bnbflash.com Open in urlscan Pro
169.59.0.130  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://skewechoes.com/zpending/index%20original.php?email=export@kapugems.com Page URL
2. https://bnbflash.com/home/aus/aus/mail.php?email=export@kapugems.com Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	index%20original.php Show response skewechoes.com/zpending/	128 B 349 B	1252ms 284ms	Document text/html	89.32.250.164 NETMIHAN
General Check archive.org Show headers Download Go to Full URL http://skewechoes.com/zpending/index%20original.php?email=export@kapugems.com Protocol HTTP/1.1 Server 89.32.250.164 Geneva, Switzerland, ASN204213 (NETMIHAN, IR), Reverse DNS mailirserver12.mylittledatacenter.com Software LiteSpeed / Resource Hash f4ca29340e205ea2f86b3bf60df5d91f49e39e99a55156f7daa3122cd0831491 Request headers Host skewechoes.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type text/html; charset=UTF-8 Content-Length 125 Content-Encoding gzip Vary Accept-Encoding Date Sat, 21 Sep 2019 09:00:22 GMT Accept-Ranges bytes Server LiteSpeed Connection close
GET H2	200	Primary Request mail.php Show response bnbflash.com/home/aus/aus/	6 KB 2 KB	423ms 135ms	Document text/html	169.59.0.130 SoftLayer Technol...
General Check archive.org Show headers Download Go to Full URL https://bnbflash.com/home/aus/aus/mail.php?email=export@kapugems.com Requested by Host: skewechoes.com URL: http://skewechoes.com/zpending/index%20original.php?email=export@kapugems.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 169.59.0.130 , United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US), Reverse DNS hs2.name.com Software Apache / Resource Hash 1297ad9a4511c514ce2767d24960290666e504c31ecc15ee74b987e44a0e3f20 Request headers :method GET :authority bnbflash.com :scheme https :path /home/aus/aus/mail.php?email=export@kapugems.com pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer http://skewechoes.com/zpending/index%20original.php?email=export@kapugems.com accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Referer http://skewechoes.com/zpending/index%20original.php?email=export@kapugems.com Response headers status 200 date Sat, 21 Sep 2019 09:00:24 GMT server Apache content-encoding gzip vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8
GET H/1.1	400 Bad Request	favicons www.google.com/s2/	0 0	42ms 41ms	Image text/html	2a00:1450:4001:818::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL http://www.google.com/s2/favicons?domain= Requested by Host: bnbflash.com URL: https://bnbflash.com/home/aus/aus/mail.php?email=export@kapugems.com Protocol HTTP/1.1 Server 2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	23ms 7ms	Script application/javascript	2001:4de0:ac18::1:a:1b Highwinds Network...
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: bnbflash.com URL: https://bnbflash.com/home/aus/aus/mail.php?email=export@kapugems.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US), Reverse DNS Software nginx / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Request headers Sec-Fetch-Mode no-cors Referer https://bnbflash.com/home/aus/aus/mail.php?email=export@kapugems.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sat, 21 Sep 2019 09:00:24 GMT Content-Encoding gzip Last-Modified Mon, 20 Mar 2017 19:01:15 GMT Server nginx ETag W/"58d026fb-15283" Vary Accept-Encoding X-HW 1569056424.dop023.fr8.shc,1569056424.dop023.fr8.t,1569056424.cds133.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 30125

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery string| strMainDomain string| strPageIcon number| intSubmit string| strFirstPassword function| getParameterByName function| submitPassword string| $strEmail

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bnbflash.com
code.jquery.com
skewechoes.com
www.google.com
169.59.0.130
2001:4de0:ac18::1:a:1b
2a00:1450:4001:818::2004
89.32.250.164
1297ad9a4511c514ce2767d24960290666e504c31ecc15ee74b987e44a0e3f20
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f4ca29340e205ea2f86b3bf60df5d91f49e39e99a55156f7daa3122cd0831491