canada-pstliv.servebeer.com
Open in
urlscan Pro
91.236.239.165
Malicious Activity!
Public Scan
Submitted URL: https://araeta.com/wp-content/themes/berg-wp/buge
Effective URL: https://canada-pstliv.servebeer.com/dskdirect.bg/vr/
Submission: On April 15 via manual from SG — Scanned from ES
Effective URL: https://canada-pstliv.servebeer.com/dskdirect.bg/vr/
Submission: On April 15 via manual from SG — Scanned from ES
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 1 HTTP transactions.
The main IP is 91.236.239.165, located in
France and
belongs to FIRSTHEBERG, FR.
The main domain is canada-pstliv.servebeer.com.
TLS certificate: Issued by R3 on April 11th 2022. Valid for: 3 months.
This is the only time canada-pstliv.servebeer.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on April 11th 2022. Valid for: 3 months.
This is the only time canada-pstliv.servebeer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DSK Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 2 | 82.98.160.145 82.98.160.145 | 42612 (DINAHOSTI...) (DINAHOSTING-AS) | |
| 1 2 | 91.236.239.165 91.236.239.165 | 197922 (FIRSTHEBERG) (FIRSTHEBERG) | |
| 1 | 2 |
2
91.236.239.165
(France)
ASN197922 (FIRSTHEBERG, FR)
PTR: srv315.firstheberg.net
ASN197922 (FIRSTHEBERG, FR)
PTR: srv315.firstheberg.net
| canada-pstliv.servebeer.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
servebeer.com
1 redirects
canada-pstliv.servebeer.com |
629 KB |
| 2 |
araeta.com
2 redirects
araeta.com |
426 B |
| 1 | 2 |
| Domain | Requested by | |
|---|---|---|
| 2 | canada-pstliv.servebeer.com | 1 redirects |
| 2 | araeta.com | 2 redirects |
| 1 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| canada-pstliv.servebeer.com R3 |
2022-04-11 - 2022-07-10 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://canada-pstliv.servebeer.com/dskdirect.bg/vr/
Frame ID: 08ACEC1B33609A005313BA7A2707BB61
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Електронно банкиране ДСК Директ от Банка ДСКPage URL History Show full URLs
-
https://araeta.com/wp-content/themes/berg-wp/buge
HTTP 301
http://araeta.com/wp-content/themes/berg-wp/buge/ HTTP 302
https://canada-pstliv.servebeer.com/dskdirect.bg/ HTTP 302
https://canada-pstliv.servebeer.com/dskdirect.bg/vr/ Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://araeta.com/wp-content/themes/berg-wp/buge
HTTP 301
http://araeta.com/wp-content/themes/berg-wp/buge/ HTTP 302
https://canada-pstliv.servebeer.com/dskdirect.bg/ HTTP 302
https://canada-pstliv.servebeer.com/dskdirect.bg/vr/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
1 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
canada-pstliv.servebeer.com/dskdirect.bg/vr/ Redirect Chain
|
874 KB 629 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
27 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
100 KB 100 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
72 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
42 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
37 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
949 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
39 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
79 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
100 KB 100 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
100 KB 100 KB |
Font
font/x-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DSK Bank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
araeta.com
canada-pstliv.servebeer.com
82.98.160.145
91.236.239.165
0e3bc0ec0269a5201ee96b28118478d690189840798c2f80dedf259a06a2c535
1daa4277916dd050fb98fe61a6d1f584871d477094885219c4ea900ee7fc07a8
33534766c32a4f1f09d24e1e6d31008f1184db197b1768b599e5196bd2bad9a2
35132ca2b6de83f6f297f89869e95fe5e957f474fe3e1f5eecfdf7836e22b314
380f51ea9177067609968913a746722d26cf2f00300f157e6c3ed3b38b0cf10d
4bce01ca8b68d07aec86ba30dc2f94775adf91a4f487a174522eab988488af34
4dc2784d1bf184b593dd4d447f1037407dbbf62d5ad04d730636513b57a067bd
556dbd4447b2f9e872db058bdc0cc11b1f24b1d9fdabaf3d6c5e2a0f96ca9131
59112ed4801f8c7528bb2cb4aecd536dd4b480e89a39eadecf61fc6fa4c4a148
7a9d2e26c43294bfc2f43d7c8de599e8ebdb1e930dec633e62c58293986a50b6
885ba059f6960be2f0c3f240641c2935c88401fe000b1c11db9074650fd4c216
b0f3fd5a37ec1d8f6115698c4e6739086530728ab250061d49a8f65b2df27911
b62c577862c7e980b1baa24b22c78912f9b3f47aa478dc47ef2b06cbcf61a30a
b6fb3abc677a66e3a6575b2dbaec9950f8d8630e26922f33094afdeaba7f004e
bcc71ba4680f7fecde3b159ca93c9ee6ff438360c431002bb60679e2cfd07eaf
db923b9dfc974938937a074b4791203f9d0b381674aecfd934a3fca95583f816
e2b5c25dc2b377ca4e7e78271710f6eed22d811ca90c588820236556d2375770
faa57da39d66803cdb67d6f8744006d5d9adeea10d363e23070fb2d46f0f0187