trolland.com.ua
31.131.21.53  Malicious Activity!

Submitted URL: https://trolland.com.ua/invoice/Docfile/index.php
Effective URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Submission: On February 08 via manual from IE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 31.131.21.53, located in Rotterdam, Netherlands and belongs to VPS-UA-AS, UA. The main domain is trolland.com.ua.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 8th 2019. Valid for: 3 months.
This is the only time trolland.com.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Domain & IP information

IP Address AS Autonomous System
10 31.131.21.53 56851 (VPS-UA-AS)
10 1
Domain
Subdomains
Transfer
10 trolland.com.ua
.trolland.com.ua
277 KB
10 1
Domain Requested by
10 trolland.com.ua trolland.com.ua
10 1

This site contains no links.

Subject Issuer Validity Valid
trolland.com.ua
Let's Encrypt Authority X3
2019-02-08 -
2019-05-09
3 months crt.sh

This page contains 1 frames:

Primary Page: https://trolland.com.ua/invoice/Docfile/melstod.php
Frame ID: 12E9F8332DF7B28DEA142059080F801B
Requests: 10 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://trolland.com.ua/invoice/Docfile/index.php Page URL
  2. https://trolland.com.ua/invoice/Docfile/melstod.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

277 kB
Transfer

276 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://trolland.com.ua/invoice/Docfile/index.php Page URL
  2. https://trolland.com.ua/invoice/Docfile/melstod.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
index.php
trolland.com.ua/invoice/Docfile/
278 B
328 B
Document
General
Full URL
https://trolland.com.ua/invoice/Docfile/index.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed / PHP/5.6.40
Resource Hash
e9b197c3bd37ea1d1f32b597c3509a1f811a0c4dfe954a31cd9bb04f6bf549bb

Request headers

:method
GET
:authority
trolland.com.ua
:scheme
https
:path
/invoice/Docfile/index.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
x-powered-by
PHP/5.6.40
content-type
text/html; charset=UTF-8
content-length
164
content-encoding
br
vary
Accept-Encoding
date
Fri, 08 Feb 2019 10:29:13 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
juirrgyuj.png
trolland.com.ua/invoice/Docfile/bettyimages/
196 KB
196 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/juirrgyuj.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/index.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
a0d0fea32c60f6d5bf8393772b94362e363812c3d7c0c9bc9416f7d232614578

Request headers

:path
/invoice/Docfile/bettyimages/juirrgyuj.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/index.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:13 GMT
last-modified
Wed, 13 Dec 2017 20:19:28 GMT
server
LiteSpeed
etag
"30f13-5a318b50-bbac823f38feb807;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
200467
expires
Fri, 15 Feb 2019 10:29:13 GMT
Primary Request melstod.php
trolland.com.ua/invoice/Docfile/
1 KB
482 B
Document
General
Full URL
https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed / PHP/5.6.40
Resource Hash
78fb7aa9057daa7eaac2c2bc5f0674ad9cc6e2d716e6dd57d0a9d5ccd4fa141d

Request headers

:method
GET
:authority
trolland.com.ua
:scheme
https
:path
/invoice/Docfile/melstod.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://trolland.com.ua/invoice/Docfile/index.php
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://trolland.com.ua/invoice/Docfile/index.php

Response headers

status
200
x-powered-by
PHP/5.6.40
content-type
text/html; charset=UTF-8
content-length
318
content-encoding
br
vary
Accept-Encoding
date
Fri, 08 Feb 2019 10:29:17 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
juirr.png
trolland.com.ua/invoice/Docfile/bettyimages/
45 KB
45 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/juirr.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
f4d0d078a7f8bdac1dc6ed9d6034f7edf3169b2d97414e5d19f32b7a6da7106f

Request headers

:path
/invoice/Docfile/bettyimages/juirr.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 19:49:56 GMT
server
LiteSpeed
etag
"b3dc-5a318464-32bf2727659633b1;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
46044
expires
Fri, 15 Feb 2019 10:29:17 GMT
sydte.png
trolland.com.ua/invoice/Docfile/bettyimages/
13 KB
13 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/sydte.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
a022c4b19537909af369225a14aaf7ccf8a39c5ce2c0c4d902ce9fe0a334c3c0

Request headers

:path
/invoice/Docfile/bettyimages/sydte.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 17:35:22 GMT
server
LiteSpeed
etag
"347a-5a3164da-62803ebba89d3e1;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
13434
expires
Fri, 15 Feb 2019 10:29:17 GMT
yuseww.png
trolland.com.ua/invoice/Docfile/bettyimages/
7 KB
7 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/yuseww.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
580f73c464fe49da5e3b87e9528f093944a33580a4891e85642b2ebbd6274a0d

Request headers

:path
/invoice/Docfile/bettyimages/yuseww.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 17:32:34 GMT
server
LiteSpeed
etag
"1b4c-5a316432-6aac446b0373ab79;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
6988
expires
Fri, 15 Feb 2019 10:29:17 GMT
ietyees.png
trolland.com.ua/invoice/Docfile/bettyimages/
3 KB
3 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/ietyees.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
2148e47fef32ab5bb987ae6b1b01a6920c9d67fb40c886add108517dc357fc14

Request headers

:path
/invoice/Docfile/bettyimages/ietyees.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 17:33:22 GMT
server
LiteSpeed
etag
"d56-5a316462-af56c677d87c71e5;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
3414
expires
Fri, 15 Feb 2019 10:29:17 GMT
owiee.png
trolland.com.ua/invoice/Docfile/bettyimages/
2 KB
2 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/owiee.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
e9d1400fd3b3255a8bd38549d6a181bc823b91b9a887933eaab5064a8d37e055

Request headers

:path
/invoice/Docfile/bettyimages/owiee.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 17:39:58 GMT
server
LiteSpeed
etag
"7db-5a3165ee-3835adbff2c441d1;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
2011
expires
Fri, 15 Feb 2019 10:29:17 GMT
landgd.png
trolland.com.ua/invoice/Docfile/bettyimages/
5 KB
5 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/landgd.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
6f5b65c97dcbaa001291c269015cfa7a49b9caef804f0ab8eab3c4e50592720b

Request headers

:path
/invoice/Docfile/bettyimages/landgd.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 17:40:50 GMT
server
LiteSpeed
etag
"13a0-5a316622-c9f2cac7f444ebc9;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
5024
expires
Fri, 15 Feb 2019 10:29:17 GMT
dteedzcs.png
trolland.com.ua/invoice/Docfile/bettyimages/
4 KB
4 KB
Image
General
Full URL
https://trolland.com.ua/invoice/Docfile/bettyimages/dteedzcs.png
Requested by
Host: trolland.com.ua
URL: https://trolland.com.ua/invoice/Docfile/melstod.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.131.21.53 Rotterdam, Netherlands, ASN56851 (VPS-UA-AS, UA),
Reverse DNS
53.21.131.31.euhost01.twinservers.net
Software
LiteSpeed /
Resource Hash
4c2f422176c9eebfd72a50794075af6273a740563588358059da028f737e0301

Request headers

:path
/invoice/Docfile/bettyimages/dteedzcs.png
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
trolland.com.ua
referer
https://trolland.com.ua/invoice/Docfile/melstod.php
:scheme
https
:method
GET
Referer
https://trolland.com.ua/invoice/Docfile/melstod.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 08 Feb 2019 10:29:17 GMT
last-modified
Wed, 13 Dec 2017 17:41:40 GMT
server
LiteSpeed
etag
"fcb-5a316654-7ae5ff808e02df92;;;"
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
4043
expires
Fri, 15 Feb 2019 10:29:17 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies