![](/screenshots/f83d27c0-5c24-4400-8ec8-ad8dadbf544a.png)
quizdespoteaux.com
Open in
urlscan Pro
151.80.56.192
Malicious Activity!
Public Scan
Effective URL: https://quizdespoteaux.com/.97698765/dexcel/excel/source/view.php?email=%3C?php%20echo%20$_GET[%27email%27];%20?%3E
Submission: On November 18 via automatic, source openphish
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 30th 2020. Valid for: 3 months.
This is the only time quizdespoteaux.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 81.177.135.12 81.177.135.12 | 8342 (RTCOMM-AS) (RTCOMM-AS) | |
5 | 151.80.56.192 151.80.56.192 | 16276 (OVH) (OVH) | |
6 | 2 |
ASN8342 (RTCOMM-AS, RU)
PTR: srv138-h-st.jino.ru
sltorg.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
quizdespoteaux.com
quizdespoteaux.com |
82 KB |
1 |
sltorg.ru
sltorg.ru |
444 B |
6 | 2 |
Domain | Requested by | |
---|---|---|
5 | quizdespoteaux.com |
quizdespoteaux.com
|
1 | sltorg.ru | |
6 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
quizdespoteaux.com Let's Encrypt Authority X3 |
2020-09-30 - 2020-12-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://quizdespoteaux.com/.97698765/dexcel/excel/source/view.php?email=%3C?php%20echo%20$_GET[%27email%27];%20?%3E
Frame ID: F48708BB3B2CF3B136F8AEBD8008A024
Requests: 6 HTTP requests in this frame
Screenshot
![](/screenshots/f83d27c0-5c24-4400-8ec8-ad8dadbf544a.png)
Page URL History Show full URLs
- http://sltorg.ru/ Page URL
- https://quizdespoteaux.com/.97698765/dexcel/excel/source/?email=%3C?php%20echo%20$_GET[%27email%27];%20... Page URL
- https://quizdespoteaux.com/.97698765/dexcel/excel/source/view.php?email=%3C?php%20echo%20$_GET[%27email... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://sltorg.ru/ Page URL
- https://quizdespoteaux.com/.97698765/dexcel/excel/source/?email=%3C?php%20echo%20$_GET[%27email%27];%20?%3E Page URL
- https://quizdespoteaux.com/.97698765/dexcel/excel/source/view.php?email=%3C?php%20echo%20$_GET[%27email%27];%20?%3E Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
sltorg.ru/ |
134 B 444 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
quizdespoteaux.com/.97698765/dexcel/excel/source/ |
460 B 668 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
view.php
quizdespoteaux.com/.97698765/dexcel/excel/source/ |
25 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.jpg
quizdespoteaux.com/.97698765/dexcel/excel/source/includes/ |
54 KB 54 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
user.jpg
quizdespoteaux.com/.97698765/dexcel/excel/source/includes/ |
938 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pass.jpg
quizdespoteaux.com/.97698765/dexcel/excel/source/includes/ |
1 KB 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| modal object| btn undefined| span0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
quizdespoteaux.com
sltorg.ru
151.80.56.192
81.177.135.12
21caaad560894be766629bf60c765b34eb1de76e29db93adb23646ef9cfc6089
4e6c376e920aaaa526470ed74c1e7fb0e80d2be5bb1429fd6828f97f1850cd26
5c24c359f2a970fb597869dca63717c1dfff673c49a422cb50bf0b18b8a8aff0
7d59ecbc38483f6a7ce6f863722b8771a938e5993a077ef03594e80446d00149
86dd9cd15557be7b1132fbce99166a7c425f84bc6ec5934bc5923e43bdba2ac2
8755a399fd35a608c77e3007ca4d4f391b77ee83f737932d93f8cbd276c4cf92