fradegads.ml - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 80.85.156.55, located in Russian Federation and belongs to CHELYABINSK-SIGNAL-AS, RU. The main domain is fradegads.ml.

This is the only time fradegads.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	80.85.156.55 80.85.156.55	44493 (CHELYABIN...) (CHELYABINSK-SIGNAL-AS)
4	217.12.221.200 217.12.221.200	15626 (ITLAS) (ITLAS)
5	2

2 80.85.156.55 (Russian Federation) 1 redirects

ASN44493 (CHELYABINSK-SIGNAL-AS, RU)
PTR: node2.host.profitserver.ru

fradegads.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 217.12.221.200 (Ukraine)

ASN15626 (ITLAS, UA)
PTR: rakftzincorp.org

ddnsnet.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ddnsnet.ga ddnsnet.ga	830 KB
2	fradegads.ml 1 redirects fradegads.ml	2 KB
5	2

	Domain	Requested by
4	ddnsnet.ga	fradegads.ml
2	fradegads.ml	1 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 3C5802385D2EDE9ADCC714C18884BEAF
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://fradegads.ml/cambodia/regent/?email=judit.huarte-ciganda@merckgroup.com HTTP 302
http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.17742564... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

831 kB
Transfer

830 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://fradegads.ml/cambodia/regent/?email=judit.huarte-ciganda@merckgroup.com HTTP 302
http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request j9fc3pghtn5qyp3n934yy3w8.php Show response fradegads.ml/cambodia/regent/ Redirect Chain http://fradegads.ml/cambodia/regent/?email=judit.huarte-ciganda@merckgroup.com http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=j...	1 KB 2 KB	97ms 96ms	Document text/html	80.85.156.55 CHELYABINSK-SIGNA...
General Check archive.org Show headers Download Go to Full URL http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 80.85.156.55 , Russian Federation, ASN44493 (CHELYABINSK-SIGNAL-AS, RU), Reverse DNS node2.host.profitserver.ru Software nginx/1.12.2 / PHP/5.4.16 Resource Hash `e311062462e264aa4a7b907b5c4efc2d6ca4177ad8689fde500e0e5842e5e92c` Request headers Host fradegads.ml Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie PHPSESSID=ro3sb2fq01023onkq5jlrlaa71 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx/1.12.2 Date Wed, 30 Jan 2019 06:04:36 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/5.4.16 Redirect headers Server nginx/1.12.2 Date Wed, 30 Jan 2019 06:04:36 GMT Content-Type text/html Content-Length 0 Connection keep-alive X-Powered-By PHP/5.4.16 Set-Cookie PHPSESSID=ro3sb2fq01023onkq5jlrlaa71; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Location j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
GET H/1.1	200 OK	main_css.css ddnsnet.ga/new/office/images/	2 KB 2 KB	128ms 50ms	Stylesheet text/css	217.12.221.200 ITLAS
General Check archive.org Show headers Download Go to Full URL http://ddnsnet.ga/new/office/images/main_css.css Requested by Host: fradegads.ml URL: http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 217.12.221.200 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS rakftzincorp.org Software Apache / Resource Hash `4dbf2e4f3fa2fd8ac6e90c25c45cd0140f4909a3949311de51cdbebea4e98ef2` Request headers Referer http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 30 Jan 2019 06:04:30 GMT Last-Modified Tue, 22 Nov 2016 02:04:36 GMT Server Apache ETag "424e5-7cb-541da31b25500" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=100 Content-Length 1995
GET H/1.1	200 OK	index.css ddnsnet.ga/new/office/images/	2 KB 2 KB	134ms 53ms	Stylesheet text/css	217.12.221.200 ITLAS
General Check archive.org Show headers Download Go to Full URL http://ddnsnet.ga/new/office/images/index.css Requested by Host: fradegads.ml URL: http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 217.12.221.200 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS rakftzincorp.org Software Apache / Resource Hash `432477ad5a346fe74c9e22e6b2da7f7a7c63dfe3b44359ffe47734dc29e81f5c` Request headers Referer http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 30 Jan 2019 06:04:30 GMT Last-Modified Tue, 22 Nov 2016 02:04:36 GMT Server Apache ETag "424e2-7cc-541da31b25500" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=100 Content-Length 1996
GET H/1.1	200 OK	1.png ddnsnet.ga/new/office/images/	804 KB 804 KB	135ms 53ms	Image image/png	217.12.221.200 ITLAS
General Check archive.org Show headers Download Go to Show image Full URL http://ddnsnet.ga/new/office/images/1.png Requested by Host: fradegads.ml URL: http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 217.12.221.200 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS rakftzincorp.org Software Apache / Resource Hash `ba05bef2d7327f4c6daa4bf96117d01c3cec21568a9a9769063c43cb32e97dc6` Request headers Referer http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 30 Jan 2019 06:04:30 GMT Last-Modified Tue, 22 Nov 2016 02:04:30 GMT Server Apache ETag "424de-c8e10-541da3156c780" Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=100 Content-Length 822800
GET H/1.1	200 OK	2.jpg ddnsnet.ga/new/office/images/	21 KB 22 KB	135ms 53ms	Image image/jpeg	217.12.221.200 ITLAS
General Check archive.org Show headers Download Go to Show image Full URL http://ddnsnet.ga/new/office/images/2.jpg Requested by Host: fradegads.ml URL: http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 217.12.221.200 , Ukraine, ASN15626 (ITLAS, UA), Reverse DNS rakftzincorp.org Software Apache / Resource Hash `9b0237adfc097ef7c4bce5626b0d2ecbaafd98a3bb8ba181637412e68a3fe98b` Request headers Referer http://fradegads.ml/cambodia/regent/j9fc3pghtn5qyp3n934yy3w8.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=judit.huarte-ciganda@merckgroup.com&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Wed, 30 Jan 2019 06:04:30 GMT Last-Modified Tue, 22 Nov 2016 02:04:32 GMT Server Apache ETag "424df-54ee-541da31754c00" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=15, max=100 Content-Length 21742

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fradegads.ml/	1969-12-31 23:59:59	Name: PHPSESSID Value: ro3sb2fq01023onkq5jlrlaa71

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ddnsnet.ga
fradegads.ml
217.12.221.200
80.85.156.55
432477ad5a346fe74c9e22e6b2da7f7a7c63dfe3b44359ffe47734dc29e81f5c
4dbf2e4f3fa2fd8ac6e90c25c45cd0140f4909a3949311de51cdbebea4e98ef2
9b0237adfc097ef7c4bce5626b0d2ecbaafd98a3bb8ba181637412e68a3fe98b
ba05bef2d7327f4c6daa4bf96117d01c3cec21568a9a9769063c43cb32e97dc6
e311062462e264aa4a7b907b5c4efc2d6ca4177ad8689fde500e0e5842e5e92c

fradegads.ml Open in urlscan Pro 80.85.156.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

831 kBTransfer

830 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

fradegads.ml Open in urlscan Pro
80.85.156.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

831 kB
Transfer

830 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!