![](/screenshots/e8c73bc7-2087-49c9-9fe1-df8063e8392f.png)
cl460129x.maintenis.com
Open in
urlscan Pro
45.64.1.251
Malicious Activity!
Public Scan
Effective URL: https://cl460129x.maintenis.com/~k2484993/js/tmp/login.php?cmd=login_submit&id=a44b87cc32c5837eb4b86f162c3c0fd7a44b87cc32c5837eb...
Submission: On October 08 via manual from US
Summary
TLS certificate: Issued by RapidSSL RSA CA 2018 on July 11th 2018. Valid for: 2 years.
This is the only time cl460129x.maintenis.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DCU (Banking) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 89.40.173.143 89.40.173.143 | 60087 (ASSUPERNOVA) (ASSUPERNOVA) | |
3 3 | 184.168.131.241 184.168.131.241 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 8 | 45.64.1.251 45.64.1.251 | 55660 (MWN-AS-ID...) (MWN-AS-ID PT Master Web Network) | |
1 | 2a00:1450:400... 2a00:1450:4001:815::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 69.89.31.230 69.89.31.230 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
10 | 4 |
ASN60087 (ASSUPERNOVA, IT)
PTR: prohosting19-143.netsons.net
offertedalweb.net | |
www.offertedalweb.net |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-184-168-131-241.ip.secureserver.net
scrantonmfg.com |
ASN55660 (MWN-AS-ID PT Master Web Network, ID)
PTR: 64.1.251.static-45.masterweb.com
cl460129x.maintenis.com |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box430.bluehost.com
smallenvelop.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
maintenis.com
1 redirects
cl460129x.maintenis.com |
996 KB |
3 |
scrantonmfg.com
3 redirects
scrantonmfg.com |
446 B |
2 |
offertedalweb.net
1 redirects
offertedalweb.net www.offertedalweb.net |
601 B |
1 |
smallenvelop.com
smallenvelop.com |
214 B |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
10 | 5 |
Domain | Requested by | |
---|---|---|
8 | cl460129x.maintenis.com |
1 redirects
cl460129x.maintenis.com
|
3 | scrantonmfg.com | 3 redirects |
1 | smallenvelop.com |
cl460129x.maintenis.com
|
1 | ajax.googleapis.com |
cl460129x.maintenis.com
|
1 | www.offertedalweb.net | |
1 | offertedalweb.net | 1 redirects |
10 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
offertedalweb.net Let's Encrypt Authority X3 |
2018-08-27 - 2018-11-25 |
3 months | crt.sh |
*.maintenis.com RapidSSL RSA CA 2018 |
2018-07-11 - 2020-10-09 |
2 years | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2018-09-18 - 2018-12-11 |
3 months | crt.sh |
smallenvelop.com Let's Encrypt Authority X3 |
2018-09-24 - 2018-12-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cl460129x.maintenis.com/~k2484993/js/tmp/login.php?cmd=login_submit&id=a44b87cc32c5837eb4b86f162c3c0fd7a44b87cc32c5837eb4b86f162c3c0fd7&session=a44b87cc32c5837eb4b86f162c3c0fd7a44b87cc32c5837eb4b86f162c3c0fd7
Frame ID: EB0BF5657F79C961B8522C0B0322C9FF
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/e8c73bc7-2087-49c9-9fe1-df8063e8392f.png)
Page URL History Show full URLs
-
http://offertedalweb.net/re-direct.php
HTTP 302
https://www.offertedalweb.net/re-direct.php Page URL
-
http://scrantonmfg.com/4ABN
HTTP 302
http://scrantonmfg.com/NQnlZ/4ABN HTTP 302
http://scrantonmfg.com/4ABN HTTP 302
https://cl460129x.maintenis.com/~k2484993/js/tmp/index.php HTTP 302
https://cl460129x.maintenis.com/~k2484993/js/tmp/login.php?cmd=login_submit&id=a44b87cc32c5837eb4b86f162c3c0... Page URL
Detected technologies
Detected patterns
- url /\.php(?:$|\?)/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://offertedalweb.net/re-direct.php
HTTP 302
https://www.offertedalweb.net/re-direct.php Page URL
-
http://scrantonmfg.com/4ABN
HTTP 302
http://scrantonmfg.com/NQnlZ/4ABN HTTP 302
http://scrantonmfg.com/4ABN HTTP 302
https://cl460129x.maintenis.com/~k2484993/js/tmp/index.php HTTP 302
https://cl460129x.maintenis.com/~k2484993/js/tmp/login.php?cmd=login_submit&id=a44b87cc32c5837eb4b86f162c3c0fd7a44b87cc32c5837eb4b86f162c3c0fd7&session=a44b87cc32c5837eb4b86f162c3c0fd7a44b87cc32c5837eb4b86f162c3c0fd7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://offertedalweb.net/re-direct.php HTTP 302
- https://www.offertedalweb.net/re-direct.php
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
re-direct.php
www.offertedalweb.net/ Redirect Chain
|
109 B 278 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
login.php
cl460129x.maintenis.com/~k2484993/js/tmp/ Redirect Chain
|
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c1.png
cl460129x.maintenis.com/~k2484993/js/tmp/images/ |
492 KB 493 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c2.png
cl460129x.maintenis.com/~k2484993/js/tmp/images/ |
396 KB 396 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c3.png
cl460129x.maintenis.com/~k2484993/js/tmp/images/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c4.png
cl460129x.maintenis.com/~k2484993/js/tmp/images/ |
59 KB 60 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gn.png
cl460129x.maintenis.com/~k2484993/js/tmp/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c5.png
cl460129x.maintenis.com/~k2484993/js/tmp/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Preloader_11.gif
smallenvelop.com/wp-content/uploads/2014/08/ |
214 B 214 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DCU (Banking) Generic (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cl460129x.maintenis.com
offertedalweb.net
scrantonmfg.com
smallenvelop.com
www.offertedalweb.net
184.168.131.241
2a00:1450:4001:815::200a
45.64.1.251
69.89.31.230
89.40.173.143
05229600de1e1f87c620d28c7979db2da88c7b56cfafbdc9c9a6557fb418d733
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1d02799cd72f0d4d6d0e9238715fc7060b1edd5f2e8cbe20fc89a4f7e815174c
472817838f3a31f9e621d8e5ea92f41de250d9198d1f5b375aeb05a750490957
8ed1ed38467cc418ca3948607afc328c44b3c4b1fcc2f0230ef38240c1f66524
8f7c75bd29266e67445c70e88630fbc18db9dce725e4eb52aecd1732e64578a3
9a3ed1abd7605d9afdf045496de4a718c7f7085a52c901597746b6e8d2d5d9b4
a2a559373b1187fd99818424acb16514c5a7edd45ea3e892bedbde283f296d3d
ad3351ee01e56f3155e02c5291b107e1fdc3060097df2f94fc123cd4cc9fc1bf
cd5bef14ec559e818f07b62c6e91a8a96d49ed6434eaae372a5f3ca67f5fc812