www.wifebirthdaygiftideas.com Open in urlscan Pro
67.205.2.208 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel
Effective URL:
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&c...
Submission: On May 31 via manual (May 31st 2018, 9:32:44 pm UTC) from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 67.205.2.208, located in Brea, United States and belongs to DREAMHOST-AS - New Dream Network, LLC, US. The main domain is www.wifebirthdaygiftideas.com.

This is the only time www.wifebirthdaygiftideas.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 11	67.205.2.208 67.205.2.208	26347 (DREAMHOST-AS) (DREAMHOST-AS - New Dream Network)
1	134.249.116.78 134.249.116.78	15895 (KSNET-AS) (KSNET-AS)
1 1	199.193.73.36 199.193.73.36	27257 (WEBAIR-IN...) (WEBAIR-INTERNET - Webair Internet Development Company Inc.)
1	194.187.98.176 194.187.98.176	35415 (WEBZILLA) (WEBZILLA)
12	4

11 67.205.2.208 (Brea, United States) 1 redirects

ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US)
PTR: ps568273.dreamhost.com

www.wifebirthdaygiftideas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.249.116.78 (Lviv, Ukraine)

ASN15895 (KSNET-AS, UA)
PTR: 134-249-116-78.broadband.kyivstar.net

134.249.116.78	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.193.73.36 (Garden City, United States) 1 redirects

ASN27257 (WEBAIR-INTERNET - Webair Internet Development Company Inc., US)
PTR: signup.fencepandemic.com

www.hibids10.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.187.98.176 (Netherlands)

ASN35415 (WEBZILLA, NL)
PTR: 194.187.98.176.webazilla.com

bestadbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	wifebirthdaygiftideas.com 1 redirects www.wifebirthdaygiftideas.com	4 MB
1	bestadbid.com bestadbid.com
1	hibids10.com 1 redirects www.hibids10.com	552 B
12	3

	Domain	Requested by
11	www.wifebirthdaygiftideas.com	1 redirects www.wifebirthdaygiftideas.com
1	bestadbid.com	134.249.116.78
1	www.hibids10.com	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: 7E7021744303E66B5D11E4E45931162D
Requests: 6 HTTP requests in this frame

Frame: http://bestadbid.com/afu.php?zoneid=1462665&var=14212202
Frame ID: 04040EDA396FE1EF3E7087546CE5FF83
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel HTTP 301
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/ Page URL
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

3601 kB
Transfer

3621 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel HTTP 301
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/ Page URL
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel HTTP 301
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/

Request Chain 11

https://www.hibids10.com/watch?key=789a4129e78c00008a47b36e23d65ea7 HTTP 302
http://bestadbid.com/afu.php?zoneid=1462665&var=14212202

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Redirect Chain

http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel
http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/

429 B
560 B

97ms
96ms

Document
text/html

67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 7c1b63626b0c13f0a9d9afb11f46f985360ddd474b06baf1e9c7a09b6791cec9

Request headers

Host: www.wifebirthdaygiftideas.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 7E7021744303E66B5D11E4E45931162D

Response headers

Date: Thu, 31 May 2018 21:32:33 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 325
Keep-Alive: timeout=2, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Thu, 31 May 2018 21:32:33 GMT
Server: Apache
Location: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 225
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK loading.gif
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/ 4 KB
4 KB 95ms
95ms Image
image/gif 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/loading.gif
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:33 GMT
Last-Modified: Fri, 23 Jun 2017 16:43:58 GMT
Server: Apache
ETag: "e85-552a34ec16f80"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 3717

GET
H/1.1 200
OK lintex.png
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/ 119 KB
119 KB 184ms
92ms Image
image/png 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/lintex.png
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 642b823bfda63344a1342fbc28bc61fde43119e208b77bffe545d2d4f0518e85

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:33 GMT
Last-Modified: Fri, 23 Jun 2017 16:43:58 GMT
Server: Apache
ETag: "1da31-552a34ec16f80"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 121393

GET
H/1.1 200
OK Primary Request page.php Show response
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ 19 KB
5 KB 192ms
99ms Document
text/html 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: f98382cc66e651f91bcc85df3058682e81adac31c0f0a82f0b5358007a512e24

Request headers

Host: www.wifebirthdaygiftideas.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 7E7021744303E66B5D11E4E45931162D
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/

Response headers

Date: Thu, 31 May 2018 21:32:36 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4838
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK pobg.gif
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ 3 MB
3 MB 94ms
94ms Image
image/gif 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/pobg.gif
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: a210b28a6b1be655e3f077da0b9be0e2384cc4d0424add48d7690b8ef27f807a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:36 GMT
Last-Modified: Fri, 23 Jun 2017 16:44:02 GMT
Server: Apache
ETag: "361fc2-552a34efe7880"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 3547074

GET
H/1.1 200
OK login.php Show response
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ Frame 0404 5 KB
3 KB 184ms
93ms Document
text/html 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 2af291851b76f1da2a59991a4be137287c289c80d0180ef72953783a92a429c2

Request headers

Host: www.wifebirthdaygiftideas.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 7E7021744303E66B5D11E4E45931162D
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/page.php?email=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Response headers

Date: Thu, 31 May 2018 21:32:37 GMT
Server: Apache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2472
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ga.js Show response
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ Frame 0404 431 B
535 B 92ms
91ms Script
application/javascript 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ga.js
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 1ba5509373ed47e261ae5cd6e79147e710f0cd177ab1afaf95ed172caefb3035

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 31 May 2018 19:29:42 GMT
Server: Apache
ETag: "1af-56d857d3f7063"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 207

GET
H/1.1 200
OK jquery.js Show response
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ Frame 0404 431 B
535 B 182ms
91ms Script
application/javascript 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/jquery.js
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 1ba5509373ed47e261ae5cd6e79147e710f0cd177ab1afaf95ed172caefb3035

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 31 May 2018 19:29:42 GMT
Server: Apache
ETag: "1af-56d857d3f7063"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=98
Content-Length: 207

GET
H/1.1 200
OK jquery_popup.css
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ Frame 0404 2 KB
1 KB 181ms
91ms Stylesheet
text/css 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/jquery_popup.css
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: b1dbe2cdf1aff375b2420bd518650d07a6614455528e2f9400c99a74e4b57dc0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:37 GMT
Content-Encoding: gzip
Last-Modified: Fri, 23 Jun 2017 16:44:02 GMT
Server: Apache
ETag: "8b7-552a34efe7880"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 753

GET
H/1.1 200
OK jquery_popup.js Show response
www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/ Frame 0404 431 B
536 B 482ms
389ms Script
application/javascript 67.205.2.208
New Dream Network

General

Check archive.org

Show headers Download Go to

Full URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/jquery_popup.js
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Protocol: HTTP/1.1
Server: 67.205.2.208 Brea, United States, ASN26347 (DREAMHOST-AS - New Dream Network, LLC, US),
Reverse DNS: ps568273.dreamhost.com
Software: Apache /
Resource Hash: 1ba5509373ed47e261ae5cd6e79147e710f0cd177ab1afaf95ed172caefb3035

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.wifebirthdaygiftideas.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 31 May 2018 19:29:42 GMT
Server: Apache
ETag: "1af-56d857d3f7063"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 207

GET
H/1.1 200
OK jquery.js Show response
134.249.116.78/ Frame 0404 3 KB
3 KB 51ms
26ms Script
application/javascript 134.249.116.78
KSNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://134.249.116.78/jquery.js
Requested by: Host: www.wifebirthdaygiftideas.com
URL: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/jquery.js
Protocol: HTTP/1.1
Server: 134.249.116.78 Lviv, Ukraine, ASN15895 (KSNET-AS, UA),
Reverse DNS: 134-249-116-78.broadband.kyivstar.net
Software: Apache/2.4.28 (Win32) PHP/7.1.10 /
Resource Hash: 13a197869b5835f33ca9cc79a12b3cc4ae8cb373189d6dd101c74e2fc5a8075d

Request headers

Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 31 May 2018 21:32:34 GMT
Last-Modified: Tue, 10 Apr 2018 13:48:38 GMT
Server: Apache/2.4.28 (Win32) PHP/7.1.10
ETag: "c4d-5697ec78c2215"
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3149

GET
H/1.1

200
OK

Cookie set afu.php
bestadbid.com/ Frame 0404
Redirect Chain

https://www.hibids10.com/watch?key=789a4129e78c00008a47b36e23d65ea7
http://bestadbid.com/afu.php?zoneid=1462665&var=14212202

0
0

49ms
34ms

Document
text/html

194.187.98.176
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

http://bestadbid.com/afu.php?zoneid=1462665&var=14212202

Requested by

Host: 134.249.116.78
URL: http://134.249.116.78/jquery.js

Protocol

HTTP/1.1

Server

194.187.98.176 , Netherlands, ASN35415 (WEBZILLA, NL),

Reverse DNS

194.187.98.176.webazilla.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=1
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Host: bestadbid.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 7E7021744303E66B5D11E4E45931162D
Referer: http://www.wifebirthdaygiftideas.com/wp-content/plugins/ubh/Excel/PO/login.php?email=

Response headers

Server: nginx
Date: Thu, 31 May 2018 21:32:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Timing-Allow-Origin: * *
Pragma: no-cache
Cache-Control: private, max-age=0, no-cache
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: SeenToday=1; expires=Fri, 01-Jun-2018 21:32:37 GMT; Max-Age=86400; path=/ OAGEO9457f=13%7CDE%7CBY%7CGUNZENHAUSEN%7CBROADBAND%7CHETZNER+ONLINE+AG%7CHOSTING%7C10436%7C42476%7C%3F%7C276005; expires=Fri, 01-Jun-2018 21:32:37 GMT; Max-Age=86400; path=/ oaidts=1527802357; expires=Fri, 31-May-2019 21:32:37 GMT; Max-Age=31536000; path=/ OAID=e668397a0d2fc62eb8b41e3f1cbbb7f1; expires=Fri, 31-May-2019 21:32:37 GMT; Max-Age=31536000; path=/ OXVAR=14212202; expires=Fri, 01-Jun-2018 21:32:37 GMT; Max-Age=86400; path=/ OAID=e668397a0d2fc62eb8b41e3f1cbbb7f1; expires=Fri, 31-May-2019 21:32:37 GMT; Max-Age=31536000; path=/ exsdsf=1527802357 pbk3=41de039c2028f9432c448d35124c18c16561861159365419972; expires=Thu, 31-May-2018 21:42:37 GMT; Max-Age=600 ltm_afu=1; expires=Fri, 01-Jun-2018 21:32:37 GMT; Max-Age=86400; path=/
X-FRAME-OPTIONS: DENY
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Encoding: gzip
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff

Redirect headers

Server: nginx/1.12.1
Date: Thu, 31 May 2018 21:32:37 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: http://bestadbid.com/afu.php?zoneid=1462665&var=14212202
Set-Cookie: u_pl=14212202; expires=Fri, 01 Jun 2018 21:32:37 GMT backurled=14212202; expires=Thu, 31 May 2018 21:33:37 GMT
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=0; includeSubdomains

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| myVar function| myFunction function| showPage

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.wifebirthdaygiftideas.com/	1970-01-18 16:24:48	Name: csrf_uids Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bestadbid.com
www.hibids10.com
www.wifebirthdaygiftideas.com
134.249.116.78
194.187.98.176
199.193.73.36
67.205.2.208
13a197869b5835f33ca9cc79a12b3cc4ae8cb373189d6dd101c74e2fc5a8075d
1ba5509373ed47e261ae5cd6e79147e710f0cd177ab1afaf95ed172caefb3035
2af291851b76f1da2a59991a4be137287c289c80d0180ef72953783a92a429c2
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19
642b823bfda63344a1342fbc28bc61fde43119e208b77bffe545d2d4f0518e85
7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5
7c1b63626b0c13f0a9d9afb11f46f985360ddd474b06baf1e9c7a09b6791cec9
a210b28a6b1be655e3f077da0b9be0e2384cc4d0424add48d7690b8ef27f807a
b1dbe2cdf1aff375b2420bd518650d07a6614455528e2f9400c99a74e4b57dc0
f98382cc66e651f91bcc85df3058682e81adac31c0f0a82f0b5358007a512e24

www.wifebirthdaygiftideas.com Open in urlscan Pro 67.205.2.208 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

3601 kBTransfer

3621 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

www.wifebirthdaygiftideas.com Open in urlscan Pro
67.205.2.208 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

3601 kB
Transfer

3621 kB
Size

1
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!