139.28.223.218 Open in urlscan Pro
139.28.223.218 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://139.28.223.218/
Effective URL:
http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZ...
Submission: On April 15 via manual (April 15th 2020, 11:22:32 am UTC) from GB

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 21 HTTP transactions. The main IP is 139.28.223.218, located in Russian Federation and belongs to SUPERSERVERSDATACENTER, RU. The main domain is 139.28.223.218.

This is the only time 139.28.223.218 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of Montreal (Banking)

Domain & IP information

	IP Address	AS Autonomous System
18	139.28.223.218 139.28.223.218	50113 (SUPERSERV...) (SUPERSERVERSDATACENTER)
1	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
21	3

18 139.28.223.218 (Russian Federation)

ASN50113 (SUPERSERVERSDATACENTER, RU)
PTR: darklife.example.com

139.28.223.218	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gstatic.com fonts.gstatic.com	21 KB
1	googleapis.com fonts.googleapis.com	581 B
21	2

	Domain	Requested by
2	fonts.gstatic.com	139.28.223.218
1	fonts.googleapis.com	139.28.223.218
21	2

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-03-24` - `2020-06-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Frame ID: 1E550DE9204FF9013A35AE291E064431
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://139.28.223.218/ Page URL
http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj... Page URL

Detected technologies

Debian (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Debian/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

21
Requests

14 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

212 kB
Transfer

765 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://139.28.223.218/ Page URL
http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set / Show response
139.28.223.218/ 204 B
618 B 201ms
168ms Document
text/html 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 84a81d934d1720e21de5af68067166a5374c3cc65fc8b0e8fba89d3d9d30a454

Request headers

Host: 139.28.223.218
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Server: Apache/2.4.25 (Debian)
Set-Cookie: PHPSESSID=l7j11t8lccn7icjocgtc6l9s50; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 198
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request Login.php Show response
139.28.223.218/ 289 KB
35 KB 96ms
96ms Document
text/html 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: db4d7ce4e225afb1d470f50d1ff2ae109cefb225573ab0e2de5752e1227df4f5

Request headers

Host: 139.28.223.218
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://139.28.223.218/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: PHPSESSID=l7j11t8lccn7icjocgtc6l9s50
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://139.28.223.218/

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Server: Apache/2.4.25 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 35616
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 css
fonts.googleapis.com/ 3 KB
581 B 19ms
16ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Heebo:300,400,500,700

Requested by

Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dafe276b82b01e819afcbed4ac30ece12c3309402208a3db5e4b3ca79418155

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 15 Apr 2020 11:22:11 GMT
server: ESF
date: Wed, 15 Apr 2020 11:22:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 15 Apr 2020 11:22:11 GMT

GET
H/1.1 200
OK jquery-1.9.1.js Show response
139.28.223.218/assets/js/ 262 KB
78 KB 190ms
156ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/assets/js/jquery-1.9.1.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "4185d-59d3a9f85f341-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK jquery.maskedinput.js Show response
139.28.223.218/assets/js/ 10 KB
3 KB 178ms
144ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/assets/js/jquery.maskedinput.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 4d4775c5932c663ca4cdd2d5cabfbae0b89a687ab26226cb88153c6d2c0166c6

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "2779-59d3a9f85ef59-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2518

GET
H/1.1 200
OK jquery.payment.js Show response
139.28.223.218/assets/js/ 17 KB
4 KB 172ms
138ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/assets/js/jquery.payment.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 190b90b1f62ad6798fca4c93adce6d0205c13b960b609af306f2d87b54885f85

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "4242-59d3a9f85ef59-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3425

GET
H/1.1 200
OK jquery.validate.min.js Show response
139.28.223.218/assets/js/ 21 KB
7 KB 195ms
87ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/assets/js/jquery.validate.min.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "524c-59d3a9f85eb71-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 6362

GET
H/1.1 200
OK lme.js Show response
139.28.223.218/files/ 40 KB
9 KB 252ms
83ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/lme.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 15c22b57b312193563dbff81e190d359c533c53a42f194b797903836e56d2676

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "9ed9-59d3a9f859d51-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 9371

GET
H/1.1 200
OK hashtable.js Show response
139.28.223.218/files/ 13 KB
4 KB 255ms
84ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/hashtable.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 72eaba348d6155b3e68aed606892e40ee51be9b2e4ce4977b4ccd63b4f253326

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "35b1-59d3a9f85d019-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3357

