urlscan.io logo urlscan.io
SecurityTrails logo

download28.ir Open in urlscan Pro
176.9.84.212  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://download28.ir/01/
Submission: On June 26 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 176.9.84.212, located in Germany and belongs to HETZNER-AS, DE. The main domain is download28.ir.
This is the only time download28.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banco Safra Limited (Banking)

Domain & IP information

IP Address AS Autonomous System
12 176.9.84.212 24940 (HETZNER-AS)
1 205.185.208.52 20446 (HIGHWINDS3)
13 2
Apex Domain
Subdomains		 Transfer
12 download28.ir
download28.ir
2 MB
1 jquery.com
code.jquery.com
33 KB
13 2
Domain Requested by
12 download28.ir download28.ir
code.jquery.com
1 code.jquery.com download28.ir
13 2

This site contains no links.

Subject Issuer Validity Valid

1970-01-01 -
1970-01-01		 a few seconds crt.sh
jquery.org
COMODO RSA Domain Validation Secure Server CA		 2018-10-17 -
2020-10-16		 2 years crt.sh

This page contains 1 frames:

Primary Page: http://download28.ir/01/
Frame ID: AFE6FB2B86EE3CFBA0F69900DD3F3291
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

8 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1993 kB
Transfer

2069 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
download28.ir/01/ 		8 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://download28.ir/01/
Protocol
HTTP/1.1
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
60431ad0b48e8105326dd890ca379d3db166bd0d961d28c59574d0bb705eb4d5

Request headers

Host
download28.ir
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Last-Modified
Tue, 18 Jun 2019 17:54:44 GMT
Content-Type
text/html
Content-Length
2877
Accept-Ranges
bytes
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Wed, 26 Jun 2019 16:22:06 GMT
Server
LiteSpeed
Connection
Keep-Alive
layout.css
download28.ir/01/wp-admin/ 		16 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://download28.ir/01/wp-admin/layout.css
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
bcb6329339a79cc47915a8097b28a5550c103b441ce55512a12bdc1f17a1afd9

Request headers

Referer
http://download28.ir/01/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 26 Jun 2019 16:22:06 GMT
Content-Encoding
gzip
Last-Modified
Wed, 26 Jun 2019 15:33:30 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
3617
Expires
Wed, 03 Jul 2019 16:22:06 GMT
menu.png
download28.ir/01/IMAGENS/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download28.ir/01/IMAGENS/menu.png
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
0cbe397145f910b72e073a9439cefbc4db7377c5e5c5df0a98a55696f5c2b6bb

Request headers

Referer
http://download28.ir/01/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Jun 2019 16:22:06 GMT
Content-Encoding
gzip
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<http://download28.ir/wp-json/>; rel="https://api.w.org/"
Content-Length
741
Expires
Wed, 11 Jan 1984 05:00:00 GMT
carregando.gif
download28.ir/01/IMAGENS/ 		76 KB
77 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download28.ir/01/IMAGENS/carregando.gif
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
64fc70946c3b3c1ef4167244251fbdebec1bc54c2b3aded647e6d0821a66bcc3

Request headers

Referer
http://download28.ir/01/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 26 Jun 2019 16:22:06 GMT
Last-Modified
Tue, 13 Mar 2018 21:50:50 GMT
Server
LiteSpeed
Content-Type
image/gif
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
78164
Expires
Wed, 03 Jul 2019 16:22:06 GMT
jquery-1.12.4.min.js
code.jquery.com/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.12.4.min.js
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
vip052.ssl.hwcdn.net
Software
nginx /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://download28.ir/01/
Origin
http://download28.ir

Response headers

Date
Wed, 26 Jun 2019 16:22:06 GMT
Content-Encoding
gzip
Last-Modified
Fri, 20 May 2016 17:18:54 GMT
Server
nginx
ETag
W/"573f46fe-17b8b"
Vary
Accept-Encoding
X-HW
1561566126.dop002.fr8.t,1561566126.cds020.fr8.shn,1561566126.cds020.fr8.c
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000, public
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
33738
safra.png
download28.ir/01/IMAGENS/ 		988 KB
988 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download28.ir/01/IMAGENS/safra.png
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
2886dd5a59bbcab81f5e02aa8849ff981c7ce441c2aff7f0bdcce2cb8055b879

Request headers

Referer
http://download28.ir/01/wp-admin/layout.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 26 Jun 2019 16:22:07 GMT
Last-Modified
Tue, 18 Jun 2019 17:50:54 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1011222
Expires
Wed, 03 Jul 2019 16:22:07 GMT
Parte2.png
download28.ir/01/IMAGENS/ 		736 KB
737 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download28.ir/01/IMAGENS/Parte2.png
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
0a4508a571bd3ffb1634dd58c4af9f129bea56468186a18e108a5c5689fdd266

Request headers

Referer
http://download28.ir/01/wp-admin/layout.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 26 Jun 2019 16:22:07 GMT
Last-Modified
Tue, 18 Jun 2019 17:48:36 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
754141
Expires
Wed, 03 Jul 2019 16:22:07 GMT
Parte3.png
download28.ir/01/IMAGENS/ 		147 KB
148 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download28.ir/01/IMAGENS/Parte3.png
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
1f16b9d37be376a097d429c3ef57a1acc40d22846ae7af2d8f5df748dbbc65e0

Request headers

Referer
http://download28.ir/01/wp-admin/layout.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 26 Jun 2019 16:22:07 GMT
Last-Modified
Tue, 18 Jun 2019 17:52:22 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
150775
Expires
Wed, 03 Jul 2019 16:22:07 GMT
Inicial.png
download28.ir/01/IMAGENS/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://download28.ir/01/IMAGENS/Inicial.png
Requested by
Host: download28.ir
URL: http://download28.ir/01/
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
0cbe397145f910b72e073a9439cefbc4db7377c5e5c5df0a98a55696f5c2b6bb

Request headers

Referer
http://download28.ir/01/wp-admin/layout.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Jun 2019 16:22:07 GMT
Content-Encoding
gzip
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Cache-Control
no-cache, must-revalidate, max-age=0
Connection
Keep-Alive
Link
<http://download28.ir/wp-json/>; rel="https://api.w.org/"
Content-Length
741
Expires
Wed, 11 Jan 1984 05:00:00 GMT
wp-admin.php
download28.ir/01/wp-admin/ 		69 B
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://download28.ir/01/wp-admin/wp-admin.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.4.min.js
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
bd9ffb3e93ae7e538c1148cf835d6a8c51837974348fdb1215482f5dbe599604

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://download28.ir/01/
Origin
http://download28.ir
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Wed, 26 Jun 2019 16:22:07 GMT
Content-Encoding
gzip
Server
LiteSpeed
Connection
Keep-Alive
Content-Length
87
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
wp-admin.php
download28.ir/01/wp-admin/ 		69 B
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://download28.ir/01/wp-admin/wp-admin.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.4.min.js
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
bd9ffb3e93ae7e538c1148cf835d6a8c51837974348fdb1215482f5dbe599604

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://download28.ir/01/
Origin
http://download28.ir
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Wed, 26 Jun 2019 16:22:09 GMT
Content-Encoding
gzip
Server
LiteSpeed
Connection
Keep-Alive
Content-Length
87
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
wp-admin.php
download28.ir/01/wp-admin/ 		69 B
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://download28.ir/01/wp-admin/wp-admin.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.4.min.js
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
bd9ffb3e93ae7e538c1148cf835d6a8c51837974348fdb1215482f5dbe599604

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://download28.ir/01/
Origin
http://download28.ir
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Wed, 26 Jun 2019 16:22:12 GMT
Content-Encoding
gzip
Server
LiteSpeed
Connection
Keep-Alive
Content-Length
87
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
wp-admin.php
download28.ir/01/wp-admin/ 		69 B
293 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://download28.ir/01/wp-admin/wp-admin.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.12.4.min.js
Protocol
HTTP/1.1
Security
, ,
Server
176.9.84.212 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
hermes.r1host.com
Software
LiteSpeed /
Resource Hash
bd9ffb3e93ae7e538c1148cf835d6a8c51837974348fdb1215482f5dbe599604

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
http://download28.ir/01/
Origin
http://download28.ir
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Wed, 26 Jun 2019 16:22:15 GMT
Content-Encoding
gzip
Server
LiteSpeed
Connection
Keep-Alive
Content-Length
87
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banco Safra Limited (Banking)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| validate function| autotab function| $ function| jQuery string| oldtext function| enviar function| LimpaSenha function| senhaclick function| letclick function| ddfclick

1 Cookies

Domain/Path Name / Value
download28.ir/ Name: PHPSESSID
Value: 153uj4mnbl0ooa3984nv89bfb3