login-reviewactivities.com Open in urlscan Pro
185.8.106.112 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://login-reviewactivities.com/
Effective URL:
https://login-reviewactivities.com/fid
Submission: On March 16 via api (March 16th 2023, 12:43:50 pm UTC) from GB — Scanned from GB

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 185.8.106.112, located in Lithuania and belongs to CHERRYSERVERS3-AS, LT. The main domain is login-reviewactivities.com.
TLS certificate: Issued by R3 on March 14th 2023. Valid for: 3 months.

This is the only time login-reviewactivities.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: first direct bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2 9	185.8.106.112 185.8.106.112	204770 (CHERRYSER...) (CHERRYSERVERS3-AS)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (STACKPATH...) (STACKPATH-CDN)
8	3

9 185.8.106.112 (Lithuania) 2 redirects

ASN204770 (CHERRYSERVERS3-AS, LT)

login-reviewactivities.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	login-reviewactivities.com 2 redirects login-reviewactivities.com	385 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 686	30 KB
8	2

	Domain	Requested by
9	login-reviewactivities.com	2 redirects login-reviewactivities.com code.jquery.com
1	code.jquery.com	login-reviewactivities.com
8	2

This site contains no links.

Subject Issuer	Validity	Valid
login-reviewactivities.com R3	`2023-03-14` - `2023-06-12`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2022-08-03` - `2023-07-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login-reviewactivities.com/fid
Frame ID: 7670EC6901CC862B57700F190F6AEE50
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome to Online Banking | first direct

Page URL History Show full URLs

http://login-reviewactivities.com/ HTTP 301
https://login-reviewactivities.com/ HTTP 302
https://login-reviewactivities.com/fid Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

415 kB
Transfer

482 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://login-reviewactivities.com/ HTTP 301
https://login-reviewactivities.com/ HTTP 302
https://login-reviewactivities.com/fid Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request fid Show response login-reviewactivities.com/ Redirect Chain http://login-reviewactivities.com/ https://login-reviewactivities.com/ https://login-reviewactivities.com/fid	5 KB 5 KB	506ms 506ms	Document text/html	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/fid Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `0cd9f1be19cd7710879ebca9c5f8a7d7e84f54e15686ab110b6302f89c3231ef` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 4872 Content-Type text/html; charset=UTF-8 Date Thu, 16 Mar 2023 12:43:45 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 16 Mar 2023 12:43:43 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 location /fid
GET H/1.1	200 OK	app.1.24.0.29d8f9.css login-reviewactivities.com/assets/fid/	142 KB 142 KB	114ms 114ms	Stylesheet text/css	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/assets/fid/app.1.24.0.29d8f9.css Requested by Host: login-reviewactivities.com URL: https://login-reviewactivities.com/fid Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `17365b5b9c07f1eb0eff1f02c7ed86fe8f67e857e0f2fed831beb0afc84e9cfe` Request headers accept-language en-GB,en;q=0.9 Referer https://login-reviewactivities.com/fid User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Thu, 16 Mar 2023 12:43:46 GMT Last-Modified Mon, 10 Oct 2022 02:13:10 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "23845-5eaa4b376d980" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 145477
GET H/1.1	200 OK	app.prefetch.72fe91.css login-reviewactivities.com/assets/fid/	156 KB 156 KB	339ms 113ms	Stylesheet text/css	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/assets/fid/app.prefetch.72fe91.css Requested by Host: login-reviewactivities.com URL: https://login-reviewactivities.com/fid Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `195511ed7037f55a3d3382e632b729f029a9e9e3deeda9a6098c301d8311de92` Request headers accept-language en-GB,en;q=0.9 Referer https://login-reviewactivities.com/fid User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Thu, 16 Mar 2023 12:43:46 GMT Last-Modified Mon, 10 Oct 2022 01:34:48 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "27013-5eaa42a411e00" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 159763
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	123ms 37ms	Script application/javascript	2001:4de0:ac18::1:a:2a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: login-reviewactivities.com URL: https://login-reviewactivities.com/fid Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers Referer https://login-reviewactivities.com/ Origin https://login-reviewactivities.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Thu, 16 Mar 2023 12:43:46 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-15d9d" vary Accept-Encoding x-hw 1678970626.dop062.lo4.t,1678970626.cds006.lo4.hn,1678970626.cds263.lo4.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H/1.1	200 OK	actions.js Show response login-reviewactivities.com/assets/js/	778 B 1 KB	338ms 113ms	Script application/javascript	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/assets/js/actions.js?v=1678970626 Requested by Host: login-reviewactivities.com URL: https://login-reviewactivities.com/fid Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60` Request headers accept-language en-GB,en;q=0.9 Referer https://login-reviewactivities.com/fid User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Thu, 16 Mar 2023 12:43:46 GMT Last-Modified Wed, 27 Apr 2022 18:39:38 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "30a-5dda721afce80" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 778
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `70b9e003edf061263b00b0cf2b30457ed3c6e8e843a663467aa540b0c1c9cb85` Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	6 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ff494e63dbf65d514f4082ee6e1518b8d95a14fd6b9c7e7ad8aa2ea71c32dc21` Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	158 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `abe5dd4337483083a1525197caceac6b1e229cb02b6334b41040a2e9ef1edd1b` Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H/1.1	200 OK	HelveticaNeueLTW05-45Light.woff2 login-reviewactivities.com/assets/fid/	38 KB 38 KB	113ms 113ms	Font application/octet-stream	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/assets/fid/HelveticaNeueLTW05-45Light.woff2 Requested by Host: login-reviewactivities.com URL: https://login-reviewactivities.com/assets/fid/app.1.24.0.29d8f9.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `0bfe845c97897526fcfd1009a71c12de5b8f85115c339cc5483234ac3a1a97ca` Request headers Referer https://login-reviewactivities.com/assets/fid/app.1.24.0.29d8f9.css Origin https://login-reviewactivities.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Thu, 16 Mar 2023 12:43:46 GMT Last-Modified Mon, 10 Oct 2022 01:16:56 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "964c-5eaa3ea5bb200" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 38476
GET H/1.1	200 OK	HelveticaNeueLTW05-75Bold.woff2 login-reviewactivities.com/assets/fid/	41 KB 41 KB	113ms 113ms	Font application/octet-stream	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/assets/fid/HelveticaNeueLTW05-75Bold.woff2 Requested by Host: login-reviewactivities.com URL: https://login-reviewactivities.com/assets/fid/app.1.24.0.29d8f9.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / Resource Hash `55ade691f1a06265b6e9c502523ea2972ff8432f2ef1766965d9b3d3bbdd7d81` Request headers Referer https://login-reviewactivities.com/assets/fid/app.1.24.0.29d8f9.css Origin https://login-reviewactivities.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Thu, 16 Mar 2023 12:43:46 GMT Last-Modified Mon, 10 Oct 2022 01:16:56 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 ETag "a41c-5eaa3ea5bb200" Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 42012
POST H/1.1	200 OK	action Show response login-reviewactivities.com/apis/lr/	25 B 394 B	988ms 984ms	XHR text/html	185.8.106.112 CHERRYSERVERS3-AS
General Check archive.org Show headers Download Go to Full URL https://login-reviewactivities.com/apis/lr/action Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.0.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.8.106.112 , Lithuania, ASN204770 (CHERRYSERVERS3-AS, LT), Reverse DNS Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 / PHP/7.4.33 Resource Hash `c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e` Request headers Accept / Referer https://login-reviewactivities.com/fid X-Requested-With XMLHttpRequest accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Pragma no-cache Date Thu, 16 Mar 2023 12:43:47 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.33 X-Powered-By PHP/7.4.33 Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Keep-Alive timeout=5, max=96 Content-Length 25 Expires Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: first direct bank (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login-reviewactivities.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 32g8ci0b5dg9qf07dv0bauierj

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
login-reviewactivities.com
185.8.106.112
2001:4de0:ac18::1:a:2a
0bfe845c97897526fcfd1009a71c12de5b8f85115c339cc5483234ac3a1a97ca
0cd9f1be19cd7710879ebca9c5f8a7d7e84f54e15686ab110b6302f89c3231ef
17365b5b9c07f1eb0eff1f02c7ed86fe8f67e857e0f2fed831beb0afc84e9cfe
195511ed7037f55a3d3382e632b729f029a9e9e3deeda9a6098c301d8311de92
411a7dde58e7f50627e413a47dda8ef4d5d11ec89ac4b78b8416a66badf7bd60
55ade691f1a06265b6e9c502523ea2972ff8432f2ef1766965d9b3d3bbdd7d81
70b9e003edf061263b00b0cf2b30457ed3c6e8e843a663467aa540b0c1c9cb85
abe5dd4337483083a1525197caceac6b1e229cb02b6334b41040a2e9ef1edd1b
c1cbbd152a050ee0dc982af665d16b3508db3942527b4b1d65aff0127244ac9e
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff494e63dbf65d514f4082ee6e1518b8d95a14fd6b9c7e7ad8aa2ea71c32dc21

login-reviewactivities.com Open in urlscan Pro 185.8.106.112 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

415 kBTransfer

482 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

login-reviewactivities.com Open in urlscan Pro
185.8.106.112 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

415 kB
Transfer

482 kB
Size

1
Cookies

8 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!