Submitted URL: https://sitarcuisineofindia.net/86364/4689/?email=dib0@cdc.gov
Effective URL: https://sitarcuisineofindia.net/86364/4689/pgovkd5479opu2xet3ld5448.php?wa=wsignin1.0&rpsnv=13&ct=474191645&rver=3ddca5289029a674819636e09411574a&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&id=3DDCA5289029A674819636E09411574A&mkt=en-us&cbcxt=mai&email=dib0@cdc.gov
Submission: On February 11 via manual from US
Effective URL: https://sitarcuisineofindia.net/86364/4689/pgovkd5479opu2xet3ld5448.php?wa=wsignin1.0&rpsnv=13&ct=474191645&rver=3ddca5289029a674819636e09411574a&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&id=3DDCA5289029A674819636E09411574A&mkt=en-us&cbcxt=mai&email=dib0@cdc.gov
Submission: On February 11 via manual from US
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 21 HTTP transactions.
The main IP is 192.185.170.179, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is sitarcuisineofindia.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 4th 2019. Valid for: 3 months.
This is the first time this domain was scanned on urlscan.io!
The main IP is 192.185.170.179, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is sitarcuisineofindia.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 4th 2019. Valid for: 3 months.
This is the first time this domain was scanned on urlscan.io!
Verdict: Malicious (Score: 100/100) Show Details
-
urlscan - Score: 100
phishingPhishing against Generic (Online)
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 21 | 192.185.170.179 192.185.170.179 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
| 2 2 | 198.246.102.49 198.246.102.49 | 13611 (CDC) (CDC - U.S. Center For Disease Control and Prevention) | |
| 1 | 2a02:26f0:eb:... 2a02:26f0:eb:182::2461 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 21 | 2 |
21
192.185.170.179
(Houston, United States)
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 192-185-170-179.unifiedlayer.com
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: 192-185-170-179.unifiedlayer.com
2
198.246.102.49
(Atlanta, United States)
ASN13611 (CDC - U.S. Center For Disease Control and Prevention, US)
PTR: egappreviews.org
ASN13611 (CDC - U.S. Center For Disease Control and Prevention, US)
PTR: egappreviews.org
| Domain Subdomains |
Transfer | |
|---|---|---|
| 21 |
sitarcuisineofindia.net
1 redirects
|
316 KB |
| 3 |
cdc.gov
2 redirects
|
2 KB |
| 21 | 2 |
| Domain | Requested by | |
|---|---|---|
| 21 | sitarcuisineofindia.net |
1 redirects
sitarcuisineofindia.net
|
| 2 | cdc.gov | 2 redirects |
| 1 | www.cdc.gov |
sitarcuisineofindia.net
|
| 21 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| Subject / Issuer | Validity | Valid |
|---|---|---|
| sitarcuisineofindia.net Let's Encrypt Authority X3 |
2019-01-04 - 2019-04-04 |
3 months |
| www.cdc.gov GeoTrust RSA CA 2018 |
2018-09-17 - 2019-11-26 |
a year |
Screenshot
Detected technologies
RoundCube
(Web Mail)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^(?:rcmail|rcube_|roundcube)/i
PHP
(Programming Languages)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^(?:rcmail|rcube_|roundcube)/i
Nginx
(Web Servers)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery
(JavaScript Libraries)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
- script /jquery-ui(?:-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery-ui.*\.js/i
jQuery UI
(JavaScript Libraries)
Web
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery-ui(?:-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery-ui.*\.js/i
Stats
0
Requests
0
Ad-blocked
0
Malicious
0
%
HTTPS
0
%
IPv6
0
Domains
0
Subdomains
0
IPs
0
Countries
0
kB
Transfer
0
kB
Size
0
Cookies
0 Outgoing links
These are links going to different origins than the main page. For each link, only the first name is shown.
21 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
pgovkd5479opu2xet3ld5448.php?wa=wsignin1.0&rpsnv=13&ct=474191645&rver=3ddca5289029a674819636e09411574a&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&id=3DDCA5289029A674819636E09411574A&mkt=en-us&cbcxt=mai...
/86364/4689 Redirect Chain
|
7 KB 3 KB |
Document text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
styles.css?s=1387973879
/86364/4689/bootstrap |
46 KB 11 KB |
Stylesheet text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-ui-1.9.2.custom.css?s=1399644532
/86364/4689/plugins/jqueryui/themes/larry |
0 0 |
Stylesheet text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ui.js?s=1382384360
/86364/4689/bootstrap |
34 KB 11 KB |
Script application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Verified
jquery.min.js?s=1399644532
/86364/4689/bootstrap |
94 KB 38 KB |
Script application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.min.js?s=1399644532
/86364/4689/bootstrap |
13 KB 4 KB |
Script application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
app.min.js?s=1399644532
/86364/4689/bootstrap |
128 KB 43 KB |
Script application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jstz.min.js?s=1399644532
/86364/4689/bootstrap |
5 KB 2 KB |
Script application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-ui-1.9.2.custom.min.js?s=1399644532
/86364/4689/bootstrap |
231 KB 75 KB |
Script application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
www.cdc.gov Redirect Chain
|
1 KB 2 KB |
Image image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
linen.jpg?v=0382.14157
/86364/4689/bootstrap/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ajaxloader.gif
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
buttons.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
addcontact.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
filetypes.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
listicons.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
messages.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
quota.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
selector.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
splitter.png
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
watermark.jpg
/86364/4689/skins/larry/images |
12 KB 12 KB |
Image text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Redirect requests
There were HTTP redirects (301, 302) for the following requests:
Request 0- https://sitarcuisineofindia.net/86364/4689/?email=dib0@cdc.gov
- https://sitarcuisineofindia.net/86364/4689/pgovkd5479opu2xet3ld5448.php?wa=wsignin1.0&rpsnv=13&ct=474191645&rver=3ddca5289029a674819636e09411574a&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&id=3DDCA5289...
- http://cdc.gov/favicon.ico
- https://cdc.gov/favicon.ico
- https://www.cdc.gov/favicon.ico
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan - Score: 100
Categories:phishing
Tags:
phishing
Phishing against: Generic (Online)
33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| rcube_mail_ui function| rcube_scroller function| rcube_splitter function| $ function| jQuery number| CONTROL_KEY number| SHIFT_KEY number| CONTROL_SHIFT_KEY function| roundcube_browser object| rcube_event function| rcube_event_engine function| rcube_check_email function| rcube_clone_object function| urlencode function| rcube_find_object function| rcube_mouse_is_over function| setCookie function| getCookie function| rcube_console object| bw object| Base64 function| rcube_webmail object| jstz object| rcmail function| MM_findObj function| MM_validateForm object| jQuery1110035797173460843434 function| DP_jQuery_1549903951965 object| UI object| img0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators of compromise (IoCs)
This is a term in the security industry to describe indicators around an attack. This includes IPs, hashes, domains, etc.
cdc.gov sitarcuisineofindia.net www.cdc.gov 192.185.170.179 198.246.102.49 2a02:26f0:eb:182::2461 186e4871719f8181122e5dff6182859e2d36939537309e8415b8cd21c2b8aac8 2d7f43c7ddda4bc107c80e268023650196b790f2b9ebc4b73e8908af1787d4f5 2f0a6fe0e824262821cc359a15b7908a00e5733fb6d8a5cdd404a7ad94988e47 32f59f8128d42dda46d1e3234d326574d25659bda0cd5762021e619c1a738ea6 b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682 b98e58f0f2c62969d61ce2ec31043dacb8d378ecbbfcae138b6250d432e195dd c21819444c59933ada030bc71b93325df463d5644fd75181f8bbd5c69c07912a e4048613475c00b1a77c90d3f7a8f9c0986cc710eff9ad990db9701d2e9995c4 f3ffb0e895c8503c8ae77b9ab28700f88c7fc5d966882634c059042f94dc3f85 f63ffa752044f857838b22cab1b1098dfab0701184ab6fcbf447c63e829660f5