com |
www.youtube.com |
www.pinterest.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
alpha.xelenz.education R3 |
2022-05-20 - 2022-08-18 |
3 months | crt.sh |
*.orb.alkamitech.com Entrust Certification Authority - L1K |
2022-01-03 - 2023-01-03 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
onlinebanking.ecu.com Entrust Certification Authority - L1M |
2022-06-07 - 2023-06-07 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-06-20 - 2022-09-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://alpha.xelenz.education/wp-admin/educators/main/login.php?NESIN=990792811e949ec9144f8e1c27bff275&p=educators&session=1657121960
Frame ID: 9F91C1F38A8D5C18C982B3E11695CD3D
Requests: 26 HTTP requests in this frame
Screenshot
![](/screenshots/cdf358d6-de40-4c8e-b55a-6abce70e6a41.png)
Page Title
LoginPage URL History Show full URLs
-
https://alpha.xelenz.education/wp-admin/educators/main
HTTP 301
https://alpha.xelenz.education/wp-admin/educators/main/ HTTP 302
https://alpha.xelenz.education/wp-admin/educators/main/login.php?NESIN=990792811e949ec9144f8e1c27bff275&p=e... Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/ZURB Foundation.png)
Detected patterns
- <link[^>]+foundation[^>"]+css
![](/vendor/wappa/icons/Vue.js.png)
Detected patterns
- <[^>]+\sdata-v(?:ue)?-
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: Rates
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Find a Branch or ATM
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://alpha.xelenz.education/wp-admin/educators/main
HTTP 301
https://alpha.xelenz.education/wp-admin/educators/main/ HTTP 302
https://alpha.xelenz.education/wp-admin/educators/main/login.php?NESIN=990792811e949ec9144f8e1c27bff275&p=educators&session=1657121960 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login.php
alpha.xelenz.education/wp-admin/educators/main/ Redirect Chain
|
51 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-icons.css
assets.orb.alkamitech.com/production/icons/Educators/font/ |
116 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yui-reset.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
793 B 772 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
31 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.daterangepicker.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ext-all.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
123 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
197 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
grid.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sidebar.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iris.shim.desktop.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
673 B 706 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iris.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
95 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iris-foundation.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
50 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iris-components.shim.desktop.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
1 KB 926 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
iris-components.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
187 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
isotope.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
theme.desktop.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
43 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fi.desktop.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
59 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/css/ |
158 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Logo
onlinebanking.ecu.com/Image/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app-store-badge.svg
onlinebanking.ecu.com/Isotope/Images/ |
11 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
google-play-badge.svg
onlinebanking.ecu.com/Isotope/Images/ |
9 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@4.6.1/dist/js/ |
81 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
alpha.xelenz.education/wp-admin/educators/main/assets/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
print.min.css
alpha.xelenz.education/wp-admin/educators/main/assets/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Alkami.woff2
assets.orb.alkamitech.com/production/icons/Educators/font/ |
41 KB 42 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Educators Credit Union (Financial)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| bootstrap function| userlogin function| isEmail function| next function| UrlExists function| EMlogin object| input object| url string| SesIN2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
alpha.xelenz.education/ | Name: PHPSESSID Value: mm2nnm9avrrvuecp01f3ek3tk6 |
|
.ecu.com/ | Name: __cf_bm Value: tsJNXCbOVamQdKmRRHlhGuXDgzuBVh.h3voyMR9kO24-1657121661-0-AV6HNhTRzqtfAzJjGYWJqi4allb20bVEs4UGxF3AjNsAtqr7RYo+4a8KqRX5ZSPqupPMdufE3l6chRDQWziRA9o= |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
alpha.xelenz.education
assets.orb.alkamitech.com
cdn.jsdelivr.net
onlinebanking.ecu.com
104.17.127.190
2600:9000:202c:2800:4:819e:800:93a1
2606:4700::6810:5514
2607:f8b0:4006:80d::200a
3.7.184.189
037e5f8a4d2ef765d97f6c14e087cab4f8f27a1ac2a6a7584793b1a76a08fb8f
0c5ed985fdbddc027124d4e6879ce1a1860832cda85e2b517c18d8fbd2fffc06
1c6409b9d51aa164948a53e968a2f9bb5c81186ff45f05e2de04f685b6347883
2dcf765854f1fe869b1674016feb1638870c1066f156f8d7dfd47b53d0dc093f
4ce72ae45e1aafaa5cd4cc684c0000459c6d154c31450aad92bbd51a34107c93
590fcd2ea2a3de691c86ecf564fff1fcb0982271cf723ae4d6e2453c9e6f5434
59f12ecd0c381fee3367ffac176a581a966727684a5ce94390b4390b2fc06ca4
5ca919797ea60615bb21b01a198194c5ff03076a7272b2003fc6c07668d12953
7e02c082fedfc821a8a51fe004dab6896dd928876a21ccac8675142c2e2f7b1f
85392c1de142face2c43f99a314465b26754b0c3b84a66c744802e4268fee931
86c9954e1457d27db013c1f10a96ffaba845e5af7765c4ef9df4ac1549e47d67
8e9901c7a56cf78e86b90384c8a18329a0bc96c06f0ba87b239a0f4413b199eb
a277dd9a22a97f512f9024dbe82acb5468a168ec43bad3146b2cda9d93afd2fe
a6ffe73271ddb32a8d74bffb2450d0272b40ab5aef57b1120c7a88d0124f456b
ab9c55dea4e2d8b7e988cb51b7f82d7dda04336a90e7b9400ac417198590077b
ad401a67d0afec08fb36bdd814985e6a4f90949191a150e9e640ed5df95d5e97
bd9e388c4bf3fa35c69954adfcfad65a60fd47f96ff6bf48048fb4c285c0541a
be0b525336c526e14ac9fd25f5055f4f356c1ed0d2c19f41372e5832e00aa636
be2abe72cbcb0d7577cca9200829db1861c30b0697efec6e0bf96e640a59de75
c45f05122a7423fd896b64d851a5a77e4abbc1da87792588e5f81c5976717ca0
d8037eaa657798878ac5ff42f851a9615bb5419a34ea05d798f38e797456cc6b
e1a457fcc3c6c0d23336df97c1e5594395410bbb67e79719498c53e3551c838f
e4b9f0c0a5e74bbbde3c314a73fd18b1f5038cbda33e1e58e597dbee8f63d9e0
e5895f5341963193228e9f0c1477a3ba414148d4b8785a6078801b2bc02959ca
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f9cdc3eed2e549dc825b5354ebcad5f4e6ee57547604c0b54346390051be741c