ffwpu-kenya.com Open in urlscan Pro
69.57.162.19 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://kazimmedia.wpengine.com/wp-includes/index.html
Effective URL:
https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL
Submission: On May 06 via manual (May 6th 2023, 4:46:45 pm UTC) from NL — Scanned from NL

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 2 HTTP transactions. The main IP is 69.57.162.19, located in United States and belongs to NAMECHEAP-NET, US. The main domain is ffwpu-kenya.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 18th 2022. Valid for: a year.

This is the only time ffwpu-kenya.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	104.196.185.141 104.196.185.141	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 2	69.57.162.19 69.57.162.19	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	3

1 104.196.185.141 (North Charleston, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 141.185.196.104.bc.googleusercontent.com

kazimmedia.wpengine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.57.162.19 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: premium265-5.web-hosting.com

ffwpu-kenya.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	ffwpu-kenya.com 1 redirects ffwpu-kenya.com	376 KB
1	wpengine.com kazimmedia.wpengine.com	515 B
2	2

	Domain	Requested by
2	ffwpu-kenya.com	1 redirects
1	kazimmedia.wpengine.com
2	2

This site contains no links.

Subject Issuer	Validity	Valid
ffwpu-kenya.com Sectigo RSA Domain Validation Secure Server CA	`2022-11-18` - `2023-11-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL
Frame ID: A5BD22FB404976FDE0E82EBFC710DA29
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Line TV /Line TV /

Page URL History Show full URLs

http://kazimmedia.wpengine.com/wp-includes/index.html Page URL
https://ffwpu-kenya.com/nc_assets/img/css/ HTTP 302
https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

480 kB
Transfer

679 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://kazimmedia.wpengine.com/wp-includes/index.html Page URL
https://ffwpu-kenya.com/nc_assets/img/css/ HTTP 302
https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index.html Show response kazimmedia.wpengine.com/wp-includes/	90 B 515 B	250ms 118ms	Document text/html	104.196.185.141 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL http://kazimmedia.wpengine.com/wp-includes/index.html Protocol HTTP/1.1 Server 104.196.185.141 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 141.185.196.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash `7a15d187bc46ff00920d3dd4a9f0c8e6a37998e0629ec08e1e6088c51b980bd8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Accept-Ranges bytes Cache-Control max-age=600, must-revalidate Connection keep-alive Content-Length 90 Content-Type text/html Date Sat, 06 May 2023 16:46:39 GMT ETag W/"5a-5faeaee11f9c0-gzip" Keep-Alive timeout=20 Last-Modified Fri, 05 May 2023 04:43:27 GMT Server nginx Vary Accept-Encoding,Cookie X-Cache HIT: 1 X-Cache-Group normal X-Cacheable SHORT X-Powered-By WP Engine
GET H2	200	Primary Request index.htmL Show response ffwpu-kenya.com/nc_assets/img/css/grab/ Redirect Chain https://ffwpu-kenya.com/nc_assets/img/css/ https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL	566 KB 375 KB	364ms 363ms	Document text/html	69.57.162.19 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL Protocol H2 Security TLS 1.3, , AES_256_GCM Server 69.57.162.19 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium265-5.web-hosting.com Software LiteSpeed / Resource Hash `49f355b0957c07e5dc79320d73881a8e9c4b02bb19f82a554caff3be80e59e4e` Request headers Referer http://kazimmedia.wpengine.com/wp-includes/index.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers accept-ranges bytes content-encoding br content-length 383870 content-type text/html date Sat, 06 May 2023 16:46:41 GMT last-modified Sat, 06 May 2023 14:34:36 GMT server LiteSpeed vary Accept-Encoding x-turbo-charged-by LiteSpeed Redirect headers cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Sat, 06 May 2023 16:46:41 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location grab/index.htmL pragma no-cache server LiteSpeed x-powered-by PHP/7.4.33 x-turbo-charged-by LiteSpeed
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d8dc942bdf04e43d4edb17c9d421f9f3a70bd62d5ec2fb502deb91b9b95fc064` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9a4620a32974adc5764f26a8070cd432aa32ba8be3167320fd32bcd9cdcaed08` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7601455c0af7c3e0d8e64a288249c254b8fc1b257350613a6cdd1e1aaca9a3e4` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ba2d2ee4d6be23aec486a42f33a99b6844ec6b3f70983c87482c5be600d570c6` Request headers accept-language nl-NL,nl;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	52 KB 52 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167` Request headers Referer Origin https://ffwpu-kenya.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	53 KB 53 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e` Request headers Referer Origin https://ffwpu-kenya.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ffwpu-kenya.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9d1c5b25af1e2a3c8e6e53ff7dfe3129

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://ffwpu-kenya.com/nc_assets/img/css/grab/index.htmL Message: The Content Security Policy 'default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:;' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ffwpu-kenya.com
kazimmedia.wpengine.com
104.196.185.141
69.57.162.19
49f355b0957c07e5dc79320d73881a8e9c4b02bb19f82a554caff3be80e59e4e
7601455c0af7c3e0d8e64a288249c254b8fc1b257350613a6cdd1e1aaca9a3e4
7a15d187bc46ff00920d3dd4a9f0c8e6a37998e0629ec08e1e6088c51b980bd8
9a4620a32974adc5764f26a8070cd432aa32ba8be3167320fd32bcd9cdcaed08
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e
ba2d2ee4d6be23aec486a42f33a99b6844ec6b3f70983c87482c5be600d570c6
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167
d8dc942bdf04e43d4edb17c9d421f9f3a70bd62d5ec2fb502deb91b9b95fc064

ffwpu-kenya.com Open in urlscan Pro 69.57.162.19 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

480 kBTransfer

679 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

ffwpu-kenya.com Open in urlscan Pro
69.57.162.19 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

480 kB
Transfer

679 kB
Size

1
Cookies

2 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!