URL: http://auscuqu.uk/nnt;/exce/tracking.php
Submission: On April 13 via api from CA

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 142.44.160.83, located in Victoria, Canada and belongs to OVH, FR. The main domain is auscuqu.uk.
This is the only time auscuqu.uk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

IP Address AS Autonomous System
9 142.44.160.83 16276 (OVH)
9 1
Apex Domain
Subdomains
Transfer
9 auscuqu.uk
auscuqu.uk
276 KB
9 1
Domain Requested by
9 auscuqu.uk auscuqu.uk
9 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://auscuqu.uk/nnt;/exce/tracking.php
Frame ID: 59DA8DCB884B98CD6789C1AB161CE412
Requests: 9 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

276 kB
Transfer

274 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request tracking.php
auscuqu.uk/nnt;/exce/
4 KB
4 KB
Document
General
Full URL
http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
5925be1904f8ca901ea11a28328f1eaf55bba41d66843c65b06667b79b7c19a3

Request headers

Host
auscuqu.uk
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Server
Apache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
facebox.css
auscuqu.uk/nnt;/exce/javascript/facebox/src/
1 KB
1 KB
Stylesheet
General
Full URL
http://auscuqu.uk/nnt;/exce/javascript/facebox/src/facebox.css
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
9a2a983c9ea36e030b6ee8f7f08a2d966fed84f445af2710fcc49dd98b37e832

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Thu, 09 Jun 2016 21:57:40 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1151
jquery-1.js
auscuqu.uk/nnt;/exce/javascript/
89 KB
90 KB
Script
General
Full URL
http://auscuqu.uk/nnt;/exce/javascript/jquery-1.js
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Thu, 09 Jun 2016 21:57:40 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
91556
facebox.js
auscuqu.uk/nnt;/exce/javascript/facebox/src/
9 KB
9 KB
Script
General
Full URL
http://auscuqu.uk/nnt;/exce/javascript/facebox/src/facebox.js
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
983747e7938326bd872ecf4734d559a8d811dbd4488fd46c05fe6f99e9b0a867

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Thu, 09 Jun 2016 21:57:40 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
9223
jquery.js
auscuqu.uk/nnt;/exce/javascript/watermark/
18 KB
18 KB
Script
General
Full URL
http://auscuqu.uk/nnt;/exce/javascript/watermark/jquery.js
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
d76d8ccf3c229b319c08e3b8f44a9b3cbc00d72b25a5cdbe40609ef4856a8c98

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Thu, 09 Jun 2016 21:57:40 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
18666
javascript1.js
auscuqu.uk/nnt;/exce/javascript/
3 KB
3 KB
Script
General
Full URL
http://auscuqu.uk/nnt;/exce/javascript/javascript1.js
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
b854daf5fd2abf265dbebd5fc18aefb69aceadcbaa4533a27c8d5b78b0d21c86

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Thu, 07 Sep 2017 16:44:28 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3321
pdf.png
auscuqu.uk/nnt;/exce/img/
72 KB
72 KB
Image
General
Full URL
http://auscuqu.uk/nnt;/exce/img/pdf.png
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
48a51ddc166a7ebda8894a36948ab37fc4621e64f32c11f3f53e5f45eac3f753

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Wed, 29 Nov 2017 15:30:48 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
73653
pdf2013.png
auscuqu.uk/nnt;/exce/img/
12 KB
12 KB
Image
General
Full URL
http://auscuqu.uk/nnt;/exce/img/pdf2013.png
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
7ad3cfa7242cbdc3b8f9126dbf8273043417c2581f11c95385dc46cc80702798

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Sat, 25 Feb 2017 15:49:00 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
12290
pdf.gif
auscuqu.uk/nnt;/exce/img/
64 KB
65 KB
Image
General
Full URL
http://auscuqu.uk/nnt;/exce/img/pdf.gif
Requested by
Host: auscuqu.uk
URL: http://auscuqu.uk/nnt;/exce/tracking.php
Protocol
HTTP/1.1
Server
142.44.160.83 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
83.ip-142-44-160.net
Software
Apache /
Resource Hash
5637283db9765684dbc62dc9ab8e109239c415bc0dfd6671e6665558827808b0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
auscuqu.uk
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://auscuqu.uk/nnt;/exce/tracking.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Sat, 13 Apr 2019 05:08:30 GMT
Last-Modified
Sat, 25 Feb 2017 15:52:10 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
65913

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| jQuery1620705557675224793 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download function| MM_reloadPage

0 Cookies