curvepebbles.com Open in urlscan Pro
192.232.192.29 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/non...
Submission: On July 22 via api (July 22nd 2020, 6:34:08 am UTC) from TW

Summary HTTP 16 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 16 HTTP transactions. The main IP is 192.232.192.29, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is curvepebbles.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 19th 2020. Valid for: 3 months.

This is the only time curvepebbles.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Unicredit (Banking)

Domain & IP information

	IP Address	AS Autonomous System
7	192.232.192.29 192.232.192.29	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
3	195.68.201.32 195.68.201.32	29080 (BULBANK-AS) (BULBANK-AS)
2	104.111.249.240 104.111.249.240	16625 (AKAMAI-AS) (AKAMAI-AS)
16	4

7 192.232.192.29 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-232-192-29.unifiedlayer.com

curvepebbles.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 195.68.201.32 (Bulgaria)

ASN29080 (BULBANK-AS, BG)

bulbankonline.bg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.249.240 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-249-240.deploy.static.akamaitechnologies.com

seal.websecurity.norton.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	curvepebbles.com curvepebbles.com	260 KB
3	bulbankonline.bg bulbankonline.bg	585 KB
2	norton.com seal.websecurity.norton.com	458 B
16	3

	Domain	Requested by
7	curvepebbles.com	curvepebbles.com
3	bulbankonline.bg	curvepebbles.com
2	seal.websecurity.norton.com	curvepebbles.com
16	3

This site contains links to these domains. Also see Links.

Domain
online.bulbank.bg
www.unicreditbulbank.bg

Subject Issuer	Validity	Valid
curvepebbles.com cPanel, Inc. Certification Authority	`2020-07-19` - `2020-10-17`	3 months	crt.sh
bulbankonline.bg DigiCert SHA2 Extended Validation Server CA	`2019-08-26` - `2021-08-25`	2 years	crt.sh
seal.websecurity.norton.com DigiCert SHA2 Extended Validation Server CA	`2020-03-23` - `2022-04-03`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
Frame ID: 70EB7E9D4371E2116582C9F36AE43ECB
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

16
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

846 kB
Transfer

1199 kB
Size

0
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://online.bulbank.bg/docs/BBO_security_recommendation_BG.pdf
Title: Препоръки за сигурност при работа с алтернативни канали на Банката

Search URL Search Domain Scan URL

URL: https://www.unicreditbulbank.bg/bg/pravna-informatsiya/biskvitki/
Title: Политика за прилагане на бисквитки

Search URL Search Domain Scan URL

URL: https://www.unicreditbulbank.bg/bg/tarifi-i-obshti-usloviya/tarifi-usloviya-fizicheski-litsa/#elektronni-uslugi
Title: Общи условия за Булбанк Онлайн

Search URL Search Domain Scan URL

URL: https://online.bulbank.bg/docs/Account_types_and_possibilities_for_subscription_and_operations_BG.pdf
Title: Видове сметки и възможности за работа с тях в услугата „Булбанк Онлайн”

Search URL Search Domain Scan URL

URL: https://online.bulbank.bg/docs/Online_Corporate_Request_BG.pdf
Title: Искане за ползване на Булбанк Онлайн - корпоративни клиенти

Search URL Search Domain Scan URL

URL: https://online.bulbank.bg/docs/Online_Individuals_Request_BG.pdf
Title: Искане за ползване на Булбанк Онлайн – индивидуални клиенти

Search URL Search Domain Scan URL

URL: https://online.bulbank.bg/docs/request-new%20username%20and%20password_BG.pdf
Title: Искане за промяна на достъп на потребител за ползване на Булбанк Онлайн

Search URL Search Domain Scan URL

URL: https://www.unicreditbulbank.bg/bg/pravna-informatsiya/poveritelnost/
Title: Поверителност

Search URL Search Domain Scan URL

URL: https://www.unicreditbulbank.bg/bg/pravna-informatsiya/usloviya-za-polzvane/
Title: Права на ползване

Search URL Search Domain Scan URL

URL: https://online.bulbank.bg/docs/FAQ_BG.pdf
Title: Често задавани въпроси

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Login.php Show response
curvepebbles.com/Bulk/ 17 KB
5 KB 969ms
241ms Document
text/html 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL

https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

245f91663d4e7dd6f959c8043868830256c6d3774e3bb40a607557f8921ff70c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: curvepebbles.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:46 GMT
Server: Apache
Cache-Control: max-age=0
Expires: Wed, 22 Jul 2020 06:33:46 GMT
Vary: Accept-Encoding
Content-Encoding: gzip
X-UA-Compatible: IE=edge
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
Content-Length: 4357
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.min.css
bulbankonline.bg/Content/css/ 421 KB
77 KB 382ms
111ms Stylesheet
text/css 195.68.201.32
BULBANK-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://bulbankonline.bg/Content/css/style.min.css

Requested by

Host: curvepebbles.com
URL: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.68.201.32 , Bulgaria, ASN29080 (BULBANK-AS, BG),

Reverse DNS

Software

Resource Hash

5ea0d9dbd04e1e9d895c49545da879f5520a1c9b41ceaa9cd991482ffe2f1c76

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://seal.websecurity.norton.com; img-src 'self' https://seal.websecurity.norton.com https://i.ytimg.com data:; frame-src 'self' https://www.youtube.com; frame-ancestors 'self'
Strict-Transport-Security	max-age= 31999999; includeSubDomains
X-Frame-Options	sameorigin

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://seal.websecurity.norton.com; img-src 'self' https://seal.websecurity.norton.com https://i.ytimg.com data:; frame-src 'self' https://www.youtube.com; frame-ancestors 'self'
Content-Encoding: gzip
Last-Modified: Thu, 25 Jun 2020 13:47:17 GMT
ETag: "a5e8d523f74ad61:0"
ntCoent-Length: 431008
X-Frame-Options: sameorigin
Content-Type: text/css
Cache-Control: max-age=28800, must-revalidate
Date: Wed, 22 Jul 2020 06:33:46 GMT
Strict-Transport-Security: max-age= 31999999; includeSubDomains
Accept-Ranges: bytes
Transfer-Encoding: chunked

GET
H/1.1 200
OK getseal Show response
seal.websecurity.norton.com/ 13 B
217 B 188ms
67ms Script
text/javascript 104.111.249.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://seal.websecurity.norton.com/getseal?host_name=bulbankonline.bg&size=M&use_flash=YES&use_%0Atransparent=YES&lang=en
Requested by: Host: curvepebbles.com
URL: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.249.240 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-249-240.deploy.static.akamaitechnologies.com
Software: nginx/1.14.2 /
Resource Hash: bb807cd3b9903a753407ec9d82c403490bad87e9b707458b7d0e7f165277cd2c

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:46 GMT
Cache-Control: must-revalidate, max-age=0
Server: nginx/1.14.2
Connection: keep-alive
ETag
Content-Length: 13
Content-Type: text/javascript

GET
H/1.1 200
OK getseal
seal.websecurity.norton.com/ 43 B
241 B 201ms
77ms Image
image/gif 104.111.249.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://seal.websecurity.norton.com/getseal?at=0&sealid=1&dn=bulbankonline.bg&lang=en&tpt=transparent
Requested by: Host: curvepebbles.com
URL: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.249.240 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-249-240.deploy.static.akamaitechnologies.com
Software: nginx/1.14.2 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:46 GMT
Cache-Control: must-revalidate, max-age=0
Server: nginx/1.14.2
Connection: keep-alive
ETag
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK unicredit-bulbank-logo.svg
bulbankonline.bg/Content/img/ 6 KB
7 KB 90ms
88ms Image
image/svg+xml 195.68.201.32
BULBANK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bulbankonline.bg/Content/img/unicredit-bulbank-logo.svg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.68.201.32 , Bulgaria, ASN29080 (BULBANK-AS, BG),

Reverse DNS

Software

Resource Hash

51441f51f8fb9a7a820cbd086c4b8ec1fedfca249e1f04c1661bc499d4ad2296

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://seal.websecurity.norton.com; img-src 'self' https://seal.websecurity.norton.com https://i.ytimg.com data:; frame-src 'self' https://www.youtube.com; frame-ancestors 'self'
Strict-Transport-Security	max-age= 31999999; includeSubDomains
X-Frame-Options	sameorigin

Request headers

Referer: https://bulbankonline.bg/Content/css/style.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://seal.websecurity.norton.com; img-src 'self' https://seal.websecurity.norton.com https://i.ytimg.com data:; frame-src 'self' https://www.youtube.com; frame-ancestors 'self'
Last-Modified: Thu, 25 Jun 2020 13:28:49 GMT
ETag: "8d1618ff44ad61:0"
X-Frame-Options: sameorigin
Content-Type: image/svg+xml
Cache-Control: max-age=86400, must-revalidate
Date: Wed, 22 Jul 2020 06:33:47 GMT
Strict-Transport-Security: max-age= 31999999; includeSubDomains
Accept-Ranges: bytes
Content-Length: 6337

GET
H/1.1 200
OK tel.png
curvepebbles.com/Bulk/ 404 B
783 B 194ms
193ms Image
image/png 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://curvepebbles.com/Bulk/tel.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

bd82efdfdeda0c08ac9239242de3e22e05dfbd9595ca833faf7e92d161d69bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jul 2020 02:01:43 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=5, max=99
Content-Length: 404
Expires: Fri, 21 Aug 2020 06:33:47 GMT

GET
H/1.1 200
OK mobile.png
curvepebbles.com/Bulk/ 239 B
618 B 393ms
198ms Image
image/png 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://curvepebbles.com/Bulk/mobile.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

3d67a6e8cd02ecb88d4d924a5e29098324e5b5bf27d43752074f4b94f26c91c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jul 2020 02:01:43 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=5, max=98
Content-Length: 239
Expires: Fri, 21 Aug 2020 06:33:47 GMT

GET
H/1.1 200
OK bg-login.jpg
bulbankonline.bg/Content/img/ 501 KB
502 KB 181ms
92ms Image
image/jpeg 195.68.201.32
BULBANK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bulbankonline.bg/Content/img/bg-login.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

195.68.201.32 , Bulgaria, ASN29080 (BULBANK-AS, BG),

Reverse DNS

Software

Resource Hash

2341d64aadfd89d9d21788c4e5c309e83209bd6406b167f7181050d77add46cd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://seal.websecurity.norton.com; img-src 'self' https://seal.websecurity.norton.com https://i.ytimg.com data:; frame-src 'self' https://www.youtube.com; frame-ancestors 'self'
Strict-Transport-Security	max-age= 31999999; includeSubDomains
X-Frame-Options	sameorigin

Request headers

Referer: https://bulbankonline.bg/Content/css/style.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://seal.websecurity.norton.com; img-src 'self' https://seal.websecurity.norton.com https://i.ytimg.com data:; frame-src 'self' https://www.youtube.com; frame-ancestors 'self'
Last-Modified: Fri, 03 Apr 2020 09:31:21 GMT
ETag: "7c53bca29a9d61:0"
X-Frame-Options: sameorigin
Content-Type: image/jpeg
Cache-Control: max-age=86400, must-revalidate
Date: Wed, 22 Jul 2020 06:33:47 GMT
Strict-Transport-Security: max-age= 31999999; includeSubDomains
Accept-Ranges: bytes
Content-Length: 513298

GET
H/1.1 200
OK dar.png
curvepebbles.com/Bulk/ 447 B
827 B 576ms
196ms Image
image/png 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://curvepebbles.com/Bulk/dar.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

0af36ef532df80f9b11ca5acea6798a26943db08d6d27f9322225da62d91333f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jul 2020 02:01:43 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=5, max=100
Content-Length: 447
Expires: Fri, 21 Aug 2020 06:33:47 GMT

GET
H/1.1 200
OK user.png
curvepebbles.com/Bulk/ 251 KB
251 KB 592ms
207ms Image
image/png 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://curvepebbles.com/Bulk/user.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

5e0a4eb4b2b6d103a2b2a65d96c1527bf59111f646e360a7c865839545991d5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jul 2020 02:01:43 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=5, max=100
Content-Length: 256602
Expires: Fri, 21 Aug 2020 06:33:47 GMT

