bandolitis.com Open in urlscan Pro
50.115.21.226 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bandolitis.com/app/webroot/update/domain/index.php?email=
Effective URL:
http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email=
Submission: On June 04 via automatic, source phishtank (June 4th 2017, 11:44:05 am UTC)

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 50.115.21.226, located in Tampa, United States and belongs to AS-KGIX - KGIX, US. The main domain is bandolitis.com.

This is the only time bandolitis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	50.115.21.226 50.115.21.226	53861 (AS-KGIX) (AS-KGIX - KGIX)
8	202.65.210.237 202.65.210.237	9584 (GENESIS-A...) (GENESIS-AP Diyixian.com Limited)
1	212.72.4.128 212.72.4.128	28885 (OMANTEL-N...) (OMANTEL-NAP-AS OmanTel NAP)
12	3

3 50.115.21.226 (Tampa, United States)

ASN53861 (AS-KGIX - KGIX, US)
PTR: caelis.sudns.com

bandolitis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 202.65.210.237 (Hong Kong)

ASN9584 (GENESIS-AP Diyixian.com Limited, HK)
PTR: static-ip-237-210-65-202.rev.dyxnet.com

mail.gangshitape.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.72.4.128 (Oman)

ASN28885 (OMANTEL-NAP-AS OmanTel NAP, OM)
PTR: mail.omantel.net.om

mail.omantel.net.om	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	gangshitape.com mail.gangshitape.com	15 KB
3	bandolitis.com bandolitis.com	10 KB
1	omantel.net.om mail.omantel.net.om	61 B
12	3

	Domain	Requested by
8	mail.gangshitape.com	bandolitis.com
3	bandolitis.com	bandolitis.com
1	mail.omantel.net.om	bandolitis.com
12	3

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com

Subject Issuer	Validity	Valid
mail.omantel.net.om thawte SSL CA - G2	`2015-02-24` - `2018-02-25`	3 years	crt.sh

This page contains 1 frames:

Primary Page: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email=
Frame ID: 4147.1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

12
Requests

8 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

25 kB
Transfer

32 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://go.microsoft.com/fwlink/?LinkId=65796
Title: security risks