GET
H/1.1 200
OK pm_fp.js Show response
139.28.223.218/files/ 37 KB
11 KB 264ms
88ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/pm_fp.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 94675091a50bce73164da049e23434130513f5234dd58abd3c566690a5498644

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "9477-59d3a9f847c42-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 11069

GET
H/1.1 200
OK worklight.css
139.28.223.218/files/ 4 KB
2 KB 175ms
142ms Stylesheet
text/css 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/worklight.css
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 11db581c7a2efa5271fd38426fb14ad8552e7d6b36f56cda387105e11e1f096d

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "f3a-59d3a9f85d401-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1326

GET
H/1.1 200
OK app.css
139.28.223.218/files/ 15 KB
4 KB 167ms
135ms Stylesheet
text/css 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/app.css
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: a08236e582969cd5cb4ccb4fe74ca9be8050a3a560232737e7360dfed1c01e2c

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "3b51-59d3a9f8589c9-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3605

GET
H/1.1 200
OK bmo-logo-white.da860e1dcbd0370b41529d289d1c53ec.svg
139.28.223.218/files/ 3 KB
3 KB 86ms
86ms Image
image/svg+xml 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://139.28.223.218/files/bmo-logo-white.da860e1dcbd0370b41529d289d1c53ec.svg
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: bb7af830300442e4ff713146efe19833948f4a95882d0d6d4f811d7f5bdd4772

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "b73-59d3a9f8589c9"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2931

GET
H/1.1 200
OK 1.png
139.28.223.218/files/ 625 B
909 B 84ms
83ms Image
image/png 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://139.28.223.218/files/1.png
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: b56ae114bdf5ff5bdb2fdf6ee45c1ceb5972e2995f9a537eb4d4fa6f1c2c511e

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "271-59d3a9f859969"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 625

GET
H/1.1 200
OK 2.png
139.28.223.218/files/ 819 B
1 KB 82ms
82ms Image
image/png 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://139.28.223.218/files/2.png
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 9f0915b5de5d53754af24f154e9aa38fac828b534c3e283ca6191b6e9c8f3125

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "333-59d3a9f84785a"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 819

GET
H/1.1 200
OK 3.png
139.28.223.218/files/ 3 KB
4 KB 87ms
86ms Image
image/png 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://139.28.223.218/files/3.png
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 0c8a69aec3763772661455675fc52691cd70412b7ed61813f4d74408221dd4f2

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "d36-59d3a9f85d019"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 3382

GET
H/1.1 200
OK browserCheck.js Show response
139.28.223.218/files/ 4 KB
2 KB 86ms
86ms Script
application/javascript 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/browserCheck.js
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 752ce465387cd877a95714efadec24e6da5a5c962ed653a0b8b7dcb1702850e9

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "10df-59d3a9f85d401-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1496

GET
H/1.1 200
OK header-background.3cfd406909d4684e1416d67e8158afc5.png
139.28.223.218/files/ 5 KB
5 KB 88ms
87ms Image
image/png 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://139.28.223.218/files/header-background.3cfd406909d4684e1416d67e8158afc5.png
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 4e95d8e2a43e43305fbff1e490ceb4093f8f05b971ff6100417c3d5449c94cb2

Request headers

Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "1311-59d3a9f8589c9"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4881

GET
H2 200 NGS3v5_NC0k9P9lNaKRMkK4q06VE.woff2
fonts.gstatic.com/s/heebo/v5/ 10 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/heebo/v5/NGS3v5_NC0k9P9lNaKRMkK4q06VE.woff2

Requested by

Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2230ca232d900dfe252d6c465d8a3eb56026a6c936f49e1d5ec0527c83c736e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Heebo:300,400,500,700
Origin: http://139.28.223.218

Response headers

date: Wed, 01 Apr 2020 18:22:19 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:22:03 GMT
server: sffe
age: 1184392
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 10412
x-xss-protection: 0
expires: Thu, 01 Apr 2021 18:22:19 GMT

GET
H/1.1 200
OK heebo-v3-latin-regular.woff2
139.28.223.218/files/fonts/ 18 KB
18 KB 121ms
86ms Font
application/octet-stream 139.28.223.218
SUPERSERVERSDATAC...

General

Check archive.org

Show headers Download Go to

Full URL: http://139.28.223.218/files/fonts/heebo-v3-latin-regular.woff2
Requested by: Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Protocol: HTTP/1.1
Server: 139.28.223.218 , Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, RU),
Reverse DNS: darklife.example.com
Software: Apache/2.4.25 (Debian) /
Resource Hash: 9ddd83dfd31abda9a00b38cc30dcd0f54f30acb6adface6d4b9578890c779464

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS
Origin: http://139.28.223.218

Response headers

Date: Wed, 15 Apr 2020 11:22:11 GMT
Last-Modified: Tue, 28 Jan 2020 22:19:53 GMT
Server: Apache/2.4.25 (Debian)
ETag: "46cc-59d3a9f859581"
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 18124

GET
H2 200 NGS3v5_NC0k9P9kFbqRMkK4q06VE.woff2
fonts.gstatic.com/s/heebo/v5/ 10 KB
10 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/heebo/v5/NGS3v5_NC0k9P9kFbqRMkK4q06VE.woff2

Requested by

Host: 139.28.223.218
URL: http://139.28.223.218/Login.php?sslchannel=true&sessionid=AKUwtHaVeMgPGrGskmH4D28XM8QE4ntF8obB5lxj8N9PfPhzbZDO1MMNUCsZZVF8jRJpchIk4RajHrSS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d146d946fd8be33dee0d3d9bb7410a52c574428cb789d5e26c61ef03dc87307e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Heebo:300,400,500,700
Origin: http://139.28.223.218

Response headers

date: Thu, 02 Apr 2020 01:34:51 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:21:31 GMT
server: sffe
age: 1158440
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 10492
x-xss-protection: 0
expires: Fri, 02 Apr 2021 01:34:51 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of Montreal (Banking)

62 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			139.28.223.218/	1969-12-31 23:59:59	Name: PHPSESSID Value: l7j11t8lccn7icjocgtc6l9s50

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: http://139.28.223.218/files/lme.js(Line 536) Message: loaded lme.js [object Window]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
139.28.223.218
2a00:1450:4001:814::2003
2a00:1450:4001:821::200a
0c8a69aec3763772661455675fc52691cd70412b7ed61813f4d74408221dd4f2
11db581c7a2efa5271fd38426fb14ad8552e7d6b36f56cda387105e11e1f096d
15c22b57b312193563dbff81e190d359c533c53a42f194b797903836e56d2676
190b90b1f62ad6798fca4c93adce6d0205c13b960b609af306f2d87b54885f85
2dafe276b82b01e819afcbed4ac30ece12c3309402208a3db5e4b3ca79418155
4d4775c5932c663ca4cdd2d5cabfbae0b89a687ab26226cb88153c6d2c0166c6
4e95d8e2a43e43305fbff1e490ceb4093f8f05b971ff6100417c3d5449c94cb2
72eaba348d6155b3e68aed606892e40ee51be9b2e4ce4977b4ccd63b4f253326
752ce465387cd877a95714efadec24e6da5a5c962ed653a0b8b7dcb1702850e9
7705fee13417229d718f14947e9860d5bb2b25bd15c9f5cd834f2545c7bad0a6
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
84a81d934d1720e21de5af68067166a5374c3cc65fc8b0e8fba89d3d9d30a454
94675091a50bce73164da049e23434130513f5234dd58abd3c566690a5498644
9ddd83dfd31abda9a00b38cc30dcd0f54f30acb6adface6d4b9578890c779464
9f0915b5de5d53754af24f154e9aa38fac828b534c3e283ca6191b6e9c8f3125
a08236e582969cd5cb4ccb4fe74ca9be8050a3a560232737e7360dfed1c01e2c
b2230ca232d900dfe252d6c465d8a3eb56026a6c936f49e1d5ec0527c83c736e
b56ae114bdf5ff5bdb2fdf6ee45c1ceb5972e2995f9a537eb4d4fa6f1c2c511e
bb7af830300442e4ff713146efe19833948f4a95882d0d6d4f811d7f5bdd4772
d146d946fd8be33dee0d3d9bb7410a52c574428cb789d5e26c61ef03dc87307e
db4d7ce4e225afb1d470f50d1ff2ae109cefb225573ab0e2de5752e1227df4f5

139.28.223.218 Open in urlscan Pro 139.28.223.218 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

14 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

212 kBTransfer

765 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

62 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

139.28.223.218 Open in urlscan Pro
139.28.223.218 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

14 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

212 kB
Transfer

765 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!