83.135.25.134 - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 0 domains to perform 6 HTTP transactions. The main IP is 83.135.25.134, located in Luebbenau, Germany and belongs to VERSATEL, DE. The main domain is 83.135.25.134.

This is the only time 83.135.25.134 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Australian Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
1	24.234.184.146 24.234.184.146	22773 (ASN-CXA-A...) (ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc.)
1 6	83.135.25.134 83.135.25.134	8881 (VERSATEL) (VERSATEL)
6	2

1 24.234.184.146 (Las Vegas, United States)

ASN22773 (ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc., US)
PTR: mail.newmanwest.com

24.234.184.146	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 83.135.25.134 (Luebbenau, Germany) 1 redirects

ASN8881 (VERSATEL, DE)
PTR: mx0.mopo.de

83.135.25.134	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	0

	Domain	Requested by
6	0

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php
Frame ID: AF16AA39AFF74098F8DAEC21139BD287
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1RzsQAklM5... Page URL
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cd... HTTP 302
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cd... Page URL

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

2
Countries

302 kB
Transfer

300 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1RzsQAklM5pnhB4gu2ImPn/Edzc5nH0bd4Xw6SlmP.html Page URL
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/OrFEd8sn2Xd9sQz.php HTTP 302
http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Edzc5nH0bd4Xw6SlmP.html Show response 24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1RzsQAklM5pnhB4gu2ImPn/	217 B 340 B	365ms 344ms	Document text/html	24.234.184.146 Cox Communication...
General Check archive.org Show headers Download Go to Full URL http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1RzsQAklM5pnhB4gu2ImPn/Edzc5nH0bd4Xw6SlmP.html Protocol HTTP/1.1 Server 24.234.184.146 Las Vegas, United States, ASN22773 (ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc., US), Reverse DNS mail.newmanwest.com Software IceWarp/4.1 / Resource Hash `21fb2e02d9d33e61b8f416de0aadfec76558f07139f8df733fcdc78f528e8cce` Request headers Host 24.234.184.146 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Connection close Server IceWarp/4.1 Date Tue, 14 Jan 2020 20:36:21 -0800 Content-type text/html
GET H/1.1	200 OK	Primary Request Cookie set index.php Show response 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/ Redirect Chain http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/OrFEd8sn2Xd9sQz.php http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php	4 KB 4 KB	74ms 73ms	Document text/html	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `e08f88fedc772670c188f6b53d16754703d4a0dc038e20522b3e603fa18d5b17` Request headers Host 83.135.25.134 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Referer http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1RzsQAklM5pnhB4gu2ImPn/Edzc5nH0bd4Xw6SlmP.html Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Referer http://24.234.184.146/accounts/inc/DswxqGftEdqsaHgyUj/ExTa3Vb/CfDxWsQ/RgTfXsw/Ds2WQzaHb/1RzsQAklM5pnhB4gu2ImPn/Edzc5nH0bd4Xw6SlmP.html Response headers Server IceWarp/10.1.0 Date Wed, 15 Jan 2020 04:46:02 GMT Set-Cookie PHPSESSID=1642eb242e8f3617546b80473e0d6508; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Content-type text/html Transfer-Encoding chunked Redirect headers Server IceWarp/10.1.0 Date Wed, 15 Jan 2020 04:46:02 GMT location e35e1cdbe761085ac0e38fc783e69c31/index.php Content-type text/html Transfer-Encoding chunked
GET H/1.1	200 OK	image.css 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/	2 KB 2 KB	56ms 41ms	Stylesheet text/css	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/image.css Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `50dc531b3a5c30b12a7d80150b1969a127da5554177d6e4863fdca47f7aab74e` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Wed, 15 Jan 2020 04:46:02 GMT Expires Wed, 15 Jan 2030 04:46:04 GMT Last-Modified Wed, 15 Jan 2020 04:46:04 GMT Server IceWarp/10.1.0 Content-Length 1810 Content-Type text/css
GET H/1.1	200 OK	user.png 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/	3 KB 3 KB	71ms 66ms	Image application/octet-stream	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Show image Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/user.png Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `2f59e0255a37e34f2e6baebdf85d3c5c8cac5e86538f96e8d8f300ddbce0caa4` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Wed, 15 Jan 2020 04:46:02 GMT Expires Wed, 15 Jan 2030 04:46:04 GMT Last-Modified Wed, 15 Jan 2020 04:46:04 GMT Server IceWarp/10.1.0 Content-Length 3121 Content-Type application/octet-stream
GET H/1.1	200 OK	pass.png 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/	8 KB 8 KB	80ms 61ms	Image application/octet-stream	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Show image Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/pass.png Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `0db100b94e87ba4d2397d0f164b596919fe53afefd0951e7198420b519476c1f` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Wed, 15 Jan 2020 04:46:02 GMT Expires Wed, 15 Jan 2030 04:46:04 GMT Last-Modified Wed, 15 Jan 2020 04:46:04 GMT Server IceWarp/10.1.0 Content-Length 7695 Content-Type application/octet-stream
GET H/1.1	200 OK	backlog.png 83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/	284 KB 284 KB	89ms 70ms	Image application/octet-stream	83.135.25.134 VERSATEL
General Check archive.org Show headers Download Go to Show image Full URL http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/img/backlog.png Requested by Host: 83.135.25.134 URL: http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php Protocol HTTP/1.1 Server 83.135.25.134 Luebbenau, Germany, ASN8881 (VERSATEL, DE), Reverse DNS mx0.mopo.de Software IceWarp/10.1.0 / Resource Hash `8381f01f54455e0baa4d66f0f33e66db36b82905cbe4013405d119ee25e540c2` Request headers Referer http://83.135.25.134/mail/wap/TfdResZqaJhnBg3/3ResZqAvC/LmPezQaBvCdX/1aGN3wD0qrTf/5RskLmp9NhgT6cdXsghT3seZsQwlK/e35e1cdbe761085ac0e38fc783e69c31/index.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36 Response headers Date Wed, 15 Jan 2020 04:46:02 GMT Expires Wed, 15 Jan 2030 04:46:04 GMT Last-Modified Wed, 15 Jan 2020 04:46:04 GMT Server IceWarp/10.1.0 Content-Length 290743 Content-Type application/octet-stream

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Australian Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			83.135.25.134/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1642eb242e8f3617546b80473e0d6508

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

24.234.184.146
83.135.25.134
0db100b94e87ba4d2397d0f164b596919fe53afefd0951e7198420b519476c1f
21fb2e02d9d33e61b8f416de0aadfec76558f07139f8df733fcdc78f528e8cce
2f59e0255a37e34f2e6baebdf85d3c5c8cac5e86538f96e8d8f300ddbce0caa4
50dc531b3a5c30b12a7d80150b1969a127da5554177d6e4863fdca47f7aab74e
8381f01f54455e0baa4d66f0f33e66db36b82905cbe4013405d119ee25e540c2
e08f88fedc772670c188f6b53d16754703d4a0dc038e20522b3e603fa18d5b17

83.135.25.134 Open in urlscan Pro 83.135.25.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

2 IPs

2 Countries

302 kBTransfer

300 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

83.135.25.134 Open in urlscan Pro
83.135.25.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

2
Countries

302 kB
Transfer

300 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!