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response bandolitis.com/app/webroot/update/domain/ Redirect Chain http://bandolitis.com/app/webroot/update/domain/index.php?email= http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email=	10 KB 10 KB	167ms 167ms	Document text/html	50.115.21.226 KGIX
General Check archive.org Show headers Download Go to Full URL http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 50.115.21.226 Tampa, United States, ASN53861 (AS-KGIX - KGIX, US), Reverse DNS caelis.sudns.com Software Apache / Resource Hash `d39012fe18179d7c5b80bbcca4eabf55593d779a6ad211974ced62e141912d2b` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host bandolitis.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:52 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Transfer-Encoding chunked Content-Type text/html Redirect headers Location login.php?rand=WebAppSecurity.1&email= Date Sun, 04 Jun 2017 11:43:51 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 0 Content-Type text/html
GET H/1.1	200 OK	Cookie set logon.css mail.gangshitape.com/owa/14.2.247.5/themes/resources/	2 KB 1 KB	2264ms 296ms	Stylesheet text/css	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/css,/;q=0.1 Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Content-Encoding gzip ETag "041d1e7bfa9cc1:0" Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Cache-Control public,max-age=2592000 Set-Cookie OutlookSession=071401d5a98044b1ab197d76bfd0fc6a; path=/; HttpOnly Accept-Ranges bytes Content-Length 1037
GET H/1.1	200 OK	Cookie set owafont.css mail.gangshitape.com/owa/14.2.247.5/themes/resources/	5 KB 2 KB	2267ms 297ms	Stylesheet text/css	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/owafont.css Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/css,/;q=0.1 Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Content-Encoding gzip ETag "041d1e7bfa9cc1:0" Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Cache-Control public,max-age=2592000 Set-Cookie OutlookSession=352391ec51b34a95b4ab71841d119413; path=/; HttpOnly Accept-Ranges bytes Content-Length 1773
GET H/1.1	404 Not Found	Cookie set lgntopl.gif bandolitis.com/app/webroot/update/domain/owned/	1 KB 0	647ms 647ms	Image text/html	50.115.21.226 KGIX
General Check archive.org Show headers Download Go to Show image Full URL http://bandolitis.com/app/webroot/update/domain/owned/lgntopl.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 50.115.21.226 Tampa, United States, ASN53861 (AS-KGIX - KGIX, US), Reverse DNS caelis.sudns.com Software Apache / Resource Hash `214e9142584ca459d8c386ed1de8116d72cd54e1592dc984c73df2235f741989` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host bandolitis.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:54 GMT Server Apache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Connection Keep-Alive Set-Cookie PHPSESSID=o619ujlo6j2cch8vgkre94g1d6; path=/ Content-Type text/html; charset=UTF-8 Keep-Alive timeout=5, max=98 Content-Length 11264
GET H/1.1	404 Not Found	Cookie set lgntopr.gif bandolitis.com/app/webroot/update/domain/owned/	1 KB 0	754ms 753ms	Image text/html	50.115.21.226 KGIX
General Check archive.org Show headers Download Go to Show image Full URL http://bandolitis.com/app/webroot/update/domain/owned/lgntopr.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 50.115.21.226 Tampa, United States, ASN53861 (AS-KGIX - KGIX, US), Reverse DNS caelis.sudns.com Software Apache / Resource Hash `81f11419074840e255cdb83789a48d55cb07ff6971e399ebcb6b7d1fd93c4d0c` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host bandolitis.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:54 GMT Server Apache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Connection Keep-Alive Set-Cookie PHPSESSID=5jdq48llk7iahfqt7aflt2rmr2; path=/ Content-Type text/html; charset=UTF-8 Keep-Alive timeout=5, max=100 Content-Length 11264
GET H/1.1	200 OK	CookieAuth.dll mail.omantel.net.om/	61 B 61 B	751ms 123ms	Image image/gif	212.72.4.128 OMANTEL-NAP-AS Om...
General Check archive.org Show headers Download Go to Show image Full URL https://mail.omantel.net.om/CookieAuth.dll?GetPic?formdir=1&image=lgnexlogo.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Security TLS 1.0, RSA, AES_128_CBC Server 212.72.4.128 , Oman, ASN28885 (OMANTEL-NAP-AS OmanTel NAP, OM), Reverse DNS mail.omantel.net.om Software / Resource Hash `b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host mail.omantel.net.om Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Cache-control max-age=604800 Connection close Content-Length 61 Content-Type image/gif
GET H/1.1	200 OK	lgnbotl.gif mail.gangshitape.com/owa/14.2.247.5/themes/resources/	9 KB 9 KB	261ms 260ms	Image image/gif	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Show image Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/lgnbotl.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Cookie OutlookSession=352391ec51b34a95b4ab71841d119413 Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET ETag "041d1e7bfa9cc1:0" Content-Type image/gif Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 9311
GET H/1.1	200 OK	lgnbotr.gif mail.gangshitape.com/owa/14.2.247.5/themes/resources/	2 KB 2 KB	259ms 258ms	Image image/gif	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Show image Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/lgnbotr.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Cookie OutlookSession=352391ec51b34a95b4ab71841d119413 Connection keep-alive Cache-Control no-cache Referer http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET ETag "041d1e7bfa9cc1:0" Content-Type image/gif Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 2392
GET H/1.1	200 OK	lgntopm.gif mail.gangshitape.com/owa/14.2.247.5/themes/resources/	58 B 58 B	260ms 260ms	Image image/gif	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Show image Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/lgntopm.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css Cookie OutlookSession=352391ec51b34a95b4ab71841d119413 Connection keep-alive Cache-Control no-cache Referer http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET ETag "041d1e7bfa9cc1:0" Content-Type image/gif Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 58
GET H/1.1	200 OK	lgnleft.gif mail.gangshitape.com/owa/14.2.247.5/themes/resources/	290 B 290 B	516ms 258ms	Image image/gif	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Show image Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/lgnleft.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css Cookie OutlookSession=352391ec51b34a95b4ab71841d119413 Connection keep-alive Cache-Control no-cache Referer http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET ETag "041d1e7bfa9cc1:0" Content-Type image/gif Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 290
GET H/1.1	200 OK	lgnright.gif mail.gangshitape.com/owa/14.2.247.5/themes/resources/	306 B 306 B	518ms 260ms	Image image/gif	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Show image Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/lgnright.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css Cookie OutlookSession=352391ec51b34a95b4ab71841d119413 Connection keep-alive Cache-Control no-cache Referer http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET ETag "041d1e7bfa9cc1:0" Content-Type image/gif Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 306
GET H/1.1	200 OK	lgnbotm.gif mail.gangshitape.com/owa/14.2.247.5/themes/resources/	276 B 276 B	519ms 260ms	Image image/gif	202.65.210.237 GENESIS-AP Diyixi...
General Check archive.org Show headers Download Go to Show image Full URL http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/lgnbotm.gif Requested by Host: bandolitis.com URL: http://bandolitis.com/app/webroot/update/domain/login.php?rand=WebAppSecurity.1&email= Protocol HTTP/1.1 Server 202.65.210.237 , Hong Kong, ASN9584 (GENESIS-AP Diyixian.com Limited, HK), Reverse DNS static-ip-237-210-65-202.rev.dyxnet.com Software Microsoft-IIS/7.5 / ASP.NET Resource Hash `6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host mail.gangshitape.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css Cookie OutlookSession=352391ec51b34a95b4ab71841d119413 Connection keep-alive Cache-Control no-cache Referer http://mail.gangshitape.com/owa/14.2.247.5/themes/resources/logon.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Sun, 04 Jun 2017 11:43:53 GMT Last-Modified Wed, 23 Nov 2011 09:11:38 GMT Server Microsoft-IIS/7.5 X-Powered-By ASP.NET ETag "041d1e7bfa9cc1:0" Content-Type image/gif Cache-Control public,max-age=2592000 Accept-Ranges bytes Content-Length 276

