pbti.dp.ua Open in urlscan Pro
91.203.147.201 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://trimmer.to/fFJJT
Effective URL:
https://pbti.dp.ua/nxz/
Submission: On November 14 via manual (November 14th 2023, 4:40:01 pm UTC) from CA — Scanned from US

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 91.203.147.201, located in Mykolayiv, Ukraine and belongs to GOODNET-AS, UA. The main domain is pbti.dp.ua.
TLS certificate: Issued by R3 on October 23rd 2023. Valid for: 3 months.

This is the only time pbti.dp.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3030::6815:24cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	91.203.147.201 91.203.147.201	45045 (GOODNET-AS) (GOODNET-AS)
1	2607:f8b0:400... 2607:f8b0:4004:c17::5f	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c06::5e	15169 (GOOGLE) (GOOGLE)
13	3

1 2606:4700:3030::6815:24cc (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

trimmer.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 91.203.147.201 (Mykolayiv, Ukraine)

ASN45045 (GOODNET-AS, UA)

pbti.dp.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	pbti.dp.ua pbti.dp.ua	747 KB
1	gstatic.com fonts.gstatic.com	48 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
1	trimmer.to 1 redirects trimmer.to	599 B
13	4

	Domain	Requested by
11	pbti.dp.ua	pbti.dp.ua
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	pbti.dp.ua
1	trimmer.to	1 redirects
13	4

This site contains no links.

Subject Issuer	Validity	Valid
pbti.dp.ua R3	`2023-10-23` - `2024-01-21`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pbti.dp.ua/nxz/
Frame ID: 182A5F1634251CC1C39FE6DCF9185716
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Detailed Tracking

Page URL History Show full URLs

https://trimmer.to/fFJJT HTTP 301
https://pbti.dp.ua/nxz/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

797 kB
Transfer

1965 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://trimmer.to/fFJJT HTTP 301
https://pbti.dp.ua/nxz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
pbti.dp.ua/nxz/
Redirect Chain

https://trimmer.to/fFJJT
https://pbti.dp.ua/nxz/

25 KB
4 KB

21618ms
20595ms

Document
text/html

91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx / PHP/5.4.45
Resource Hash: 1f7e08e2cac48b7d0b6e58fede6db38a29ab9c1344937905d75fdce0291bc4c2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
content-length: 4085
content-type: text/html; charset=UTF-8
date: Tue, 14 Nov 2023 16:41:22 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/5.4.45

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8260b0fa0f92434f-EWR
content-type: text/html; charset=UTF-8
date: Tue, 14 Nov 2023 16:39:34 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://pbti.dp.ua/nxz/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AI6uR7s4J0qYWrrFxAK023XChnKUIZ3H5SGM5jFbZOeg2QpVAobA6k7CZIkIwAhdUJULe192uicekVTw2B6WiXp45vWIAL2jjtkSzDFp8ihmu9XN%2BKiYZtVAoIjWtfjslHIyvNgXdLTj"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.1.24
x-robots-tag: noindex
x-turbo-charged-by: LiteSpeed

GET
H2 200 bootstrap.min.css
pbti.dp.ua/nxz/files/ 152 KB
30 KB 540ms
535ms Stylesheet
text/css 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/bootstrap.min.css
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-260c5"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 helpers.css
pbti.dp.ua/nxz/files/ 41 KB
7 KB 406ms
402ms Stylesheet
text/css 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/helpers.css
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-a3ab"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 style.css
pbti.dp.ua/nxz/files/ 8 KB
2 KB 538ms
534ms Stylesheet
text/css 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/style.css
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 35ccf96afa38eef03d12ef3443d2082b375464c2e86f922343685e6f8cec689a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-1ee4"
vary: Accept-Encoding
content-type: text/css

GET
H2 200 CP_4C_E.svg
pbti.dp.ua/nxz/files/ 12 KB
4 KB 287ms
283ms Image
image/svg+xml 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbti.dp.ua/nxz/files/CP_4C_E.svg
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 88d51ac3ad807618c487d046aac0139864b10ec722f295f573c1e82799b5dc35

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sun, 26 Feb 2023 02:31:50 GMT
server: nginx
etag: W/"63fac496-2f74"
vary: Accept-Encoding
content-type: image/svg+xml

GET
H2 200 err.svg
pbti.dp.ua/nxz/files/ 509 B
500 B 670ms
666ms Image
image/svg+xml 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pbti.dp.ua/nxz/files/err.svg
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 38afa7317eabc2637c7a2d6e63ab2344ef1ce4abcb16e1cabae11619e885cd86

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
x-accel-version: 0.01
etag: "1fd-5f58935f31100-gzip"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
accept-ranges: bytes
content-length: 289

GET
H2 200 jquery-3.6.1.min.js Show response
pbti.dp.ua/nxz/files/ 88 KB
35 KB 528ms
525ms Script
application/javascript 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/jquery-3.6.1.min.js
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-15e40"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 bootstrap.bundle.min.js Show response
pbti.dp.ua/nxz/files/ 77 KB
27 KB 396ms
394ms Script
application/javascript 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/bootstrap.bundle.min.js
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-13397"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 all.min.js Show response
pbti.dp.ua/nxz/files/ 1 MB
633 KB 664ms
662ms Script
application/javascript 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/all.min.js
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-175216"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 jquery.mask.min.js Show response
pbti.dp.ua/nxz/files/ 8 KB
4 KB 668ms
666ms Script
application/javascript 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/jquery.mask.min.js
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: 2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
etag: W/"63fa3f24-2087"
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 js.js Show response
pbti.dp.ua/nxz/files/ 496 B
415 B 668ms
667ms Script
application/javascript 91.203.147.201
GOODNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pbti.dp.ua/nxz/files/js.js
Requested by: Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.203.147.201 Mykolayiv, Ukraine, ASN45045 (GOODNET-AS, UA),
Reverse DNS
Software: nginx /
Resource Hash: f6ecae9999b4d4c78226a09e14df1c6ec8bcdf3473377d4e49327e6c9b6b957c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/nxz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 16:41:23 GMT
content-encoding: gzip
last-modified: Sat, 25 Feb 2023 17:02:28 GMT
server: nginx
x-accel-version: 0.01
etag: "1f0-5f58935f31100-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 199

GET
H2 200 css2
fonts.googleapis.com/ 14 KB
1 KB 143ms
51ms Stylesheet
text/css 2607:f8b0:4004:c17::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap

Requested by

Host: pbti.dp.ua
URL: https://pbti.dp.ua/nxz/files/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2177ae3e829faf96e725d696a6bcb2e3ec1ec261796b60a46ea25b857d2ac469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pbti.dp.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 14 Nov 2023 16:39:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 15:48:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Nov 2023 16:39:57 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
48 KB 139ms
43ms Font
font/woff2 2607:f8b0:4004:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;500;600;700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://pbti.dp.ua
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Fri, 10 Nov 2023 05:55:58 GMT
x-content-type-options: nosniff
age: 384239
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Nov 2024 05:55:58 GMT

Verdicts & Comments Add Verdict or Comment

Malicious page.url
Submitted on November 14th 2023, 4:41:00 pm UTC — From Canada

Threats: Phishing
Brands: Canada Post CA
Comment: Phishing email, using a redirected/shortener link from trimmer.to

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			trimmer.to/	1969-12-31 23:59:59	Name: PHPSESSID Value: 94ljtu8c2mu8r4n4hp8v3203lk
			pbti.dp.ua/	1969-12-31 23:59:59	Name: PHPSESSID Value: m52jog95lbvmugrjb8g3sjj5a4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
pbti.dp.ua
trimmer.to
2606:4700:3030::6815:24cc
2607:f8b0:4004:c06::5e
2607:f8b0:4004:c17::5f
91.203.147.201
1c7070cf33da6adcb7a6b9ff7eb6e06fd8f64958622d61569b990e8b92c58615
1f7e08e2cac48b7d0b6e58fede6db38a29ab9c1344937905d75fdce0291bc4c2
2177ae3e829faf96e725d696a6bcb2e3ec1ec261796b60a46ea25b857d2ac469
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
35ccf96afa38eef03d12ef3443d2082b375464c2e86f922343685e6f8cec689a
38afa7317eabc2637c7a2d6e63ab2344ef1ce4abcb16e1cabae11619e885cd86
6a769e18b06859751eaa2259044a6ff76e3ddcd6572a516d8ce3a2d7b8c7538e
7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b
7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe
88d51ac3ad807618c487d046aac0139864b10ec722f295f573c1e82799b5dc35
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
f6ecae9999b4d4c78226a09e14df1c6ec8bcdf3473377d4e49327e6c9b6b957c

pbti.dp.ua Open in urlscan Pro 91.203.147.201 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

797 kBTransfer

1965 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Malicious page.url Submitted on November 14th 2023, 4:41:00 pm UTC — From Canada

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

9 JavaScript Global Variables

2 Cookies

Indicators

pbti.dp.ua Open in urlscan Pro
91.203.147.201 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

797 kB
Transfer

1965 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Malicious page.url
Submitted on November 14th 2023, 4:41:00 pm UTC — From Canada

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!