portaal.taxshelter.caviarcontent.com Open in urlscan Pro
185.37.11.151  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.htm Show response portaal.taxshelter.caviarcontent.com/misc/pdf/view/	1 MB 1 MB	26ms 14ms	Document text/html	185.37.11.151 CAVIAR-NETWORK
General Check archive.org Show headers Download Go to Full URL http://portaal.taxshelter.caviarcontent.com/misc/pdf/view/index.htm Protocol HTTP/1.1 Server 185.37.11.151 , Belgium, ASN200099 (CAVIAR-NETWORK, BE), Reverse DNS preggyornot.com Software nginx / PleskLin Resource Hash a4c7bffa57dee4264b9dd52f1635a6c9f3da29fca1d523748ed9fba0125226a4 Request headers Host portaal.taxshelter.caviarcontent.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id 4BCBA67AB8AB66EB911693CA5FBA096D Response headers Server nginx Date Thu, 24 May 2018 13:50:51 GMT Content-Type text/html Content-Length 1378258 Last-Modified Wed, 16 May 2018 10:29:02 GMT Connection keep-alive Cache-Control max-age=1209600 Expires Thu, 07 Jun 2018 13:50:51 GMT ETag "5afc07ee-1507d2" X-Powered-By PleskLin Accept-Ranges bytes
GET H/1.1	200 OK	default.css portaal.taxshelter.caviarcontent.com/misc/pdf/view/jk/	23 KB 23 KB	26ms 13ms	Stylesheet text/css	185.37.11.151 CAVIAR-NETWORK
General Check archive.org Show headers Download Go to Full URL http://portaal.taxshelter.caviarcontent.com/misc/pdf/view/jk/default.css Requested by Host: portaal.taxshelter.caviarcontent.com URL: http://portaal.taxshelter.caviarcontent.com/misc/pdf/view/index.htm Protocol HTTP/1.1 Server 185.37.11.151 , Belgium, ASN200099 (CAVIAR-NETWORK, BE), Reverse DNS preggyornot.com Software nginx / PleskLin Resource Hash c6fd1e1fe5693af23aee9d3ac556f5945e2e5a5c6bd5b2546772c2a45d402b11 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host portaal.taxshelter.caviarcontent.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://portaal.taxshelter.caviarcontent.com/misc/pdf/view/index.htm Connection keep-alive Cache-Control no-cache Referer http://portaal.taxshelter.caviarcontent.com/misc/pdf/view/index.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 24 May 2018 13:50:51 GMT ETag "58b80672-5a83" Last-Modified Thu, 02 Mar 2017 11:48:02 GMT Server nginx X-Powered-By PleskLin Content-Type text/css Cache-Control max-age=1209600 Connection keep-alive Accept-Ranges bytes Content-Length 23171 Expires Thu, 07 Jun 2018 13:50:51 GMT
GET DATA	200 OK	truncated /	866 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash af2f21e45d03ba202dfe5265fe9ef4d1219e9f0528a131b8ccab835475bb2121 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	69 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6236cf0cc3cf6981172f22942dad3001ebf7906e8e0740447c360d2d94db0799 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 65a5e27b5bc2dea7a5015391f91a811ac67bf343fc0b5606b376fcc989511414 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET		request cfs.uzone.id/2fn7a2/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cfs.uzone.id

URL

http://cfs.uzone.id/2fn7a2/request?id=1&enc=9UwkxLgY9&params=4TtHaUQnUEiP6K%2fc5C582CL4NjpNgssK2EKU7fejxSXf3Xvq50rclpTIwX%2f4%2bYrGlJZeXb29uUCg1x468a9tav470n5BU2%2fb6ruJuHP%2bAcGBtbaf76F12k6L4x5lhTULs65Jdfi8lTRHvur7niiopaHJ2h72wZGWyQLTahEs4iOk7%2fpTPbgTkOdm%2fri8V8qAiC095brQDrrutGy4RRVYKCBv8P0ELCDv4AeziGI3m5J%2bI5MInDvAbK3f0PX5ygibuSZ9d%2bGHQACT03UlOSE4cwLJWcc7%2fSzAxwmGaQ4KKzUs%2fWjFoeYjGRtS2ALXUj6MW0HwvLTCr0ioY%2b%2bUHOdCgLLHC%2b2rJJ5OwmmOBdv%2bMVjncSelfJmecy916nJ%2fq51QhhXLpZnw38rNU2zPQN23gjSIrbWi2SPvTr2ctKeuzCCGgsp8W4obJcaYh77UmD3fAVowhiqWh%2b3lFY9RU%2btvTcRU9osltXZBmTLohPyOqX2TtT2C8GJ%2buheVvuNU78tHO3tHtD5doRl8ptw%2bhuHM6r1D0gcYbdw2vPlYSB8HU9o%3d&idc_r=47551438629&domain=portaal.taxshelter.caviarcontent.com&sw=1600&sh=1200

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getParm function| validateForm function| netbro_cache_analytics function| sync function| requestCfs object| EmailField

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cfs.uzone.id
portaal.taxshelter.caviarcontent.com
cfs.uzone.id
185.37.11.151
6236cf0cc3cf6981172f22942dad3001ebf7906e8e0740447c360d2d94db0799
65a5e27b5bc2dea7a5015391f91a811ac67bf343fc0b5606b376fcc989511414
a4c7bffa57dee4264b9dd52f1635a6c9f3da29fca1d523748ed9fba0125226a4
af2f21e45d03ba202dfe5265fe9ef4d1219e9f0528a131b8ccab835475bb2121
c6fd1e1fe5693af23aee9d3ac556f5945e2e5a5c6bd5b2546772c2a45d402b11