myprimebags.com Open in urlscan Pro
216.194.165.27 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pocrovskiihram.ru/wp-admin/redirect1.php?email=64hongs@hanmail.net
Effective URL:
https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&i...
Submission: On April 10 via automatic, source openphish (April 10th 2020, 12:19:49 pm UTC)

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 216.194.165.27, located in El Segundo, United States and belongs to IMH-WEST, US. The main domain is myprimebags.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 5th 2020. Valid for: 3 months.

This is the only time myprimebags.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	46.254.21.28 46.254.21.28	203226 (IHCRU Int...) (IHCRU Internet-Hosting Ltd)
11	216.194.165.27 216.194.165.27	22611 (IMH-WEST) (IMH-WEST)
12	2

1 46.254.21.28 (Russian Federation)

ASN203226 (IHCRU Internet-Hosting Ltd, Moscow, Russia, RU)
PTR: cpanel3.ihc.ru

pocrovskiihram.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 216.194.165.27 (El Segundo, United States)

ASN22611 (IMH-WEST, US)
PTR: secure.bitace.in

myprimebags.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	myprimebags.com myprimebags.com	154 KB
1	pocrovskiihram.ru pocrovskiihram.ru	411 B
12	2

	Domain	Requested by
11	myprimebags.com	myprimebags.com
1	pocrovskiihram.ru
12	2

This site contains no links.

Subject Issuer	Validity	Valid
myprimebags.com cPanel, Inc. Certification Authority	`2020-03-05` - `2020-06-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: 2D265772B3A97E78231D50BB6B6FBBA3
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://pocrovskiihram.ru/wp-admin/redirect1.php?email=64hongs@hanmail.net Page URL
https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3v... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

155 kB
Transfer

327 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pocrovskiihram.ru/wp-admin/redirect1.php?email=64hongs@hanmail.net Page URL
https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK redirect1.php Show response
pocrovskiihram.ru/wp-admin/ 197 B
411 B 208ms
115ms Document
text/html 46.254.21.28
IHCRU Internet-Ho...

General

Check archive.org

Show headers Download Go to

Full URL: http://pocrovskiihram.ru/wp-admin/redirect1.php?email=64hongs@hanmail.net
Protocol: HTTP/1.1
Server: 46.254.21.28 , Russian Federation, ASN203226 (IHCRU Internet-Hosting Ltd, Moscow, Russia, RU),
Reverse DNS: cpanel3.ihc.ru
Software: LiteSpeed / PHP/7.3.16
Resource Hash: 6468f0d52f7d3870f6807b2e274de03bab4b93038bae729120dede1515227a4a

Request headers

Host: pocrovskiihram.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Connection: Keep-Alive
X-Powered-By: PHP/7.3.16
Content-Type: text/html; charset=UTF-8
Content-Length: 178
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Fri, 10 Apr 2020 12:19:21 GMT
Server: LiteSpeed

GET
H/1.1 200
OK Primary Request index.php Show response
myprimebags.com/..../.../PDF/ 7 KB
2 KB 624ms
200ms Document
text/html 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

cecf48cf90c631cb840f8adf7b437c2e507eac0e8424355cafc48222322a6cf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: myprimebags.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: http://pocrovskiihram.ru/wp-admin/redirect1.php?email=64hongs@hanmail.net
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Referer: http://pocrovskiihram.ru/wp-admin/redirect1.php?email=64hongs@hanmail.net

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Server: Apache
Cache-Control: max-age=0
Expires: Fri, 10 Apr 2020 12:19:22 GMT
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Connection: keep-alive, Keep-Alive
X-Content-Type-Options: nosniff
Access-Control-Allow-Origin: *
Content-Length: 2167
Keep-Alive: timeout=5, max=150
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK facebox.css
myprimebags.com/..../.../PDF/javascript/facebox/src/ 1 KB
899 B 152ms
151ms Stylesheet
text/css 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/javascript/facebox/src/facebox.css

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 454
Expires: Fri, 10 Apr 2020 13:19:22 GMT

GET
H/1.1 200
OK only.js Show response
myprimebags.com/..../.../PDF/js/ 598 B
669 B 303ms
151ms Script
application/javascript 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/js/only.js

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

06126b2672218c14936fcae9c83150cf9704235c44f823a6e7b7023f55171799

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=148
Content-Length: 210
Expires: Fri, 10 Apr 2020 13:19:22 GMT

GET
H/1.1 200
OK jquery-1.6.2.min.js Show response
myprimebags.com/..../.../PDF/javascript/ 89 KB
32 KB 462ms
161ms Script
application/javascript 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/javascript/jquery-1.6.2.min.js

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 32066
Expires: Fri, 10 Apr 2020 13:19:22 GMT

GET
H/1.1 200
OK facebox.js Show response
myprimebags.com/..../.../PDF/javascript/facebox/src/ 9 KB
3 KB 453ms
152ms Script
application/javascript 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/javascript/facebox/src/facebox.js

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

983747e7938326bd872ecf4734d559a8d811dbd4488fd46c05fe6f99e9b0a867

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 2843
Expires: Fri, 10 Apr 2020 13:19:22 GMT

GET
H/1.1 200
OK jquery.watermark.js Show response
myprimebags.com/..../.../PDF/javascript/watermark/ 18 KB
6 KB 456ms
155ms Script
application/javascript 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/javascript/watermark/jquery.watermark.js

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

d76d8ccf3c229b319c08e3b8f44a9b3cbc00d72b25a5cdbe40609ef4856a8c98

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 6092
Expires: Fri, 10 Apr 2020 13:19:22 GMT

GET
H/1.1 200
OK initx.js Show response
myprimebags.com/..../.../PDF/javascript/ 4 KB
2 KB 455ms
154ms Script
application/javascript 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to

Full URL

https://myprimebags.com/..../.../PDF/javascript/initx.js

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

276789013bbbea229e1c402623b81fa995ddb0ecafcdea13bcd5460ad92618db

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 1248
Expires: Fri, 10 Apr 2020 13:19:22 GMT

GET
H/1.1 200
OK favicon.ico
myprimebags.com/..../.../PDF/images/ 105 KB
13 KB 306ms
157ms Image
image/x-icon 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myprimebags.com/..../.../PDF/images/favicon.ico

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

bcbf2535518c09fb68ecf5e05c20946d58ced43eeb0dff8e95574701cc1283d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: image/x-icon
Cache-Control: max-age=31536000
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=150
Content-Length: 13280
Expires: Sat, 10 Apr 2021 12:19:22 GMT

GET
H/1.1 200
OK Yyjfy0T.png
myprimebags.com/..../.../PDF/images/ 4 KB
4 KB 157ms
156ms Image
image/png 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myprimebags.com/..../.../PDF/images/Yyjfy0T.png

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

0cf7c2b6cecd3c1605353d7e19f982842e64388883dd3d1d1c657cf78b5cdd4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 10 Apr 2020 12:19:22 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=147
Content-Length: 3964
Expires: Sun, 10 May 2020 12:19:22 GMT

GET
H/1.1 200
OK 33wr6fd.png
myprimebags.com/..../.../PDF/images/ 43 KB
43 KB 152ms
151ms Image
image/png 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myprimebags.com/..../.../PDF/images/33wr6fd.png

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

795fb2b4c9d6719defbb87c2d30b3eb825913890301332e2c00b25db8d3fbb91

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 10 Apr 2020 12:19:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=149
Content-Length: 43781
Expires: Sun, 10 May 2020 12:19:23 GMT

GET
H/1.1 200
OK 7dHA6V2.jpg
myprimebags.com/..../.../PDF/images/ 46 KB
47 KB 152ms
151ms Image
image/jpeg 216.194.165.27
IMH-WEST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://myprimebags.com/..../.../PDF/images/7dHA6V2.jpg

Requested by

Host: myprimebags.com
URL: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

216.194.165.27 El Segundo, United States, ASN22611 (IMH-WEST, US),

Reverse DNS

secure.bitace.in

Software

Apache /

Resource Hash

2d9b3835ce3a659c907acd33d613bab446a7894f108dddca2f2d1407263cd2d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://myprimebags.com/..../.../PDF/index.php?login=64hongs@hanmail.net&domain=hanmail.net&log=0&3vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 10 Apr 2020 12:19:23 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 10 Oct 2016 00:00:00 GMT
Server: Apache
Vary: User-Agent
Content-Type: image/jpeg
Cache-Control: max-age=2592000
Connection: keep-alive, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=146
Content-Length: 47302
Expires: Sun, 10 May 2020 12:19:23 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

myprimebags.com
pocrovskiihram.ru
216.194.165.27
46.254.21.28
06126b2672218c14936fcae9c83150cf9704235c44f823a6e7b7023f55171799
0cf7c2b6cecd3c1605353d7e19f982842e64388883dd3d1d1c657cf78b5cdd4b
276789013bbbea229e1c402623b81fa995ddb0ecafcdea13bcd5460ad92618db
2d9b3835ce3a659c907acd33d613bab446a7894f108dddca2f2d1407263cd2d0
6468f0d52f7d3870f6807b2e274de03bab4b93038bae729120dede1515227a4a
795fb2b4c9d6719defbb87c2d30b3eb825913890301332e2c00b25db8d3fbb91
983747e7938326bd872ecf4734d559a8d811dbd4488fd46c05fe6f99e9b0a867
9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832
bcbf2535518c09fb68ecf5e05c20946d58ced43eeb0dff8e95574701cc1283d6
cecf48cf90c631cb840f8adf7b437c2e507eac0e8424355cafc48222322a6cf3
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
d76d8ccf3c229b319c08e3b8f44a9b3cbc00d72b25a5cdbe40609ef4856a8c98

myprimebags.com Open in urlscan Pro 216.194.165.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

155 kBTransfer

327 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Indicators

myprimebags.com Open in urlscan Pro
216.194.165.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

155 kB
Transfer

327 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!