![](/screenshots/ff8a8fec-044d-409e-89fa-40c546e8ab47.png)
bynetsolutions.com
Open in
urlscan Pro
88.218.117.68
Malicious Activity!
Public Scan
Effective URL: http://bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/
Submission Tags: phishing malicious Search All
Submission: On February 29 via api from US
Summary
This is the only time bynetsolutions.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.11 67.199.248.11 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
1 | 2001:8d8:1001... 2001:8d8:1001:1083:ba08:4895:1e92:e02b | 8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48) | |
2 9 | 88.218.117.68 88.218.117.68 | 209622 (UPRESS-DRB) (UPRESS-DRB) | |
4 | 2.18.232.75 2.18.232.75 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
12 | 3 |
ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
www.fewo-silberleithen.at |
ASN209622 (UPRESS-DRB, IL)
PTR: s-web29-il.upress.io
bynetsolutions.com |
ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-75.deploy.static.akamaitechnologies.com
www.paypalobjects.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
bynetsolutions.com
2 redirects
bynetsolutions.com |
106 KB |
4 |
paypalobjects.com
www.paypalobjects.com |
143 KB |
1 |
fewo-silberleithen.at
www.fewo-silberleithen.at |
412 B |
1 |
bit.ly
1 redirects
bit.ly |
399 B |
12 | 4 |
Domain | Requested by | |
---|---|---|
9 | bynetsolutions.com |
2 redirects
bynetsolutions.com
|
4 | www.paypalobjects.com |
bynetsolutions.com
|
1 | www.fewo-silberleithen.at | |
1 | bit.ly | 1 redirects |
12 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.paypal.com DigiCert SHA2 Extended Validation Server CA |
2020-01-09 - 2022-01-12 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/
Frame ID: CD807646751556B4A17BAB27AEE5087F
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/ff8a8fec-044d-409e-89fa-40c546e8ab47.png)
Page URL History Show full URLs
-
http://bit.ly/3arjo1J
HTTP 301
http://www.fewo-silberleithen.at/components/com_content/controllers/lados/google.html Page URL
-
http://bynetsolutions.com//wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/
HTTP 302
http://bynetsolutions.com//wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491 HTTP 301
http://bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/ Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.ly/3arjo1J
HTTP 301
http://www.fewo-silberleithen.at/components/com_content/controllers/lados/google.html Page URL
-
http://bynetsolutions.com//wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/
HTTP 302
http://bynetsolutions.com//wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491 HTTP 301
http://bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://bit.ly/3arjo1J HTTP 301
- http://www.fewo-silberleithen.at/components/com_content/controllers/lados/google.html
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
google.html
www.fewo-silberleithen.at/components/com_content/controllers/lados/ Redirect Chain
|
129 B 412 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/style/js/ |
85 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xappx.css
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/style/css/ |
108 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/style/css/ |
782 B 747 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin.js
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xsecx.js
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/style/js/ |
268 B 544 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
monogram@2x.png
www.paypalobjects.com/images/shared/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.png
bynetsolutions.com/wp-content/themes/bynat/js/lib/marquee/021TRHRTRTH5THT/users/Login.ID-85491/style/css/ |
46 KB 47 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansBig-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
48 KB 48 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Light.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 46 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
PayPalSansSmall-Regular.woff
www.paypalobjects.com/webstatic/mktg/2014design/font/PP-Sans/ |
46 KB 47 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial) Generic (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| ChangeCaptcha function| check1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bynetsolutions.com/ | Name: PHPSESSID Value: ee641ue60sa8l7rmjj6plhs2kt |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
bynetsolutions.com
www.fewo-silberleithen.at
www.paypalobjects.com
2.18.232.75
2001:8d8:1001:1083:ba08:4895:1e92:e02b
67.199.248.11
88.218.117.68
12bec3e411f30e9f988a001dc06817aef7a8d2513fb2e78c989d75a4946714de
2a2cacf1f67863eedabdf29f70e2ad64391a1a1cb005f722fea3fe5e3c47230d
2b30ef27ece565c8f9939453d2537f00a925169bc203175b05a9c1e74829b147
544dfa59462862db7bafc2d2e4b3925ac3eacb11e52834916df02bd1cda19b1d
6147903130bbe6caae1160807a2caf410e97546def37e3cd7a982ff8716b802c
843e67ad522a908162007f4b7601819a5bbfef00e38ac7aec778766da8b7b2ab
ae79dcc3eb016922caa1d095cfd936446bc65a46bb3364b242dfc556f7e3c6a8
c54f67149f21fc89c592ede2dc71d00751dcc0576267861ebf9ee8df6a59b940
c599c554590d1a336ffcb9627f6caaac34b6228f60e15f5f25454bff38facb7e
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d
d4d7be1b34b9f66c922af0bda1b017df118d4e77df6f68e95d6bd322301a2fd9
d7e88d7c098ed6f78a3a6f6c5df5322b7b482e41ebce5016f5edc7e29e8d6b5a