83.135.25.134 - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 0 domains to perform 6 HTTP transactions. The main IP is 83.135.25.134, located in Luebbenau, Germany and belongs to VERSATEL, DE. The main domain is 83.135.25.134.

This is the only time 83.135.25.134 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	24.234.184.146 24.234.184.146	22773 (ASN-CXA-A...) (ASN-CXA-ALL-CCI-22773-RDC)
1 6	83.135.25.134 83.135.25.134	8881 (VERSATEL) (VERSATEL)
6	2

1 24.234.184.146 (Las Vegas, United States)

ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US)
PTR: mail.newmanwest.com

24.234.184.146	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 83.135.25.134 (Luebbenau, Germany) 1 redirects

ASN8881 (VERSATEL, DE)
PTR: mx0.mopo.de

83.135.25.134	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	0

	Domain	Requested by
6	0

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php
Frame ID: BB9941EF93C20E3857362A0D6786BA32
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1FeDsw1Xqz... Page URL
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzq... HTTP 302
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzq... Page URL

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

2
Countries

302 kB
Transfer

300 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1FeDsw1XqzJh0nLmpTgFc/OsEzb4NtSw0qGhj.html Page URL
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/PdEsz5qAjM0pbNtfR.php HTTP 302
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	OsEzb4NtSw0qGhj.html Show response 24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1FeDsw1XqzJh0nLmpTgFc/	220 B 343 B	450ms 437ms	Document text/html	24.234.184.146 ASN-CXA-ALL-CCI-2...
General Check archive.org Show headers Download Go to Full URL http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1FeDsw1XqzJh0nLmpTgFc/OsEzb4NtSw0qGhj.html Protocol HTTP/1.1 Server 24.234.184.146 Las Vegas, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC, US), Reverse DNS mail.newmanwest.com Software IceWarp/4.1 / Resource Hash `ba6c5150093184ccd90a9e4fad7e450c463237f385246791b4bdc76c14552480` Request headers Host 24.234.184.146 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Connection close Server IceWarp/4.1 Date Mon, 10 Feb 2020 21:40:01 -0800 Content-type text/html
GET H/1.1	200 OK	Primary Request Cookie set index.php Show response 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/ Redirect Chain http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/PdEsz5qAjM0pbNtfR.php http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php	4 KB 4 KB	43ms 43ms	Document text/html	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `e08f88fedc772670c188f6b53d16754703d4a0dc038e20522b3e603fa18d5b17` Request headers Host 83.135.25.134 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1FeDsw1XqzJh0nLmpTgFc/OsEzb4NtSw0qGhj.html Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1FeDsw1XqzJh0nLmpTgFc/OsEzb4NtSw0qGhj.html Response headers Server IceWarp/10.1.0 Date Tue, 11 Feb 2020 05:49:53 GMT Set-Cookie PHPSESSID=8c77a4d7a84a206eefb79f3dd699d62e; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-type text/html Transfer-Encoding chunked Redirect headers Server IceWarp/10.1.0 Date Tue, 11 Feb 2020 05:49:53 GMT location a0e2ca35872ebaada366e35c24b4de17/index.php Content-type text/html Transfer-Encoding chunked
GET H/1.1	200 OK	image.css 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/	2 KB 2 KB	39ms 30ms	Stylesheet text/css	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/image.css Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `50dc531b3a5c30b12a7d80150b1969a127da5554177d6e4863fdca47f7aab74e` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 11 Feb 2020 05:49:53 GMT Last-Modified Tue, 11 Feb 2020 05:49:54 GMT Server IceWarp/10.1.0 Content-Type text/css Content-Length 1810 Expires Tue, 11 Feb 2030 05:49:54 GMT
GET H/1.1	200 OK	user.png 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/	3 KB 3 KB	49ms 46ms	Image application/octet-stream	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Show image Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/user.png Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `2f59e0255a37e34f2e6baebdf85d3c5c8cac5e86538f96e8d8f300ddbce0caa4` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 11 Feb 2020 05:49:53 GMT Last-Modified Tue, 11 Feb 2020 05:49:54 GMT Server IceWarp/10.1.0 Content-Type application/octet-stream Content-Length 3121 Expires Tue, 11 Feb 2030 05:49:54 GMT
GET H/1.1	200 OK	pass.png 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/	8 KB 8 KB	56ms 43ms	Image application/octet-stream	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Show image Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/pass.png Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `0db100b94e87ba4d2397d0f164b596919fe53afefd0951e7198420b519476c1f` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 11 Feb 2020 05:49:53 GMT Last-Modified Tue, 11 Feb 2020 05:49:54 GMT Server IceWarp/10.1.0 Content-Type application/octet-stream Content-Length 7695 Expires Tue, 11 Feb 2030 05:49:54 GMT
GET H/1.1	200 OK	backlog.png 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/	284 KB 284 KB	57ms 45ms	Image application/octet-stream	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Show image Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/img/backlog.png Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `8381f01f54455e0baa4d66f0f33e66db36b82905cbe4013405d119ee25e540c2` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/SlUvFw5l/9DrSzqDkl8MPn2BhgVcfD/a0e2ca35872ebaada366e35c24b4de17/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Tue, 11 Feb 2020 05:49:53 GMT Last-Modified Tue, 11 Feb 2020 05:49:54 GMT Server IceWarp/10.1.0 Content-Type application/octet-stream Content-Length 290743 Expires Tue, 11 Feb 2030 05:49:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			83.135.25.134/	1969-12-31 23:59:59	Name: PHPSESSID Value: 8c77a4d7a84a206eefb79f3dd699d62e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

24.234.184.146
83.135.25.134
0db100b94e87ba4d2397d0f164b596919fe53afefd0951e7198420b519476c1f
2f59e0255a37e34f2e6baebdf85d3c5c8cac5e86538f96e8d8f300ddbce0caa4
50dc531b3a5c30b12a7d80150b1969a127da5554177d6e4863fdca47f7aab74e
8381f01f54455e0baa4d66f0f33e66db36b82905cbe4013405d119ee25e540c2
ba6c5150093184ccd90a9e4fad7e450c463237f385246791b4bdc76c14552480
e08f88fedc772670c188f6b53d16754703d4a0dc038e20522b3e603fa18d5b17

83.135.25.134 Open in urlscan Pro 83.135.25.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

2 IPs

2 Countries

302 kBTransfer

300 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

83.135.25.134 Open in urlscan Pro
83.135.25.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

2
Countries

302 kB
Transfer

300 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!