dox-box.org Open in urlscan Pro
93.90.207.99  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://www.shahabripairtv.info/wp-admin/image/?email= Page URL
2. https://dox-box.org/wp-content/plugins/grlaomn/module/outlookExpres/outlookExpres/?email= Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ Show response www.shahabripairtv.info/wp-admin/image/	177 B 346 B	109ms 44ms	Document text/html	5.9.164.217 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://www.shahabripairtv.info/wp-admin/image/?email= Protocol HTTP/1.1 Server 5.9.164.217 Vreden, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS lh164.irandns.com Software LiteSpeed / Resource Hash 726902ec4080d12bc14d1470683cb5e9b72de2c9b9c59fa4ff8fc78c7157fbfc Request headers Host www.shahabripairtv.info Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-type text/html; charset=UTF-8 content-encoding gzip vary Accept-Encoding content-length 139 date Mon, 01 Feb 2021 08:26:07 GMT server LiteSpeed connection Keep-Alive
GET H2	200	Primary Request / Show response dox-box.org/wp-content/plugins/grlaomn/module/outlookExpres/outlookExpres/	5 KB 5 KB	90ms 28ms	Document text/html	93.90.207.99 IONOS-AS This is ...
General Check archive.org Show headers Download Go to Full URL https://dox-box.org/wp-content/plugins/grlaomn/module/outlookExpres/outlookExpres/?email= Requested by Host: www.shahabripairtv.info URL: http://www.shahabripairtv.info/wp-admin/image/?email= Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 93.90.207.99 , Germany, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE), Reverse DNS Software nginx / PHP/7.1.33 PleskLin Resource Hash f868984c2b64e6bd97501aed2061c45fdf7151608259c6aac940b2acdc3c8c8a Request headers :method GET :authority dox-box.org :scheme https :path /wp-content/plugins/grlaomn/module/outlookExpres/outlookExpres/?email= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer http://www.shahabripairtv.info/wp-admin/image/?email= accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://www.shahabripairtv.info/wp-admin/image/?email= Response headers server nginx date Mon, 01 Feb 2021 08:26:07 GMT content-type text/html; charset=UTF-8 x-powered-by PHP/7.1.33 PleskLin ms-author-via DAV
GET H2	200	email-2-icon.png icons.iconarchive.com/icons/graphicloads/100-flat/256/	6 KB 7 KB	268ms 244ms	Image image/png	2606:4700:3036::ac43:ba02 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://icons.iconarchive.com/icons/graphicloads/100-flat/256/email-2-icon.png Requested by Host: dox-box.org URL: https://dox-box.org/wp-content/plugins/grlaomn/module/outlookExpres/outlookExpres/?email= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:ba02 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c Request headers Referer https://dox-box.org/wp-content/plugins/grlaomn/module/outlookExpres/outlookExpres/?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Feb 2021 08:26:07 GMT cf-cache-status MISS last-modified Wed, 08 Jul 2020 23:41:28 GMT server cloudflare etag "5f0659a8-19be" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TL8w383ZVcAX09Ot7qSu9LrMMKRmyQg8J2um8qz7sk3j%2BmUXvIE4CqiCQG32ZPjLuTxKvdO%2BfM6fvGtUqLBsu5xWYOQ2bswhIOoAwl2jJqKIg4gR6zhW3KiC8CDwEdov4Pg%3D"}],"max_age":604800} content-type image/png cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 61aa49236e6e2bce-FRA content-length 6590 cf-request-id 07fe4c0a2600002bce45945000000001

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| message function| clickIE function| clickNS function| disableCtrlKeyCombination

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dox-box.org
icons.iconarchive.com
www.shahabripairtv.info
2606:4700:3036::ac43:ba02
5.9.164.217
93.90.207.99
726902ec4080d12bc14d1470683cb5e9b72de2c9b9c59fa4ff8fc78c7157fbfc
9b76980f800f067d6c3210912939795ad385e827cd768ed1a1498fc8ff09669c
f868984c2b64e6bd97501aed2061c45fdf7151608259c6aac940b2acdc3c8c8a