www.sedayeomidshz.ir

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 185.126.202.148, located in Iran, Islamic Republic Of and belongs to DPMOBINIDC, IR. The main domain is www.sedayeomidshz.ir.

This is the only time www.sedayeomidshz.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
4	185.126.202.148 185.126.202.148	209782 (DPMOBINIDC) (DPMOBINIDC)
1	54.148.84.95 54.148.84.95	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	2

4 185.126.202.148 (Iran, Islamic Republic Of)

ASN209782 (DPMOBINIDC, IR)
PTR: hosted-by.mobinhost.com

www.sedayeomidshz.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.148.84.95 (Boardman, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-148-84-95.us-west-2.compute.amazonaws.com

www.sitepoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	sedayeomidshz.ir www.sedayeomidshz.ir	37 KB
1	sitepoint.com www.sitepoint.com	6 KB
5	2

	Domain	Requested by
4	www.sedayeomidshz.ir	www.sedayeomidshz.ir
1	www.sitepoint.com	www.sedayeomidshz.ir
5	2

This site contains no links.

Subject Issuer	Validity	Valid
sitepoint.com SSL.com Premium EV CA	`2018-08-07` - `2019-09-23`	a year	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
Frame ID: 7D11168995DF9D5D0D8F3F59D9C7007E
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

20 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

43 kB
Transfer

53 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request file2.html Show response
www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/ 4 KB
5 KB 304ms
82ms Document
text/html 185.126.202.148
DPMOBINIDC

General

Check archive.org

Show headers Download Go to

Full URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
Protocol: HTTP/1.1
Server: 185.126.202.148 , Iran, Islamic Republic Of, ASN209782 (DPMOBINIDC, IR),
Reverse DNS: hosted-by.mobinhost.com
Software: Apache /
Resource Hash: c54a1542aa9bb76b3991a99c78ab550ecc0ccf8e23f574b7948226c235b66698

Request headers

Host: www.sedayeomidshz.ir
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 22 Jun 2019 09:53:42 GMT
Server: Apache
Last-Modified: Tue, 08 May 2018 00:18:22 GMT
Accept-Ranges: bytes
Content-Length: 4407
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK MaskedPassword.js Show response
www.sitepoint.com/examples/password/MaskedPassword/ 17 KB
6 KB 748ms
172ms Script
application/javascript 54.148.84.95
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sitepoint.com/examples/password/MaskedPassword/MaskedPassword.js

Requested by

Host: www.sedayeomidshz.ir
URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

54.148.84.95 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-148-84-95.us-west-2.compute.amazonaws.com

Software

Apache/2.2.22 (Debian) /

Resource Hash

7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a

Security Headers

Name	Value
X-Frame-Options	sameorigin

Request headers

Referer: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 22 Jun 2019 08:49:39 GMT
Content-Encoding: gzip
X-Cache-Lookup: HIT from ip-172-31-22-12.us-west-2.compute.internal:3128
Last-Modified: Fri, 15 Oct 2010 00:03:45 GMT
Server: Apache/2.2.22 (Debian)
Age: 3844
X-Frame-Options: sameorigin
ETag: "680936-4208-4929c8f629a40"
Vary: User-Agent,Accept-Encoding
X-Cache: HIT from ip-172-31-22-12.us-west-2.compute.internal
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 5767

GET
H/1.1 200
OK 2.png
www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/images/ 27 KB
28 KB 85ms
82ms Image
image/png 185.126.202.148
DPMOBINIDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/images/2.png
Requested by: Host: www.sedayeomidshz.ir
URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
Protocol: HTTP/1.1
Security: , ,
Server: 185.126.202.148 , Iran, Islamic Republic Of, ASN209782 (DPMOBINIDC, IR),
Reverse DNS: hosted-by.mobinhost.com
Software: Apache /
Resource Hash: 6fd09ac6403538d7f23b28878d8532f8e5daa3b0a7cf0522d1a902491db26968

Request headers

Referer: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 22 Jun 2019 09:53:42 GMT
Last-Modified: Tue, 08 May 2018 11:17:08 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 28107

GET
H/1.1 200
OK button2.png
www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/images/ 636 B
878 B 166ms
82ms Image
image/png 185.126.202.148
DPMOBINIDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/images/button2.png
Requested by: Host: www.sedayeomidshz.ir
URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
Protocol: HTTP/1.1
Security: , ,
Server: 185.126.202.148 , Iran, Islamic Republic Of, ASN209782 (DPMOBINIDC, IR),
Reverse DNS: hosted-by.mobinhost.com
Software: Apache /
Resource Hash: 01ead4eba68445728ad260d8465b1309355ea56f1ae22d64efcb3371da3dc0cf

Request headers

Referer: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 22 Jun 2019 09:53:43 GMT
Last-Modified: Mon, 07 May 2018 11:05:50 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 636

GET
H/1.1 200
OK file2.html
www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/ 4 KB
4 KB 81ms
81ms Image
text/html 185.126.202.148
DPMOBINIDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
Requested by: Host: www.sedayeomidshz.ir
URL: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
Protocol: HTTP/1.1
Security: , ,
Server: 185.126.202.148 , Iran, Islamic Republic Of, ASN209782 (DPMOBINIDC, IR),
Reverse DNS: hosted-by.mobinhost.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://www.sedayeomidshz.ir/public_ftp/Sodim/sharepoint/file2.html?websrc=59c275dc2e97dd3b896ed4ff2b82a8fd&dispatched=20&id=6718519776
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 22 Jun 2019 09:53:43 GMT
Last-Modified: Tue, 08 May 2018 00:18:22 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4407

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.sedayeomidshz.ir
www.sitepoint.com
185.126.202.148
54.148.84.95
01ead4eba68445728ad260d8465b1309355ea56f1ae22d64efcb3371da3dc0cf
6fd09ac6403538d7f23b28878d8532f8e5daa3b0a7cf0522d1a902491db26968
7742fb83d98648f94727a40d5c3381b3245805e62b6f998002d933715ac84b6a
c54a1542aa9bb76b3991a99c78ab550ecc0ccf8e23f574b7948226c235b66698
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

www.sedayeomidshz.ir Open in urlscan Pro 185.126.202.148 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

20 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

43 kBTransfer

53 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

www.sedayeomidshz.ir Open in urlscan Pro
185.126.202.148 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

20 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

43 kB
Transfer

53 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!