europeec.pro - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2a06:6440:0:2d1a::1, located in Ukraine and belongs to UKRAINE-AS, UA. The main domain is europeec.pro.

This is the only time europeec.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	2a06:6440:0:2... 2a06:6440:0:2d1a::1	200000 (UKRAINE-AS) (UKRAINE-AS)
1	209.17.68.209 209.17.68.209	14173 (PHOTOBUCKET) (PHOTOBUCKET - PHOTOBUCKET.COM)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
5	3

3 2a06:6440:0:2d1a::1 (Ukraine)

ASN200000 (UKRAINE-AS, UA)

europeec.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.17.68.209 (United States)

ASN14173 (PHOTOBUCKET - PHOTOBUCKET.COM, INC., US)

i63.tinypic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	europeec.pro europeec.pro	3 KB
1	msauth.net aadcdn.msauth.net	278 KB
1	tinypic.com i63.tinypic.com	3 KB
5	3

	Domain	Requested by
3	europeec.pro	europeec.pro
1	aadcdn.msauth.net	europeec.pro
1	i63.tinypic.com	europeec.pro
5	3

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
aadcdn.msauth.net Microsoft IT TLS CA 4	`2018-11-07` - `2020-11-07`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://europeec.pro/wp-admin/includes/outlook.office.com/index.html
Frame ID: 9D74B8D93CF438D1126F3C294FB4C049
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

5
Requests

20 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

283 kB
Transfer

287 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response europeec.pro/wp-admin/includes/outlook.office.com/	8 KB 3 KB	149ms 60ms	Document text/html	2a06:6440:0:2d1a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL http://europeec.pro/wp-admin/includes/outlook.office.com/index.html Protocol HTTP/1.1 Server 2a06:6440:0:2d1a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `cd526892bbc03dcf6eb2aa6baa8ccb1b97b86db4fb03edfeadad4b4b6deab0ee` Request headers Host europeec.pro Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server nginx Date Tue, 16 Jul 2019 05:10:16 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Last-Modified Fri, 10 May 2019 04:32:22 GMT ETag W/"5cd4fed6-1ed6" Content-Encoding gzip
GET H/1.1	404 Not Found	style.css europeec.pro/wp-admin/includes/outlook.office.com/	0 0	727ms 726ms	Stylesheet text/html	2a06:6440:0:2d1a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL http://europeec.pro/wp-admin/includes/outlook.office.com/style.css Requested by Host: europeec.pro URL: http://europeec.pro/wp-admin/includes/outlook.office.com/index.html Protocol HTTP/1.1 Security , , Server 2a06:6440:0:2d1a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash Request headers Referer http://europeec.pro/wp-admin/includes/outlook.office.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 16 Jul 2019 05:10:16 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding,Cookie Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection keep-alive Link <http://europeec.pro/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	jquery.js europeec.pro/wp-admin/includes/outlook.office.com/js/	0 0	815ms 746ms	Script text/html	2a06:6440:0:2d1a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL http://europeec.pro/wp-admin/includes/outlook.office.com/js/jquery.js Requested by Host: europeec.pro URL: http://europeec.pro/wp-admin/includes/outlook.office.com/index.html Protocol HTTP/1.1 Security , , Server 2a06:6440:0:2d1a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash Request headers Referer http://europeec.pro/wp-admin/includes/outlook.office.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Tue, 16 Jul 2019 05:10:16 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding,Cookie Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection keep-alive Link <http://europeec.pro/wp-json/>; rel="https://api.w.org/" Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	104n6mx.jpg i63.tinypic.com/	3 KB 3 KB	3537ms 136ms	Image image/jpeg	209.17.68.209 PHOTOBUCKET.COM
General Check archive.org Show headers Download Go to Show image Full URL http://i63.tinypic.com/104n6mx.jpg Requested by Host: europeec.pro URL: http://europeec.pro/wp-admin/includes/outlook.office.com/index.html Protocol HTTP/1.1 Security , , Server 209.17.68.209 , United States, ASN14173 (PHOTOBUCKET - PHOTOBUCKET.COM, INC., US), Reverse DNS Software Apache / Resource Hash `bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164` Request headers Referer http://europeec.pro/wp-admin/includes/outlook.office.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 16 Jul 2019 05:07:56 GMT Via 1.1 varnish Last-Modified Tue, 22 Jan 2019 13:05:02 GMT Server Apache Age 3072 X-Varnish-Server den2tpv64 ETag "aed-5800ba019096b" X-Cache HIT Content-Type image/jpeg Cache-Control max-age=21600 X-Varnish 1173695833 1172290641 Connection keep-alive Accept-Ranges bytes Content-Length 2797 Expires Tue, 16 Jul 2019 10:16:43 GMT
GET H2	200	0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg aadcdn.msauth.net/ests/2.1/content/images/backgrounds/	277 KB 278 KB	167ms 16ms	Image image/jpeg	2620:1ec:bdf::10 Microsoft Corpora...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/0_a5dbd4393ff6a725c7e62b61df7e72f0.jpg Requested by Host: europeec.pro URL: http://europeec.pro/wp-admin/includes/outlook.office.com/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash `211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb` Request headers Referer http://europeec.pro/wp-admin/includes/outlook.office.com/index.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 16 Jul 2019 05:07:53 GMT x-azure-ref-originshield 0IcwpXQAAAACinkZp8oJQRqnj7iwBBiKlQU1TRURHRTA2MTkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-md5 pdvUOT/2pyXH5ith335y8A== x-cache TCP_HIT status 200 content-length 283351 x-ms-lease-status unlocked last-modified Fri, 02 Nov 2018 20:26:29 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D6410178E329F6 x-azure-ref 0qVstXQAAAAD1VpRqk8RLTqHN0p+vc9wtVklFRURHRTAyMjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/jpeg access-control-allow-origin * x-ms-request-id 1a72cb31-f01e-0040-11ae-37e462000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=604800 x-ms-version 2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			europeec.pro/	1969-12-31 23:59:59	Name: PHPSESSID Value: b04kgdd17dqiebm7fu23cdenj4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
europeec.pro
i63.tinypic.com
209.17.68.209
2620:1ec:bdf::10
2a06:6440:0:2d1a::1
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
cd526892bbc03dcf6eb2aa6baa8ccb1b97b86db4fb03edfeadad4b4b6deab0ee

europeec.pro Open in urlscan Pro 2a06:6440:0:2d1a::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

20 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

283 kBTransfer

287 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

europeec.pro Open in urlscan Pro
2a06:6440:0:2d1a::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

283 kB
Transfer

287 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!