altaqwa.com.pk - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 173.236.99.82, located in Chicago, United States and belongs to SINGLEHOP-LLC - SingleHop LLC, US. The main domain is altaqwa.com.pk.

This is the only time altaqwa.com.pk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.219.248.81 104.219.248.81	22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap)
2	173.236.99.82 173.236.99.82	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop LLC)
2	104.111.251.171 104.111.251.171	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	104.40.179.243 104.40.179.243	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
5	3

1 104.219.248.81 (Los Angeles, United States) 1 redirects

ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server142-1.web-hosting.com

www.bitly.im	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.236.99.82 (Chicago, United States)

ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US)
PTR: ice.superdnssite.com

altaqwa.com.pk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.251.171 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-251-171.deploy.static.akamaitechnologies.com

secure.aadcdn.microsoftonline-p.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.40.179.243 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

customers.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	microsoftonline-p.com secure.aadcdn.microsoftonline-p.com	204 KB
2	altaqwa.com.pk altaqwa.com.pk	23 KB
1	microsoft.com customers.microsoft.com	17 KB
1	bitly.im 1 redirects www.bitly.im	430 B
5	4

	Domain	Requested by
2	secure.aadcdn.microsoftonline-p.com	altaqwa.com.pk
2	altaqwa.com.pk	altaqwa.com.pk
1	customers.microsoft.com	altaqwa.com.pk
1	www.bitly.im	1 redirects
5	4

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://altaqwa.com.pk/logs/Office/
Frame ID: (39098940887F85CEAD6ADCA606E5A221)
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.bitly.im/9U6Vg/ HTTP 301
http://altaqwa.com.pk/logs/Office/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

244 kB
Transfer

243 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.bitly.im/9U6Vg/ HTTP 301
http://altaqwa.com.pk/logs/Office/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
altaqwa.com.pk/logs/Office/
Redirect Chain

https://www.bitly.im/9U6Vg/
http://altaqwa.com.pk/logs/Office/

15 KB
16 KB

253ms
138ms

Document
text/html

173.236.99.82
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://altaqwa.com.pk/logs/Office/
Protocol: HTTP/1.1
Server: 173.236.99.82 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: ice.superdnssite.com
Software: Apache /
Resource Hash: 4b3ea177b36dd70373f5af94fbf54b2fdd5cf76e8feb860a73395a592bc17869

Request headers

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection: keep-alive
Accept-Encoding: gzip, deflate
Host: altaqwa.com.pk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 07 Mar 2018 04:08:34 GMT
Last-Modified: Sat, 27 Jan 2018 21:04:24 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 15717
Content-Type: text/html

Redirect headers

pragma: no-cache
date: Wed, 07 Mar 2018 04:08:34 GMT
content-encoding: gzip
server: Apache
status: 301
x-powered-by: PHP/5.4.45
vary: Accept-Encoding
content-type: text/html
location: http://altaqwa.com.pk/logs/Office/
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
set-cookie: PHPSESSID=ft6j2q7af7jd6jsb7gk8a53i72; path=/ short_9U6Vg=1; expires=Wed, 07-Mar-2018 04:38:34 GMT; path=/; httponly
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK style2.css
altaqwa.com.pk/logs/Office/css/ 8 KB
8 KB 234ms
119ms Stylesheet
text/css 173.236.99.82
SingleHop LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://altaqwa.com.pk/logs/Office/css/style2.css
Requested by: Host: altaqwa.com.pk
URL: http://altaqwa.com.pk/logs/Office/
Protocol: HTTP/1.1
Server: 173.236.99.82 Chicago, United States, ASN32475 (SINGLEHOP-LLC - SingleHop LLC, US),
Reverse DNS: ice.superdnssite.com
Software: Apache /
Resource Hash: d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: altaqwa.com.pk
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://altaqwa.com.pk/logs/Office/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://altaqwa.com.pk/logs/Office/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 07 Mar 2018 04:08:35 GMT
Last-Modified: Sun, 12 Jun 2016 12:47:14 GMT
Server: Apache
Connection: close
Accept-Ranges: bytes
Content-Length: 7812
Content-Type: text/css

GET
H/1.1 200
OK bannerlogo
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/ 4 KB
5 KB 35ms
7ms Image
image/png 104.111.251.171
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/bannerlogo?ts=635538653042733860

Requested by

Host: altaqwa.com.pk
URL: http://altaqwa.com.pk/logs/Office/

Protocol

HTTP/1.1

Server

104.111.251.171 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-251-171.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://altaqwa.com.pk/logs/Office/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 07 Mar 2018 04:08:35 GMT
Last-Modified: Thu, 11 Dec 2014 03:28:24 GMT
Content-MD5: nwmifU9ps1V8dDNXSinXJg==
Strict-Transport-Security: max-age=31536000
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=18862
Connection: keep-alive
Content-Length: 4585

GET
H/1.1 200
OK favicon.ico
customers.microsoft.com/images/ 17 KB
17 KB 92ms
41ms Image
image/x-icon 104.40.179.243
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://customers.microsoft.com/images/favicon.ico
Requested by: Host: altaqwa.com.pk
URL: http://altaqwa.com.pk/logs/Office/
Protocol: HTTP/1.1
Server: 104.40.179.243 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: Kestrel / ASP.NET
Resource Hash: 90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

Referer: http://altaqwa.com.pk/logs/Office/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 07 Mar 2018 04:08:35 GMT
Last-Modified: Wed, 07 Feb 2018 08:36:04 GMT
Server: Kestrel
X-Powered-By: ASP.NET
ETag: "1d39feeb0bbf116"
Content-Type: image/x-icon
Accept-Ranges: bytes
Content-Length: 17174
Request-Context: appId=cid-v1:dc8f084b-9ca1-4546-a7f2-693abd4999be

GET
H/1.1 200
OK heroillustration
secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/ 199 KB
199 KB 7ms
7ms Image
image/jpeg 104.111.251.171
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.aadcdn.microsoftonline-p.com/dbd5a2dd-uymyxxfhpwrbckvwvlxle8radh6vkzaj7cwkqpqixg/appbranding/npdp3ivuhlrwvd1ynsq0x-mjc7zhvnj0i7k676ppafa/0/heroillustration?ts=635538653045233940

Protocol

HTTP/1.1

Server

104.111.251.171 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-251-171.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://altaqwa.com.pk/logs/Office/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Wed, 07 Mar 2018 04:08:35 GMT
Last-Modified: Thu, 11 Dec 2014 03:28:24 GMT
Content-MD5: ZSg7Ej6yNeYXaumMAqxbHA==
Strict-Transport-Security: max-age=31536000
Content-Type: image\jpeg
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=59341
Connection: keep-alive
Content-Length: 203294

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

altaqwa.com.pk
customers.microsoft.com
secure.aadcdn.microsoftonline-p.com
www.bitly.im
104.111.251.171
104.219.248.81
104.40.179.243
173.236.99.82
4b3ea177b36dd70373f5af94fbf54b2fdd5cf76e8feb860a73395a592bc17869
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
d74d4d6943f32ae6f7f11d14d601dbb0e1a58919176ee512150366b6279aaf99
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

altaqwa.com.pk Open in urlscan Pro 173.236.99.82 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

244 kBTransfer

243 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

0 Cookies

Indicators

altaqwa.com.pk Open in urlscan Pro
173.236.99.82 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

244 kB
Transfer

243 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!