Submitted URL: https://babkin.in.net/mu1/z/?837898346389478390478346&IK=ZeuS&zeus=kimberly.hamby@staples.com
Effective URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Submission: On February 11 via manual from US

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions.
The main IP is 87.121.52.162, located in Bulgaria and belongs to NETERRA-AS, BG. The main domain is babkin.in.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 11th 2019. Valid for: 3 months.
This is the first time this domain was scanned on urlscan.io!

Verdict: Malicious (Score: 100/100) Show Details

  • urlscan - Score: 100
    phishing
    Phishing against Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 9 87.121.52.162 34224 (NETERRA-AS)
7 1
Domain
Subdomains
Transfer
9 babkin.in.net
398 KB
7 1
Domain Requested by
9 babkin.in.net 2 redirects babkin.in.net
7 1

This site contains links to these domains. Also see Links.

Domain
Subject / Issuer Validity Valid
babkin.in.net
Let's Encrypt Authority X3
2019-02-11 -
2019-05-12
3 months

Screenshot


Detected technologies

Web
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i


Stats

0
Requests

0
Ad-blocked

0
Malicious

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

0
IPs

0
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&c...
/mu1/z
Redirect Chain
  • https://babkin.in.net/mu1/z/?837898346389478390478346&IK=ZeuS&zeus=kimberly.hamby@staples.com
  • https://babkin.in.net/mu1/z/page?zeus=kimberly.hamby@staples.com&IK=ZeuS
  • https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE0035...
25 KB
25 KB
Document
General
Full URL
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
957bc4d25a2a14d35f0f51827749d7b5f1acb347c2e04a6320316379da147cdf

Request headers

Host
babkin.in.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate, br
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Server
Apache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Server
Apache
Content-Location
page.php
Vary
negotiate
TCN
choice
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Set-Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0; path=/
Location
7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&#kimberly.hamby@staples.com
Content-Length
0
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
a.jpg
/mu1/z/images
298 KB
299 KB
Image
General
Full URL
https://babkin.in.net/mu1/z/images/a.jpg
Requested by
Host: babkin.in.net
URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
1edcd05875cef83d4716b936a6aaa4ee53867d48442398b40761c052de222473

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
babkin.in.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Last-Modified
Mon, 11 Feb 2019 13:31:03 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
305495
e.png
/mu1/z/images
7 KB
7 KB
Image
General
Full URL
https://babkin.in.net/mu1/z/images/e.png
Requested by
Host: babkin.in.net
URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
7ac950770b1c881c4aad5480716b07f8df3ac23b26b67cc21ab9a1cecb3f2e6d

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
babkin.in.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Last-Modified
Mon, 11 Feb 2019 13:31:03 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
7425
arrow_left.svg
/mu1/z/images
513 B
759 B
Image
General
Full URL
https://babkin.in.net/mu1/z/images/arrow_left.svg
Requested by
Host: babkin.in.net
URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
babkin.in.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Last-Modified
Mon, 11 Feb 2019 13:31:03 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
513
d.png
/mu1/z/images
64 KB
64 KB
Image
General
Full URL
https://babkin.in.net/mu1/z/images/d.png
Requested by
Host: babkin.in.net
URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
3adc882b96fd56ecdad93aff3a0128c8c501d4622bd6da9f7e0af76d6e6a9720

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
babkin.in.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Last-Modified
Mon, 11 Feb 2019 13:31:03 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
65061
h.png
/mu1/z/images
581 B
823 B
Image
General
Full URL
https://babkin.in.net/mu1/z/images/h.png
Requested by
Host: babkin.in.net
URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
c95bce7991158e4e708dc8f4a24d22535149ac7e3f64aac111a29f835d774856

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
babkin.in.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Last-Modified
Mon, 11 Feb 2019 13:31:03 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
581
g.png
/mu1/z/images
421 B
663 B
Image
General
Full URL
https://babkin.in.net/mu1/z/images/g.png
Requested by
Host: babkin.in.net
URL: https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
87.121.52.162 , Bulgaria, ASN34224 (NETERRA-AS, BG),
Reverse DNS
Software
Apache /
Resource Hash
2d9d19db9abfb22d6eda1ec55117485d766dc957520c0d9ae2694469306d7f55

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, br
Host
babkin.in.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
Cookie
PHPSESSID=75l8lvsk0c8u5tnn02q64qnfm0
Connection
keep-alive
Cache-Control
no-cache
Referer
https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE00359BCE74FF48C6077B&mkt=en-us&cbcxt=mai&
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 11 Feb 2019 16:44:20 GMT
Last-Modified
Mon, 11 Feb 2019 13:31:03 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
421

Redirect requests

There were HTTP redirects (301, 302) for the following requests:

Request 0
  • https://babkin.in.net/mu1/z/?837898346389478390478346&IK=ZeuS&zeus=kimberly.hamby@staples.com
  • https://babkin.in.net/mu1/z/page?zeus=kimberly.hamby@staples.com&IK=ZeuS
  • https://babkin.in.net/mu1/z/7xaz0z0msbu4vnlbsch97zeb.php?wa=wsignin1.0&rpsnv=13&ct=115146908&rver=468e98d309ce00359bce74ff48c6077b&wp=MBI_SSL_SHARED&wreply=inbox&lc=1024&IK=ZeuS&id=468E98D309CE0035...

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan - Score: 100

Categories:
phishing

Tags:
phishing

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| unhideBody string| s string| m string| hash

1 Cookies

Domain/Path Name / Value
babkin.in.net/ Name: PHPSESSID
Value: 75l8lvsk0c8u5tnn02q64qnfm0