secureitcare.xyz Open in urlscan Pro
94.242.223.126  Malicious Activity! Public Scan

Submitted URL: https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com
Effective URL: https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Submission: On June 15 via manual from US

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 94.242.223.126, located in Luxembourg and belongs to ROOT, LU. The main domain is secureitcare.xyz.
TLS certificate: Issued by Let's Encrypt Authority X3 on June 14th 2018. Valid for: 3 months.
This is the only time secureitcare.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 52.15.72.79 16509 (AMAZON-02)
3 94.242.223.126 5577 (ROOT)
4 2
Apex Domain
Subdomains
Transfer
3 secureitcare.xyz
secureitcare.xyz
101 KB
1 ngrok.io
d4ee660a.ngrok.io
346 B
4 2
Domain Requested by
3 secureitcare.xyz d4ee660a.ngrok.io
secureitcare.xyz
1 d4ee660a.ngrok.io
4 2

This site contains no links.

Subject Issuer Validity Valid
*.ngrok.io
RapidSSL RSA CA 2018
2018-03-12 -
2019-03-12
a year crt.sh
secureitcare.xyz
Let's Encrypt Authority X3
2018-06-14 -
2018-09-12
3 months crt.sh

This page contains 1 frames:

Primary Page: https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Frame ID: CA76FFAC831753B67114257029C29A65
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com Page URL
  2. https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
  • headers server /php\/?([\d.]+)?/i

Overall confidence: 100%
Detected patterns
  • headers server /Win32|Win64/i

Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

101 kB
Transfer

118 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com Page URL
  2. https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
direct.php
d4ee660a.ngrok.io/New/238/8334/
146 B
346 B
Document
General
Full URL
https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.15.72.79 Columbus, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
03.edge.prod.oh.ngrok.com
Software
Apache/2.4.33 (Win32) OpenSSL/1.0.2o PHP/5.6.36 / PHP/5.6.36
Resource Hash
92d84d6c928ac2edbe2aab812e42f8e30601355c618e05f75867e820be339cb6

Request headers

Host
d4ee660a.ngrok.io
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
CA76FFAC831753B67114257029C29A65

Response headers

Date
Fri, 15 Jun 2018 12:48:51 GMT
Server
Apache/2.4.33 (Win32) OpenSSL/1.0.2o PHP/5.6.36
X-Powered-By
PHP/5.6.36
Content-Length
146
Content-Type
text/html; charset=UTF-8
Primary Request auth.php
secureitcare.xyz/Update/Scan/3674/Scan/scan/
21 KB
3 KB
Document
General
Full URL
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Requested by
Host: d4ee660a.ngrok.io
URL: https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.242.223.126 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS
lion16.ipchina163.com
Software
Apache / PHP/5.6.36
Resource Hash
cc3546be5dcead73a55acbf2494ed6aaaf43705bdd7316d2482d638bc15614f6

Request headers

Host
secureitcare.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
CA76FFAC831753B67114257029C29A65
Referer
https://d4ee660a.ngrok.io/New/238/8334/direct.php?email=Testemail@gmail.com

Response headers

Date
Fri, 15 Jun 2018 12:48:54 GMT
Server
Apache
X-Powered-By
PHP/5.6.36
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
2843
Keep-Alive
timeout=3, max=10
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
img.jpg
secureitcare.xyz/Update/Scan/3674/Scan/scan/files/
20 KB
21 KB
Image
General
Full URL
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/files/img.jpg
Requested by
Host: secureitcare.xyz
URL: https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.242.223.126 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS
lion16.ipchina163.com
Software
Apache /
Resource Hash
05ca05851e360bad196dca829711ce9993a332549eb1a2f6dec8d6f87e844fe4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
secureitcare.xyz
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Connection
keep-alive
Cache-Control
no-cache
Referer
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 15 Jun 2018 12:48:54 GMT
Last-Modified
Wed, 13 Dec 2017 09:05:14 GMT
Server
Apache
Content-Type
image/jpeg
Cache-Control
max-age=2419200, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=9
Content-Length
20896
Expires
Sun, 15 Jul 2018 12:48:54 GMT
footer.jpg
secureitcare.xyz/Update/Scan/3674/Scan/scan/files/
77 KB
77 KB
Image
General
Full URL
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/files/footer.jpg
Requested by
Host: secureitcare.xyz
URL: https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.242.223.126 , Luxembourg, ASN5577 (ROOT, LU),
Reverse DNS
lion16.ipchina163.com
Software
Apache /
Resource Hash
96117bec4106a8a9b717e1e176a28a80a651eaaa02f8dae303c40bbbaa585a8e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
secureitcare.xyz
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
Connection
keep-alive
Cache-Control
no-cache
Referer
https://secureitcare.xyz/Update/Scan/3674/Scan/scan/auth.php?email=Testemail@gmail.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Fri, 15 Jun 2018 12:48:54 GMT
Last-Modified
Wed, 13 Dec 2017 09:50:08 GMT
Server
Apache
Content-Type
image/jpeg
Cache-Control
max-age=2419200, public
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=3, max=8
Content-Length
78788
Expires
Sun, 15 Jul 2018 12:48:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| login

0 Cookies