skillbook.eu Open in urlscan Pro
185.81.4.68 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://208.71.141.135/loud/
Effective URL:
https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/
Submission: On September 16 via api (September 16th 2020, 11:54:17 am UTC) from BE

Summary HTTP 7 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 1 domains to perform 7 HTTP transactions. The main IP is 185.81.4.68, located in Rome, Italy and belongs to SERVERPLAN-AS, IT. The main domain is skillbook.eu.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 2nd 2020. Valid for: 3 months.

This is the only time skillbook.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address		AS Autonomous System
1	208.71.141.135 208.71.141.135		40281 (QWKNET) (QWKNET)
6	185.81.4.68 185.81.4.68		52030 (SERVERPLA...) (SERVERPLAN-AS)
7	2

1 208.71.141.135 (Idaho Falls, United States)

ASN40281 (QWKNET, US)
PTR: mail.breezyhilldesigns.com

208.71.141.135	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.81.4.68 (Rome, Italy)

ASN52030 (SERVERPLAN-AS, IT)
PTR: euporia.dnshigh.com

skillbook.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	skillbook.eu skillbook.eu	1 MB
7	1

	Domain	Requested by
6	skillbook.eu	skillbook.eu
7	1

This site contains no links.

Subject Issuer	Validity	Valid
webmail.skillbook.eu Let's Encrypt Authority X3	`2020-08-02` - `2020-10-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/
Frame ID: DA68C579CC23D7FF884478CAF837D866
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://208.71.141.135/loud/ Page URL
https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Page URL

Detected technologies

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

2
Countries

1083 kB
Transfer

1075 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://208.71.141.135/loud/ Page URL
https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response 208.71.141.135/loud/	426 B 770 B	427ms 398ms	Document text/html	208.71.141.135 QWKNET
General Check archive.org Show headers Download Go to Full URL http://208.71.141.135/loud/ Protocol HTTP/1.1 Server 208.71.141.135 Idaho Falls, United States, ASN40281 (QWKNET, US), Reverse DNS mail.breezyhilldesigns.com Software Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 / Resource Hash `3ccb3dd3497c7f281f7b6218903f6626605675299433967bb9884c0bd8df15f0` Request headers Host 208.71.141.135 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 16 Sep 2020 11:54:00 GMT Server Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Last-Modified Wed, 16 Sep 2020 11:30:29 GMT ETag "16a1fc9-1aa-5af6c983dd0a4" Accept-Ranges bytes Content-Length 426 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H2	200	Primary Request / Show response skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/	7 KB 7 KB	343ms 148ms	Document text/html	185.81.4.68 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.81.4.68 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS euporia.dnshigh.com Software Apache / Resource Hash `779e542766b327fd348e07a884a201cf4b1f1903f0beddaf0dcafcb178070534` Request headers :method GET :authority skillbook.eu :scheme https :path /data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer http://208.71.141.135/loud/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://208.71.141.135/loud/ Response headers status 200 date Wed, 16 Sep 2020 11:54:01 GMT server Apache content-length 6746 content-type text/html; charset=UTF-8
GET H2	200	bootstrap.min.css skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/css/	141 KB 143 KB	83ms 81ms	Stylesheet text/css	185.81.4.68 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/css/bootstrap.min.css Requested by Host: skillbook.eu URL: https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.81.4.68 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS euporia.dnshigh.com Software Apache / Resource Hash `e97eeaff12e2bc13faea2155e33f58ba434d337bdbf63ee9d65addaf88b02c6c` Request headers Referer https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 11:54:01 GMT last-modified Thu, 14 May 2020 21:20:42 GMT server Apache etag "32a055b-235f0-5a5a244da5e80" content-type text/css status 200 accept-ranges bytes content-length 144880
GET H2	200	style.css skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/css/	802 B 889 B	82ms 81ms	Stylesheet text/css	185.81.4.68 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/css/style.css Requested by Host: skillbook.eu URL: https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.81.4.68 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS euporia.dnshigh.com Software Apache / Resource Hash `9f51647fa83cd430cb3fa98af1838d57779900663a1299e4f2cc89ba9d83adce` Request headers Referer https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 11:54:01 GMT last-modified Thu, 14 May 2020 21:25:40 GMT server Apache etag "32a055c-322-5a5a2569d7d00" content-type text/css status 200 accept-ranges bytes content-length 802
GET H2	200	jquery-3.2.1.slim.min.js Show response skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/js/	68 KB 69 KB	83ms 82ms	Script application/javascript	185.81.4.68 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/js/jquery-3.2.1.slim.min.js Requested by Host: skillbook.eu URL: https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.81.4.68 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS euporia.dnshigh.com Software Apache / Resource Hash `91a04a5dfe501d54af8a59b942495bd7ab26bb811ab34f460115fc0267f825f1` Request headers Referer https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 11:54:01 GMT last-modified Fri, 01 May 2020 14:31:18 GMT server Apache etag "32a2887-10fdc-5a49708c99980" content-type application/javascript status 200 accept-ranges bytes content-length 69596
GET H2	200	bootstrap.min.js Show response skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/js/	48 KB 48 KB	83ms 82ms	Script application/javascript	185.81.4.68 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Full URL https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/js/bootstrap.min.js Requested by Host: skillbook.eu URL: https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.81.4.68 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS euporia.dnshigh.com Software Apache / Resource Hash `e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b` Request headers Referer https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 11:54:01 GMT last-modified Fri, 01 May 2020 14:31:24 GMT server Apache etag "32a1c43-bf30-5a49709252700" content-type application/javascript status 200 accept-ranges bytes content-length 48944
GET H2	200	backgrd.png skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/hmm/	810 KB 816 KB	82ms 81ms	Image image/png	185.81.4.68 SERVERPLAN-AS
General Check archive.org Show headers Download Go to Show image Full URL https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/hmm/backgrd.png Requested by Host: skillbook.eu URL: https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 185.81.4.68 Rome, Italy, ASN52030 (SERVERPLAN-AS, IT), Reverse DNS euporia.dnshigh.com Software Apache / Resource Hash `a30d676d5acc7fda0731bf303702f835b002253e12328254da85f286784fad68` Request headers Referer https://skillbook.eu/data/%CE%B1%CF%81%CF%87%CE%B5%CE%AF%CF%89%CE%BD/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 16 Sep 2020 11:54:01 GMT last-modified Sun, 10 Feb 2019 14:13:34 GMT server Apache etag "32a05ff-ca910-5818acc24ff80" content-type image/png status 200 accept-ranges bytes content-length 829712

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

skillbook.eu
185.81.4.68
208.71.141.135
3ccb3dd3497c7f281f7b6218903f6626605675299433967bb9884c0bd8df15f0
779e542766b327fd348e07a884a201cf4b1f1903f0beddaf0dcafcb178070534
91a04a5dfe501d54af8a59b942495bd7ab26bb811ab34f460115fc0267f825f1
9f51647fa83cd430cb3fa98af1838d57779900663a1299e4f2cc89ba9d83adce
a30d676d5acc7fda0731bf303702f835b002253e12328254da85f286784fad68
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
e97eeaff12e2bc13faea2155e33f58ba434d337bdbf63ee9d65addaf88b02c6c