mukit.cu.ma Open in urlscan Pro
206.72.206.123 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://mukit.cu.ma/os/PDF/proformaorder.php
Submission: On April 25 via automatic, source phishtank (April 25th 2018, 6:41:27 pm UTC)

Summary HTTP 25 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 25 HTTP transactions. The main IP is 206.72.206.123, located in Secaucus, United States and belongs to NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US. The main domain is mukit.cu.ma.

This is the only time mukit.cu.ma was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
18	206.72.206.123 206.72.206.123		19318 (NJIIX-AS-1) (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC)
25	2

18 206.72.206.123 (Secaucus, United States)

ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US)
PTR: bingo.dynamosvensk.com

mukit.cu.ma	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
18	cu.ma mukit.cu.ma	158 KB
0	Failed function sub() { [native code] }. Failed
25	2

	Domain	Requested by
18	mukit.cu.ma	mukit.cu.ma
0	jid1-dgnibwqga0sibw-at-jetpack Failed	mukit.cu.ma
25	2

This site contains links to these domains. Also see Links.

Domain
localhost

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://mukit.cu.ma/os/PDF/proformaorder.php
Frame ID: 6A535DFC84A2EB2B5F9F644FAE64D52D
Requests: 17 HTTP requests in this frame

Frame: http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a.htm
Frame ID: 5E060AA89E06EE0FE016849829BB369A
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /.*Varnish/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

env /^CloudFlare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

25
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

158 kB
Transfer

241 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://localhost/NEW%20ADO%20-%20Copy/index.php
Title: Download Document

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

25 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request proformaorder.php Show response mukit.cu.ma/os/PDF/	8 KB 3 KB	321ms 227ms	Document text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `c6764b786df27c0206b55c6f5c30f1e250a2f04c21d3e3c3f0ded4afb126628e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Server LiteSpeed Vary Accept-Encoding X-Varnish 960758984 Via 1.1 varnish-v4 Connection keep-alive Accept-Ranges bytes Content-Type text/html; charset=UTF-8 Content-Length 2970
GET H/1.1	200 OK	cloudflare_002.htm Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	118 B 374 B	97ms 96ms	Script text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/cloudflare_002.htm Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `c4cbe42820c95ef71d1f77639cc40f6e07e212f49f683560593433947614bd27` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Via 1.1 varnish-v4 Last-Modified Mon, 10 Apr 2017 12:31:46 GMT Server LiteSpeed X-Varnish 960758986 Connection keep-alive Accept-Ranges bytes Content-Type text/html Content-Length 118
GET H/1.1	200 OK	cloudflare_002_002.htm Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	1 KB 1 KB	97ms 96ms	Script text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/cloudflare_002_002.htm Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `3153bd3d7035d02ea67aff170952c920caad0f2fabbc271021c88ec8393f879e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:46 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/html Via 1.1 varnish-v4 X-Varnish 949651661 Connection keep-alive Accept-Ranges bytes Content-Length 746
GET H/1.1	200 OK	cloudflare.htm Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	149 B 405 B	138ms 138ms	Script text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/cloudflare.htm Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `3c533bfa172179f95076ea20cea1088fa5b6156ff861473cc1f9b00327459ab7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:15 GMT Via 1.1 varnish-v4 Last-Modified Mon, 10 Apr 2017 12:31:46 GMT Server LiteSpeed X-Varnish 959578459 Connection keep-alive Accept-Ranges bytes Content-Type text/html Content-Length 149
GET H/1.1	200 OK	facebox.css mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	1 KB 864 B	189ms 96ms	Stylesheet text/css	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/facebox.css Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,/;q=0.1 Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:46 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 953648012 Connection keep-alive Accept-Ranges bytes Content-Length 483 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	jquery-1.js Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	89 KB 37 KB	196ms 101ms	Script application/javascript	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/jquery-1.js Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 959578457 Connection keep-alive Accept-Ranges bytes Content-Length 37142 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	facebox.js Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	9 KB 4 KB	195ms 100ms	Script application/javascript	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/facebox.js Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `b8afbfa2c28c52e9756d43f261a9530d982fee6a23e80f0aa0b69414393aeb81` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 960758989 Connection keep-alive Accept-Ranges bytes Content-Length 3292 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	jquery.js Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	19 KB 7 KB	195ms 99ms	Script application/javascript	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/jquery.js Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 961185054 Connection keep-alive Accept-Ranges bytes Content-Length 7058 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	javascript1.js Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	3 KB 1 KB	308ms 120ms	Script application/javascript	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/javascript1.js Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `0c128ee5654035de1dbd0b894672b346add97158faf25a91fd9fce7b0a5756d3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 949651659 Connection keep-alive Accept-Ranges bytes Content-Length 1033 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	style.css mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	5 KB 2 KB	191ms 97ms	Stylesheet text/css	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/style.css Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `f2d52e1d4e864a17ae15cd0e48425b14ccf57d9511c3260abf94d11634975df8` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,/;q=0.1 Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 965870669 Connection keep-alive Accept-Ranges bytes Content-Length 1391 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	ph.png mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	6 KB 6 KB	149ms 149ms	Image image/png	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Show image Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/ph.png Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `1a9fab4bedbc84ba03211a888234f0adf0e1c30b2ee583c57dc5e6080399c11b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:15 GMT Via 1.1 varnish-v4 Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 X-Varnish 960103253 Connection keep-alive Accept-Ranges bytes Content-Length 6087 Expires Wed, 02 May 2018 18:41:15 GMT
GET H/1.1	200 OK	SpryValidationTextField.css mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	3 KB 2 KB	194ms 100ms	Stylesheet text/css	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/SpryValidationTextField.css Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `7a81a4132fbedebb2287e5c537a9a6b408f56aa039c77944f4a6b4cc5074039a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,/;q=0.1 Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:14 GMT Content-Encoding gzip Last-Modified Mon, 19 Jun 2017 02:24:20 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 949651657 Connection keep-alive Accept-Ranges bytes Content-Length 1177 Expires Wed, 02 May 2018 18:41:14 GMT
GET H/1.1	200 OK	adobe_logo_new_1.jpg mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/	3 KB 3 KB	149ms 149ms	Image image/jpeg	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Show image Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/adobe_logo_new_1.jpg Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `4adfdcf5a2644ae56f1c40e44fa2ecd712d08af7b10cda9c9b93e063a517c0dd` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:15 GMT Via 1.1 varnish-v4 Last-Modified Mon, 10 Apr 2017 12:31:46 GMT Server LiteSpeed Content-Type image/jpeg Cache-Control public, max-age=604800 X-Varnish 965837795 Connection keep-alive Accept-Ranges bytes Content-Length 2995 Expires Wed, 02 May 2018 18:41:15 GMT
GET H/1.1	404 Not Found	cloudflare.min.js mukit.cu.ma/ajax.cloudflare.com/cdn-cgi/nexp/dok3v%3d919620257c/	0 0	138ms 137ms	Script text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/ajax.cloudflare.com/cdn-cgi/nexp/dok3v%3d919620257c/cloudflare.min.js Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept / Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Pragma no-cache Date Wed, 25 Apr 2018 18:41:15 GMT Via 1.1 varnish-v4 Server LiteSpeed X-Varnish 949651663 Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Type text/html Content-Length 1148
GET H/1.1	200 OK	bg.jpg mukit.cu.ma/os/PDF/	87 KB 88 KB	147ms 146ms	Image image/jpeg	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Show image Full URL http://mukit.cu.ma/os/PDF/bg.jpg Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `13ab51b9d5e8019926f0c444740dd9aabd05abf0dd7201b5c747e31d162d4558` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:15 GMT Via 1.1 varnish-v4 Last-Modified Mon, 10 Apr 2017 12:28:54 GMT Server LiteSpeed Content-Type image/jpeg Cache-Control public, max-age=604800 X-Varnish 965116705 Connection keep-alive Accept-Ranges bytes Content-Length 89305 Expires Wed, 02 May 2018 18:41:15 GMT
GET H/1.1	404 Not Found	adobe_logo_new_1.jpg mukit.cu.ma/os/PDF/images/	1 KB 1 KB	131ms 129ms	Image text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Show image Full URL http://mukit.cu.ma/os/PDF/images/adobe_logo_new_1.jpg Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/style.css Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/style.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Pragma no-cache Date Wed, 25 Apr 2018 18:41:15 GMT Via 1.1 varnish-v4 Server LiteSpeed X-Varnish 953779116 Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Type text/html Content-Length 1148
GET		home.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/	0 0

GET H/1.1	200 OK	a.htm Show response mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/ Frame 5E06	1 KB 773 B	227ms 100ms	Document text/html	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a.htm Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/proformaorder.php Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `951fd8bb6c13f3e3297e9da6004d2f5a1c58f83cbd62bc2eee353ae34d26758b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://mukit.cu.ma/os/PDF/proformaorder.php Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://mukit.cu.ma/os/PDF/proformaorder.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:15 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:46 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/html Via 1.1 varnish-v4 X-Varnish 961119355 Connection keep-alive Accept-Ranges bytes Content-Length 470
GET H/1.1	200 OK	inject.css mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a_data/ Frame 5E06	4 KB 1 KB	98ms 98ms	Stylesheet text/css	206.72.206.123 NEW JERSEY INTERN...
General Check archive.org Show headers Download Go to Full URL http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a_data/inject.css Requested by Host: mukit.cu.ma URL: http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a.htm Protocol HTTP/1.1 Server 206.72.206.123 Secaucus, United States, ASN19318 (NJIIX-AS-1 - NEW JERSEY INTERNATIONAL INTERNET EXCHANGE LLC, US), Reverse DNS bingo.dynamosvensk.com Software LiteSpeed / Resource Hash `6c3e0f3f53303f20c85d9f8832e0a07728f665a4094f94e6044227c02aa1d653` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host mukit.cu.ma User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Accept text/css,/;q=0.1 Referer http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a.htm Connection keep-alive Cache-Control no-cache Referer http://mukit.cu.ma/os/PDF/Adobe%20Document%20Cloud%20-%20Start%20Download_files/a.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36 Response headers Date Wed, 25 Apr 2018 18:41:15 GMT Content-Encoding gzip Last-Modified Mon, 10 Apr 2017 12:31:48 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Via 1.1 varnish-v4 Cache-Control public, max-age=604800 X-Varnish 961119357 Connection keep-alive Accept-Ranges bytes Content-Length 1077 Expires Wed, 02 May 2018 18:41:15 GMT
GET		faq.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/ Frame 5E06	0 0

GET		settings.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/ Frame 5E06	0 0

GET		home.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/ Frame 5E06	0 0

GET		voice.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/ Frame 5E06	0 0

GET		toggle.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/ Frame 5E06	0 0

GET		bookmarks.png jid1-dgnibwqga0sibw-at-jetpack/data/icons/ Frame 5E06	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/home.png

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/faq.png

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/settings.png

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/home.png

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/voice.png

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/toggle.png

Domain: jid1-dgnibwqga0sibw-at-jetpack
URL: resource://jid1-dgnibwqga0sibw-at-jetpack/data/icons/bookmarks.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| CloudFlare function| $ function| jQuery object| jQuery162008181773081410615 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download function| MM_reloadPage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

jid1-dgnibwqga0sibw-at-jetpack
mukit.cu.ma
jid1-dgnibwqga0sibw-at-jetpack
206.72.206.123
016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335
0c128ee5654035de1dbd0b894672b346add97158faf25a91fd9fce7b0a5756d3
13ab51b9d5e8019926f0c444740dd9aabd05abf0dd7201b5c747e31d162d4558
1a9fab4bedbc84ba03211a888234f0adf0e1c30b2ee583c57dc5e6080399c11b
3153bd3d7035d02ea67aff170952c920caad0f2fabbc271021c88ec8393f879e
3c533bfa172179f95076ea20cea1088fa5b6156ff861473cc1f9b00327459ab7
4adfdcf5a2644ae56f1c40e44fa2ecd712d08af7b10cda9c9b93e063a517c0dd
6c3e0f3f53303f20c85d9f8832e0a07728f665a4094f94e6044227c02aa1d653
70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83
7a81a4132fbedebb2287e5c537a9a6b408f56aa039c77944f4a6b4cc5074039a
951fd8bb6c13f3e3297e9da6004d2f5a1c58f83cbd62bc2eee353ae34d26758b
9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832
b8afbfa2c28c52e9756d43f261a9530d982fee6a23e80f0aa0b69414393aeb81
c4cbe42820c95ef71d1f77639cc40f6e07e212f49f683560593433947614bd27
c6764b786df27c0206b55c6f5c30f1e250a2f04c21d3e3c3f0ded4afb126628e
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
f2d52e1d4e864a17ae15cd0e48425b14ccf57d9511c3260abf94d11634975df8