crportals.com.ng Open in urlscan Pro
209.212.158.122 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://azkids.az/a/
Effective URL:
http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443
Submission Tags: 6697258
Submission: On July 26 via api (July 26th 2020, 1:00:59 pm UTC) from NL

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 209.212.158.122, located in Arlington Heights, United States and belongs to ASN-GIGENET, US. The main domain is crportals.com.ng.

This is the only time crportals.com.ng was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DHL (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	185.22.155.185 185.22.155.185	51659 (ASBAXET) (ASBAXET)
3 11	209.212.158.122 209.212.158.122	32181 (ASN-GIGENET) (ASN-GIGENET)
9	3

1 185.22.155.185 (Russian Federation)

ASN51659 (ASBAXET, RU)
PTR: ns5.sayt.az

azkids.az	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 209.212.158.122 (Arlington Heights, United States) 3 redirects

ASN32181 (ASN-GIGENET, US)
PTR: gn415.whpservers.com

crportals.com.ng	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	crportals.com.ng 3 redirects crportals.com.ng	165 KB
1	azkids.az azkids.az	333 B
9	2

	Domain	Requested by
11	crportals.com.ng	3 redirects azkids.az crportals.com.ng
1	azkids.az
9	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443
Frame ID: 8B3893B3A897A273573F4539EAE295C3
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://azkids.az/a/ Page URL
http://crportals.com.ng/DHL HTTP 301
http://crportals.com.ng/DHL/ HTTP 302
http://crportals.com.ng/DHL/x0x1x3x6/index.php?valid=true&id=45006618 HTTP 302
http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

182 kB
Transfer

320 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://azkids.az/a/ Page URL
http://crportals.com.ng/DHL HTTP 301
http://crportals.com.ng/DHL/ HTTP 302
http://crportals.com.ng/DHL/x0x1x3x6/index.php?valid=true&id=45006618 HTTP 302
http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response azkids.az/a/	64 B 333 B	296ms 290ms	Document text/html	185.22.155.185 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://azkids.az/a/ Protocol HTTP/1.1 Server 185.22.155.185 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS ns5.sayt.az Software Apache / Resource Hash `9e101a10370a791deabd38cbc809febd107a074362643dafde3489d57ff49a2d` Request headers Host azkids.az Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:39 GMT Server Apache Content-Encoding gzip Vary Accept-Encoding Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request 11644210b.php Show response crportals.com.ng/DHL/x0x1x3x6/ Redirect Chain http://crportals.com.ng/DHL http://crportals.com.ng/DHL/ http://crportals.com.ng/DHL/x0x1x3x6/index.php?valid=true&id=45006618 http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443	4 KB 2 KB	399ms 399ms	Document text/html	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Full URL http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Requested by Host: azkids.az URL: http://azkids.az/a/ Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash `55c31d8f0c2d2f4120bcf350ee6151c3b7ac603ab07bc0a894d3da3ba2051349` Request headers Host crportals.com.ng Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://azkids.az/a/ Accept-Encoding gzip, deflate Accept-Language en-US Cookie PHPSESSID=3anm89dn25f5vfke014s3aoa04 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://azkids.az/a/ Response headers Date Sun, 26 Jul 2020 13:00:25 GMT Server Apache/2 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 1642 Keep-Alive timeout=2, max=97 Connection Keep-Alive Content-Type text/html; charset-UTF-8;charset=UTF-8 Redirect headers Date Sun, 26 Jul 2020 13:00:24 GMT Server Apache/2 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Location ./11644210b.php?web=succes&local=_&id=65570443 Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 323 Keep-Alive timeout=2, max=98 Connection Keep-Alive Content-Type text/html; charset-UTF-8;charset=UTF-8
GET H/1.1	200 OK	style.css crportals.com.ng/DHL/x0x1x3x6/layout/css/	209 KB 72 KB	119ms 117ms	Stylesheet text/css	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/css/style.css Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash `993198ae94d90e3ea850f7d6b70443b64cf5f817098c778821edf924c297eea3` Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Content-Encoding gzip Last-Modified Sun, 26 Apr 2020 14:27:32 GMT Server Apache/2 ETag "34299-5a432661c3d00-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=96
GET H/1.1	404 Not Found	style.js crportals.com.ng/DHL/x0x1x3x6/layout/js/	0 0	224ms 217ms	Script text/html	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/js/style.js Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type text/html Keep-Alive timeout=2, max=100 Content-Length 220
GET H/1.1	200 OK	lg.svg crportals.com.ng/DHL/x0x1x3x6/layout/img/	2 KB 1 KB	223ms 216ms	Image image/svg+xml	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Show image Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/img/lg.svg Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash `aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1` Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Content-Encoding gzip Last-Modified Sun, 26 Apr 2020 14:27:32 GMT Server Apache/2 ETag "7f8-5a432661c3d00-gzip" Vary Accept-Encoding,User-Agent Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/svg+xml Keep-Alive timeout=2, max=100 Content-Length 729
GET H/1.1	200 OK	pub.jpg crportals.com.ng/DHL/x0x1x3x6/layout/img/	80 KB 81 KB	226ms 219ms	Image image/jpeg	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Show image Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/img/pub.jpg Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash `fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5` Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Last-Modified Sun, 26 Apr 2020 14:27:32 GMT Server Apache/2 ETag "140d5-5a432661c3d00" Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/jpeg Keep-Alive timeout=2, max=100 Content-Length 82133
GET H/1.1	200 OK	pubr.gif crportals.com.ng/DHL/x0x1x3x6/layout/img/	8 KB 8 KB	226ms 220ms	Image image/gif	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Show image Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/img/pubr.gif Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash `38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6` Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Last-Modified Sun, 26 Apr 2020 14:27:32 GMT Server Apache/2 ETag "2098-5a432661c3d00" Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/gif Keep-Alive timeout=2, max=100 Content-Length 8344
GET H/1.1	404 Not Found	style.js crportals.com.ng/DHL/x0x1x3x6/layout/js/	0 0	112ms 112ms	Script text/html	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/js/style.js Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=95 Content-Length 220
GET DATA	200 OK	truncated /	17 KB 17 KB		Font application/font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `5dd216ad75ced5dd6acfb48d1ae11ba66fb373c26da7fc5efbdad9fd1c14f6e3` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://crportals.com.ng/DHL/x0x1x3x6/layout/css/style.css Origin http://crportals.com.ng Response headers Content-Type application/font-woff2;charset=utf-8
GET H/1.1	404 Not Found	style.js crportals.com.ng/DHL/x0x1x3x6/layout/js/	0 0	315ms 314ms	Script text/html	209.212.158.122 ASN-GIGENET
General Check archive.org Show headers Download Go to Full URL http://crportals.com.ng/DHL/x0x1x3x6/layout/js/style.js Requested by Host: crportals.com.ng URL: http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 Protocol HTTP/1.1 Server 209.212.158.122 Arlington Heights, United States, ASN32181 (ASN-GIGENET, US), Reverse DNS gn415.whpservers.com Software Apache/2 / Resource Hash Request headers Referer http://crportals.com.ng/DHL/x0x1x3x6/11644210b.php?web=succes&local=_&id=65570443 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Sun, 26 Jul 2020 13:00:26 GMT Content-Encoding gzip Server Apache/2 Vary Accept-Encoding,User-Agent Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=94 Content-Length 220

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DHL (Transportation)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| onReady function| setVisible

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			crportals.com.ng/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3anm89dn25f5vfke014s3aoa04

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

azkids.az
crportals.com.ng
185.22.155.185
209.212.158.122
38d38e7a9e31f364cf1238ed6efcad478b3d71b56a8070c7aeda136e7a09dfa6
55c31d8f0c2d2f4120bcf350ee6151c3b7ac603ab07bc0a894d3da3ba2051349
5dd216ad75ced5dd6acfb48d1ae11ba66fb373c26da7fc5efbdad9fd1c14f6e3
993198ae94d90e3ea850f7d6b70443b64cf5f817098c778821edf924c297eea3
9e101a10370a791deabd38cbc809febd107a074362643dafde3489d57ff49a2d
aeed178a287002e32c4a7767dc24b3c732a812cdd42017835055e42db4d2eae1
fd6d79b881550d2aced201e506cbd7dfacafc19c16db81a655ad06f2835819c5

crportals.com.ng Open in urlscan Pro 209.212.158.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

182 kBTransfer

320 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

crportals.com.ng Open in urlscan Pro
209.212.158.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

182 kB
Transfer

320 kB
Size

1
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!