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bandolitis.com/	1970-01-01 00:00:00	Name: PHPSESSID Value: 5jdq48llk7iahfqt7aflt2rmr2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bandolitis.com
mail.gangshitape.com
mail.omantel.net.om
202.65.210.237
212.72.4.128
50.115.21.226
0e2cda541bf24815df2facd5729d44b70ef4e4bdd160169295944aefc9e51b0b
214e9142584ca459d8c386ed1de8116d72cd54e1592dc984c73df2235f741989
5a8a50bbfec3340a13879de71a5dbe889eca252ac9cfb523c6cea94f05b7b673
6097839fd066f359bbe21fb228714cd33385a6995a060eaa504ee190e3c1178a
81f11419074840e255cdb83789a48d55cb07ff6971e399ebcb6b7d1fd93c4d0c
96a4b86c4a5ff1f1aa67c52287be64ebd51598d32cbd1249351e462cae549185
97305ffb8ff74176df42bcd213e7cdfd7679630e19911a2db7b399c7960aec3e
9d894a6800fd18d20423c66066097b9653be9eb3796f6a0e216dca220c45d6d6
a9626d4f60b20f2da50f763f20d891a70625dde0dba68116896026c400b8b775
b125c5f621a199d89bc496740d7dac72f1a8462465a1b61e331727f5d369b2f4
d39012fe18179d7c5b80bbcca4eabf55593d779a6ad211974ced62e141912d2b
da50bcb5382766a7c25162bbfd523928ccecf337ed574af0b249a59b546cb834

bandolitis.com Open in urlscan Pro 50.115.21.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

12 Requests

8 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

25 kBTransfer

32 kBSize

1 Cookies

1 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

bandolitis.com Open in urlscan Pro
50.115.21.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

8 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

25 kB
Transfer

32 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!