urlscan.io logo urlscan.io
SecurityTrails logo

havytab.com Open in urlscan Pro
91.234.34.80  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://havytab.com/upload/page2.html
Submission: On June 13 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 91.234.34.80, located in Ukraine and belongs to THEHOST-AS, UA. The main domain is havytab.com.
This is the only time havytab.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Barclays (Banking)

Domain & IP information

IP Address AS Autonomous System
4 91.234.34.80 56485 (THEHOST-AS)
4 1
Apex Domain
Subdomains		 Transfer
4 havytab.com
havytab.com
370 KB
4 1
Domain Requested by
4 havytab.com havytab.com
4 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://havytab.com/upload/page2.html
Frame ID: 26835.1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

370 kB
Transfer

410 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request page2.html
havytab.com/upload/ 		2 KB
831 B 		Document
General
Check archive.org
Download Go to
Full URL
http://havytab.com/upload/page2.html
Protocol
HTTP/1.1
Server
91.234.34.80 , Ukraine, ASN56485 (THEHOST-AS, UA),
Reverse DNS
s8.thehost.com.ua
Software
nginx /
Resource Hash
7e6479670ea23c0e0579fd14abab0f724e20db92126518949d488832371ccfae

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
havytab.com
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 13 Jun 2017 12:33:43 GMT
Content-Encoding
gzip
Last-Modified
Mon, 12 Jun 2017 11:18:42 GMT
Server
nginx
ETag
"4263140-798-551c17b4c5df1"
Vary
Host,Accept-Encoding
Content-Type
text/html
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
831
PINSEntry.png
havytab.com/upload/ 		356 KB
356 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://havytab.com/upload/PINSEntry.png
Requested by
Host: havytab.com
URL: http://havytab.com/upload/page2.html
Protocol
HTTP/1.1
Server
91.234.34.80 , Ukraine, ASN56485 (THEHOST-AS, UA),
Reverse DNS
s8.thehost.com.ua
Software
nginx /
Resource Hash
eb1a9902a17629db0571a892e4d2424785348d94bc7b221c648a3c1e22e8a4a2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
havytab.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://havytab.com/upload/page2.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://havytab.com/upload/page2.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 13 Jun 2017 12:33:43 GMT
Last-Modified
Mon, 12 Jun 2017 11:18:59 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
365033
Content-Type
image/png
nextstep.png
havytab.com/upload/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://havytab.com/upload/nextstep.png
Requested by
Host: havytab.com
URL: http://havytab.com/upload/page2.html
Protocol
HTTP/1.1
Server
91.234.34.80 , Ukraine, ASN56485 (THEHOST-AS, UA),
Reverse DNS
s8.thehost.com.ua
Software
nginx /
Resource Hash
9e0ff26623ddf057824d704d85a9017bb0a515a96ebf82d4f973f5b755882aaf

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
havytab.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://havytab.com/upload/page2.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://havytab.com/upload/page2.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 13 Jun 2017 12:33:44 GMT
Last-Modified
Mon, 12 Jun 2017 11:18:36 GMT
Server
nginx
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1061
Content-Type
image/png
Cookie set favicon.ico
havytab.com/ 		51 KB
12 KB 		Other
General
Check archive.org
Download Go to
Full URL
http://havytab.com/favicon.ico
Protocol
HTTP/1.1
Server
91.234.34.80 , Ukraine, ASN56485 (THEHOST-AS, UA),
Reverse DNS
s8.thehost.com.ua
Software
nginx / PHP/5.3.10-1ubuntu3.26
Resource Hash
c7059df009bc82c76631e1397657bc4509ff03239a50e80bac93491ec3d89728

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
havytab.com
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://havytab.com/upload/page2.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://havytab.com/upload/page2.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Tue, 13 Jun 2017 12:33:44 GMT
Content-Encoding
gzip
Server
nginx
X-Powered-By
PHP/5.3.10-1ubuntu3.26
Vary
Host,Accept-Encoding
P3P
CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
Status
404 Not Found
Connection
keep-alive
Set-Cookie
ffdbd13d96d903c026c4876e97eb63a4=uuXqpnm03AfrwxMzqqG7ZrONGEvPSZzY7nGdBD4csOXBZLTJByIofMqG0kBM3NmZWb6ZVd69JEG%2FXl%2BEGf%2Boo1Al%2BbsDqFWuNqR3klO8eqYqIaUTabjL3PkGMiYD6TIhDfSYJHR%2BXNmJVZ%2Fe4%2BCFikr65ghgtH0FyETlyNOpi88%3D000115; expires=Mon, 03-Jul-2017 12:33:44 GMT; path=/; domain=havytab.com; httponly
Content-Type
text/html; charset=utf-8
Content-Length
12459

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Barclays (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies