vsteelmetalasia.com Open in urlscan Pro
67.225.140.236  Malicious Activity! Public Scan

Submitted URL: https://vsteelmetalasia.com/q/index.php
Effective URL: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711...
Submission: On November 24 via manual from CA — Scanned from CA

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 67.225.140.236, located in United States and belongs to LIQUIDWEB, US. The main domain is vsteelmetalasia.com.
TLS certificate: Issued by R3 on November 20th 2022. Valid for: 3 months.
This is the only time vsteelmetalasia.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Butterfield Group (Banking)

Domain & IP information

IP Address AS Autonomous System
1 7 67.225.140.236 32244 (LIQUIDWEB)
1 216.240.206.229 25867 (INTRIA-HP...)
7 2
Apex Domain
Subdomains
Transfer
7 vsteelmetalasia.com
vsteelmetalasia.com
847 KB
1 butterfieldonline.com
www.butterfieldonline.com — Cisco Umbrella Rank: 395158
3 MB
7 2
Domain Requested by
7 vsteelmetalasia.com 1 redirects vsteelmetalasia.com
1 www.butterfieldonline.com vsteelmetalasia.com
7 2

This site contains links to these domains. Also see Links.

Domain
www.butterfieldonline.com
www.butterfieldgroup.com
Subject Issuer Validity Valid
vsteelmetalasia.com
R3
2022-11-20 -
2023-02-18
3 months crt.sh
butterfieldonline.com
Entrust Certification Authority - L1M
2022-05-09 -
2023-05-24
a year crt.sh

This page contains 1 frames:

Primary Page: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Frame ID: A2D26B073BB8522C33402AA70C9ADBCB
Requests: 7 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://vsteelmetalasia.com/q/index.php HTTP 302
    https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

3686 kB
Transfer

3684 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://vsteelmetalasia.com/q/index.php HTTP 302
    https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
vsteelmetalasia.com/q/
Redirect Chain
  • https://vsteelmetalasia.com/q/index.php
  • https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
30 KB
31 KB
Document
General
Full URL
https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
67.225.140.236 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.marketlinkwebsolutions.com
Software
nginx /
Resource Hash
7ef81bd30bace2b214dc1a803d6d17c2a56cb6fe68b4ec58db8a79d15cfe4902

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 24 Nov 2022 14:59:25 GMT
Server
nginx
Transfer-Encoding
chunked

Redirect headers

Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Thu, 24 Nov 2022 14:59:25 GMT
Server
nginx
Transfer-Encoding
chunked
location
login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
oj-alta-notag-min.css
vsteelmetalasia.com/q/index_files/
473 KB
473 KB
Stylesheet
General
Full URL
https://vsteelmetalasia.com/q/index_files/oj-alta-notag-min.css
Requested by
Host: vsteelmetalasia.com
URL: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
67.225.140.236 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.marketlinkwebsolutions.com
Software
nginx /
Resource Hash
09adebcb70a02e15358c3979f3487fd4db358becb0ee06005f6bded3080fae42

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 24 Nov 2022 14:59:25 GMT
Last-Modified
Wed, 19 Jan 2022 22:01:36 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
483992
Content-Type
text/css
main.1626262091093.css
vsteelmetalasia.com/q/index_files/
276 KB
276 KB
Stylesheet
General
Full URL
https://vsteelmetalasia.com/q/index_files/main.1626262091093.css
Requested by
Host: vsteelmetalasia.com
URL: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
67.225.140.236 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.marketlinkwebsolutions.com
Software
nginx /
Resource Hash
5287b6cf2cfbf22a191f5e2a2eb6fffdd3a13340a34964658a7af19dc6402ca7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 24 Nov 2022 14:59:25 GMT
Last-Modified
Wed, 19 Jan 2022 22:05:22 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
282563
Content-Type
text/css
widgets.1626262091093.css
vsteelmetalasia.com/q/index_files/
63 KB
64 KB
Stylesheet
General
Full URL
https://vsteelmetalasia.com/q/index_files/widgets.1626262091093.css
Requested by
Host: vsteelmetalasia.com
URL: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
67.225.140.236 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.marketlinkwebsolutions.com
Software
nginx /
Resource Hash
6cf4fd7d81d422ded28a11c00d727dbecef762ff498cc1c29ad2a80b4eb98635

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 24 Nov 2022 14:59:25 GMT
Last-Modified
Wed, 19 Jan 2022 22:01:38 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
64945
Content-Type
text/css
lock.png
vsteelmetalasia.com/q/index_files/
775 B
984 B
Image
General
Full URL
https://vsteelmetalasia.com/q/index_files/lock.png
Requested by
Host: vsteelmetalasia.com
URL: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
67.225.140.236 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.marketlinkwebsolutions.com
Software
nginx /
Resource Hash
c2f9d784f201e2e739085cc1226b0be2bc692ca7d945da99576819a8f179aa7f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 24 Nov 2022 14:59:25 GMT
Last-Modified
Wed, 19 Jan 2022 22:01:40 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
775
Content-Type
image/png
logo.svg
vsteelmetalasia.com/q/index_files/
3 KB
3 KB
Image
General
Full URL
https://vsteelmetalasia.com/q/index_files/logo.svg
Requested by
Host: vsteelmetalasia.com
URL: https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
67.225.140.236 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS
host.marketlinkwebsolutions.com
Software
nginx /
Resource Hash
70f6c36f645a5f3b9cf1d97ab23f375c216c425bc6403246c7d30354a36ea2c3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://vsteelmetalasia.com/q/login.php?cmd=login_submit&id=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711&session=6abcf3667f10842ecad11fa5081217116abcf3667f10842ecad11fa508121711
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 24 Nov 2022 14:59:25 GMT
Last-Modified
Wed, 19 Jan 2022 22:01:40 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2738
Content-Type
image/svg+xml
in-principle-approval-parallax.jpg
www.butterfieldonline.com/images/index/icons/
3 MB
3 MB
Image
General
Full URL
https://www.butterfieldonline.com/images/index/icons/in-principle-approval-parallax.jpg
Requested by
Host: vsteelmetalasia.com
URL: https://vsteelmetalasia.com/q/index_files/main.1626262091093.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
216.240.206.229 , United States, ASN25867 (INTRIA-HP-CORP, US),
Reverse DNS
Software
/
Resource Hash
65f651710098b729dacfe24d9d2f489385c24fda2566a6775775c4c4f1e5924a
Security Headers
Name Value
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://vsteelmetalasia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Thu, 24 Nov 2022 14:58:59 GMT
Last-Modified
Sun, 12 Sep 2021 05:04:53 GMT
X-Frame-Options
DENY
Content-Type
image/jpeg
Content-Language
en
Cache-Control
max-age=120
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=45, max=200
Content-Length
2906708
Expires
Thu, 24 Nov 2022 15:00:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Butterfield Group (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies