thebarracudagroup.com

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 208.75.151.42, located in Lansing, United States and belongs to LIQUID-WEB-INC - Liquid Web, L.L.C, US. The main domain is thebarracudagroup.com.

This is the only time thebarracudagroup.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alibaba (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	185.25.21.112 185.25.21.112	199081 (LANCOM At...) (LANCOM Athens - Greece)
5	208.75.151.42 208.75.151.42	32244 (LIQUID-WE...) (LIQUID-WEB-INC - Liquid Web)
5	1

1 185.25.21.112 (Greece) 1 redirects

ASN199081 (LANCOM Athens - Greece, GR)
PTR: linux.name-servers.gr

shop.nomikobiblio.gr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 208.75.151.42 (Lansing, United States)

ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US)
PTR: host.recruiterswebhosting.com

thebarracudagroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	thebarracudagroup.com thebarracudagroup.com	394 KB
1	nomikobiblio.gr 1 redirects shop.nomikobiblio.gr	414 B
5	2

	Domain	Requested by
5	thebarracudagroup.com	thebarracudagroup.com
1	shop.nomikobiblio.gr	1 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm
Frame ID: 9686.1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://shop.nomikobiblio.gr/includes/js/tabs/post1.php HTTP 302
http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

394 kB
Transfer

394 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://shop.nomikobiblio.gr/includes/js/tabs/post1.php HTTP 302
http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request loader1.htm Show response thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/ Redirect Chain http://shop.nomikobiblio.gr/includes/js/tabs/post1.php http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm	8 KB 8 KB	241ms 121ms	Document text/html	208.75.151.42 Liquid Web
General Check archive.org Show headers Download Go to Full URL http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Protocol HTTP/1.1 Server 208.75.151.42 Lansing, United States, ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US), Reverse DNS host.recruiterswebhosting.com Software Apache / Resource Hash `ed299ae203f8cdfb55edc47d5efcf68eae0c9dc177e1020ab7071e742f0a6bb8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Mon, 11 Sep 2017 08:52:53 GMT Last-Modified Thu, 07 Sep 2017 08:39:10 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=150 Content-Length 8316 Redirect headers Date Mon, 11 Sep 2017 08:52:53 GMT Content-Encoding gzip Server nginx X-Powered-By PleskLin Vary Accept-Encoding,User-Agent Content-Type text/html Location http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Cache-Control max-age=0, public Connection keep-alive Content-Length 20 Expires Mon, 11 Sep 2017 08:52:52 GMT
GET H/1.1	200 OK	img2.png thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/images/	327 KB 327 KB	121ms 121ms	Image image/png	208.75.151.42 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/images/img2.png Requested by Host: thebarracudagroup.com URL: http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Protocol HTTP/1.1 Server 208.75.151.42 Lansing, United States, ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US), Reverse DNS host.recruiterswebhosting.com Software Apache / Resource Hash `c3de8a20b257b3e3edadd946d59bbee31d90f6f84ed6e9619904669199c0461e` Request headers Referer http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Mon, 11 Sep 2017 08:52:53 GMT Last-Modified Tue, 12 Jan 2016 02:19:22 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=149 Content-Length 335152
GET H/1.1	200 OK	img4.gif thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/images/	59 KB 59 KB	227ms 114ms	Image image/gif	208.75.151.42 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/images/img4.gif Requested by Host: thebarracudagroup.com URL: http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Protocol HTTP/1.1 Server 208.75.151.42 Lansing, United States, ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US), Reverse DNS host.recruiterswebhosting.com Software Apache / Resource Hash `ccb0a1e8928cf8f65da688fed1ff262eb74844c136fb2f6ea57519c6a70d864f` Request headers Referer http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Mon, 11 Sep 2017 08:52:53 GMT Last-Modified Tue, 12 Jan 2016 02:19:42 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=150 Content-Length 59977
GET H/1.1	404 Not Found	point.gif thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/:abstract.simplenet.com/	209 B 0	1273ms 1145ms	Image text/html	208.75.151.42 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/:abstract.simplenet.com/point.gif Requested by Host: thebarracudagroup.com URL: http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Protocol HTTP/1.1 Server 208.75.151.42 Lansing, United States, ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US), Reverse DNS host.recruiterswebhosting.com Software Apache / Resource Hash `ca539663d38154f52da3d0020310d89b7f729808560fe6c656c15da0a6a24f99` Request headers Referer http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Mon, 11 Sep 2017 08:52:53 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://thebarracudagroup.com/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=150 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	point2.html thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/abstract.simplenet.com/	22 B 0	1291ms 1157ms	Image text/html	208.75.151.42 Liquid Web
General Check archive.org Show headers Download Go to Show image Full URL http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/abstract.simplenet.com/point2.html Requested by Host: thebarracudagroup.com URL: http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm Protocol HTTP/1.1 Server 208.75.151.42 Lansing, United States, ASN32244 (LIQUID-WEB-INC - Liquid Web, L.L.C, US), Reverse DNS host.recruiterswebhosting.com Software Apache / Resource Hash `af1c1dbf03e9c15a31849e4aee0cb27461ebf356cd5f71957a6819e545c5165c` Request headers Referer http://thebarracudagroup.com/wp-content/plugins/gravityforms/css/account/update/loader1.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Mon, 11 Sep 2017 08:52:53 GMT Server Apache Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection Keep-Alive Link <http://thebarracudagroup.com/wp-json/>; rel="https://api.w.org/" Keep-Alive timeout=5, max=150 Expires Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alibaba (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			thebarracudagroup.com/	1970-01-01 00:00:00	Name: PHPSESSID Value: vj3hgtqvjboiqm69nq6tbrhhm7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

shop.nomikobiblio.gr
thebarracudagroup.com
185.25.21.112
208.75.151.42
af1c1dbf03e9c15a31849e4aee0cb27461ebf356cd5f71957a6819e545c5165c
c3de8a20b257b3e3edadd946d59bbee31d90f6f84ed6e9619904669199c0461e
ca539663d38154f52da3d0020310d89b7f729808560fe6c656c15da0a6a24f99
ccb0a1e8928cf8f65da688fed1ff262eb74844c136fb2f6ea57519c6a70d864f
ed299ae203f8cdfb55edc47d5efcf68eae0c9dc177e1020ab7071e742f0a6bb8

thebarracudagroup.com Open in urlscan Pro 208.75.151.42 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

394 kBTransfer

394 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

thebarracudagroup.com Open in urlscan Pro
208.75.151.42 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

394 kB
Transfer

394 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!