icsinternational.servehttp.com
Open in
urlscan Pro
194.135.84.70
Malicious Activity!
Public Scan
Effective URL: https://icsinternational.servehttp.com/leeg.php?session=64be334ee7049
Submission: On July 24 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on July 21st 2023. Valid for: 3 months.
This is the only time icsinternational.servehttp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 192.0.78.179 192.0.78.179 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
1 9 | 194.135.84.70 194.135.84.70 | 212531 (INTERNETO...) (INTERNETO-VIZIJA) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
14 | 4 |
ASN212531 (INTERNETO-VIZIJA, LT)
PTR: 4pfs.c.serverhost.name
icsinternational.servehttp.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
servehttp.com
1 redirects
icsinternational.servehttp.com |
17 KB |
4 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 261 |
37 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2051 |
14 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 983 |
6 KB |
1 |
tsl.news
1 redirects
tsl.news |
282 B |
14 | 5 |
Domain | Requested by | |
---|---|---|
9 | icsinternational.servehttp.com |
1 redirects
icsinternational.servehttp.com
cdnjs.cloudflare.com |
4 | cdnjs.cloudflare.com |
icsinternational.servehttp.com
|
1 | ajax.aspnetcdn.com |
icsinternational.servehttp.com
|
1 | maxcdn.bootstrapcdn.com |
icsinternational.servehttp.com
|
1 | tsl.news | 1 redirects |
14 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
icsinternational.servehttp.com R3 |
2023-07-21 - 2023-10-19 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2023-05-05 - 2024-04-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://icsinternational.servehttp.com/leeg.php?session=64be334ee7049
Frame ID: 838B046D2FBB74051E7E1715FFB7D790
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
InloggenPage URL History Show full URLs
-
https://tsl.news/?ads_click=1&data=59670-59669-0-32341-1&nonce=0003457faa&redir=https://icsin...
HTTP 302
https://icsinternational.servehttp.com/newleeg.php HTTP 302
https://icsinternational.servehttp.com/leeg.php?session=64be334ee7049 Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Axios (JavaScript libraries) Expand
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://tsl.news/?ads_click=1&data=59670-59669-0-32341-1&nonce=0003457faa&redir=https://icsinternational.servehttp.com/newleeg.php
HTTP 302
https://icsinternational.servehttp.com/newleeg.php HTTP 302
https://icsinternational.servehttp.com/leeg.php?session=64be334ee7049 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
leeg.php
icsinternational.servehttp.com/ Redirect Chain
|
21 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.3.0/css/ |
23 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
icsinternational.servehttp.com/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
golo.png
icsinternational.servehttp.com/work_files/nl-cis/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ |
82 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.easing.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-easing/1.3/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.validate.js
ajax.aspnetcdn.com/ajax/jquery.validate/1.13.1/ |
42 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.min.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
icsinternational.servehttp.com/ |
20 KB 3 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
checklogin.php
icsinternational.servehttp.com/ |
0 53 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
checklogin.php
icsinternational.servehttp.com/ |
0 33 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
checklogin.php
icsinternational.servehttp.com/ |
0 33 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
checklogin.php
icsinternational.servehttp.com/ |
0 33 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.url
Submitted on
July 26th 2023, 6:57:09 am
UTC —
From Netherlands
Threats:
Phishing
Brand Impersonation
Brands:
International Card Services
NL
Comment: Dangerous! Phishing
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| $jscomp function| axios function| containsWhitespace function| calcTotal function| getAcquisitionPoints function| getCultivationGiftPoints function| getCultivationDonationPoints function| getRetentionPoints function| getBonusDonorPoints object| modules function| saveData function| clearNexter string| url number| interval1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
icsinternational.servehttp.com/ | Name: PHPSESSID Value: pcfd9rkreaaset59g61n1a8loo |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
icsinternational.servehttp.com
maxcdn.bootstrapcdn.com
tsl.news
152.199.19.160
192.0.78.179
194.135.84.70
2606:4700::6811:190e
2606:4700::6812:bcf
0b2e14311f125f0297228596820e18b5825ba46bdc0e2d0c021cfd49c86a1ff8
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
2379363060b818df38089983c12a4508ad8c35944ae59f9519cccdc4f3e80b6c
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
42c327b149a333f7a0b3c667177e17dfcbc1983aadb18966ce9834d81fb2a744
541ac58217a8ade1a5e292a65a0661dc9db7a49ae13654943817a4fbc6761afd
889b7ca429a915176ca37ce4ea9892325a83491598251289e423436c741fd8df
ac3f3a757bfbfc9d92bc8f5e6e6362e5d4ae41dbf3cebacdda9b8f71afc82e5b
ccb14d3b7d6c42de6ee99cd01a0587c300a70c9b861f7da453749e211ae555c8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855