GET
H/1.1 200
OK usernamicon.png
curvepebbles.com/Bulk/ 821 B
1 KB 588ms
203ms Image
image/png 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://curvepebbles.com/Bulk/usernamicon.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

e2b4b11e3c11f24269127ac43be1c2fb50e9ad794170e9b2a87def6ebdb6420c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jul 2020 02:01:43 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=5, max=100
Content-Length: 821
Expires: Fri, 21 Aug 2020 06:33:47 GMT

GET
H/1.1 200
OK lock.png
curvepebbles.com/Bulk/ 435 B
815 B 588ms
201ms Image
image/png 192.232.192.29
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://curvepebbles.com/Bulk/lock.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.232.192.29 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),

Reverse DNS

192-232-192-29.unifiedlayer.com

Software

Apache /

Resource Hash

f2d724582468fae5e71c87711119cd71d54d9cac496ad0018238653d3ea59de5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://curvepebbles.com/Bulk/Login.php?appIdKey=^64.106.213.*&country=US&link=https://bulbankonline.bg/en-US/none/Login/Index?s=efb28ee619306293f8b7909d6842f8cb&view=login
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 22 Jul 2020 06:33:47 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 21 Jul 2020 02:01:43 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=5, max=100
Content-Length: 435
Expires: Fri, 21 Aug 2020 06:33:47 GMT

GET Material-Design-Iconic-Font.woff2
bulbankonline.bg/Content/icons/ 0
0

GET UniCredit%20CY-Regular.ttf
bulbankonline.bg/Content/fonts/UniCreditCY/ 0
0

GET Material-Design-Iconic-Font.woff
bulbankonline.bg/Content/icons/ 0
0

GET Material-Design-Iconic-Font.ttf
bulbankonline.bg/Content/icons/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bulbankonline.bg
URL: https://bulbankonline.bg/Content/icons/Material-Design-Iconic-Font.woff2?v=2.2.0

Domain: bulbankonline.bg
URL: https://bulbankonline.bg/Content/fonts/UniCreditCY/UniCredit%20CY-Regular.ttf

Domain: bulbankonline.bg
URL: https://bulbankonline.bg/Content/icons/Material-Design-Iconic-Font.woff?v=2.2.0

Domain: bulbankonline.bg
URL: https://bulbankonline.bg/Content/icons/Material-Design-Iconic-Font.ttf?v=2.2.0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Unicredit (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bulbankonline.bg
curvepebbles.com
seal.websecurity.norton.com
bulbankonline.bg
104.111.249.240
192.232.192.29
195.68.201.32
0af36ef532df80f9b11ca5acea6798a26943db08d6d27f9322225da62d91333f
2341d64aadfd89d9d21788c4e5c309e83209bd6406b167f7181050d77add46cd
245f91663d4e7dd6f959c8043868830256c6d3774e3bb40a607557f8921ff70c
3d67a6e8cd02ecb88d4d924a5e29098324e5b5bf27d43752074f4b94f26c91c9
51441f51f8fb9a7a820cbd086c4b8ec1fedfca249e1f04c1661bc499d4ad2296
5e0a4eb4b2b6d103a2b2a65d96c1527bf59111f646e360a7c865839545991d5b
5ea0d9dbd04e1e9d895c49545da879f5520a1c9b41ceaa9cd991482ffe2f1c76
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
bb807cd3b9903a753407ec9d82c403490bad87e9b707458b7d0e7f165277cd2c
bd82efdfdeda0c08ac9239242de3e22e05dfbd9595ca833faf7e92d161d69bee
e2b4b11e3c11f24269127ac43be1c2fb50e9ad794170e9b2a87def6ebdb6420c
f2d724582468fae5e71c87711119cd71d54d9cac496ad0018238653d3ea59de5

curvepebbles.com Open in urlscan Pro 192.232.192.29 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

75 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

846 kBTransfer

1199 kBSize

0 Cookies

10 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

curvepebbles.com Open in urlscan Pro
192.232.192.29 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

846 kB
Transfer

1199 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!