site.pcplus.ge Open in urlscan Pro
188.93.88.27 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u.to/r9xpGA
Effective URL:
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/l...
Submission: On May 14 via manual (May 14th 2020, 9:35:20 pm UTC) from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 10 HTTP transactions. The main IP is 188.93.88.27, located in Tbilisi, Georgia and belongs to CLOUD9, GE. The main domain is site.pcplus.ge.

This is the only time site.pcplus.ge was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	195.216.243.155 195.216.243.155	57724 (DDOS-GUARD) (DDOS-GUARD)
1	2606:4700:303... 2606:4700:3035::6818:6813	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:6b8::1:119 2a02:6b8::1:119	13238 (YANDEX) (YANDEX)
1 2	88.212.201.204 88.212.201.204	39134 (UNITEDNET) (UNITEDNET)
3 7	188.93.88.27 188.93.88.27	57814 (CLOUD9) (CLOUD9)
10	6

1 195.216.243.155 (Moscow, Russian Federation)

ASN57724 (DDOS-GUARD, RU)
PTR: s5.unet.com

u.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::6818:6813 (United States)

ASN13335 (CLOUDFLARENET, US)

drupal.zserver.mindlogicsinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:6b8::1:119 (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.212.201.204 (Russian Federation) 1 redirects

ASN39134 (UNITEDNET, RU)
PTR: host204.rax.ru

counter.yadro.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 188.93.88.27 (Tbilisi, Georgia) 3 redirects

ASN57814 (CLOUD9, GE)
PTR: mail.it-solutions.ge

site.pcplus.ge	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pcplus.ge 3 redirects site.pcplus.ge	70 KB
2	yadro.ru 1 redirects counter.yadro.ru	918 B
1	yandex.ru mc.yandex.ru	92 KB
1	mindlogicsinc.com drupal.zserver.mindlogicsinc.com	598 B
1	u.to u.to	1021 B
10	5

	Domain	Requested by
7	site.pcplus.ge	3 redirects site.pcplus.ge
2	counter.yadro.ru	1 redirects
1	mc.yandex.ru	u.to
1	drupal.zserver.mindlogicsinc.com	u.to
1	u.to
10	5

This site contains no links.

Subject Issuer	Validity	Valid
u.to Sectigo RSA Domain Validation Secure Server CA	`2019-08-23` - `2021-08-22`	2 years	crt.sh
mc.yandex.ru Yandex CA	`2019-09-23` - `2020-09-22`	a year	crt.sh
counter.yadro.ru GoGetSSL ECC DV CA	`2020-02-02` - `2022-05-02`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
Frame ID: 827E4D6EE5B49A365354A09C14F7B2F9
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u.to/r9xpGA Page URL
http://drupal.zserver.mindlogicsinc.com/useca/drupal.php Page URL
http://site.pcplus.ge/img/banners/78467/ HTTP 302
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiOD... HTTP 301
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiOD... HTTP 302
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiOD... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

10
Requests

30 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

163 kB
Transfer

433 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u.to/r9xpGA Page URL
http://drupal.zserver.mindlogicsinc.com/useca/drupal.php Page URL
http://site.pcplus.ge/img/banners/78467/ HTTP 302
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY= HTTP 301
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/ HTTP 302
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/r9xpGA;1589492096325 HTTP 302
https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/r9xpGA;1589492096325

Request Chain 4

https://mc.yandex.ru/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2Fr9xpGA&charset=utf-8&browser-info=ti%3A10%3Ans%3A1589492096121%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200514233456%3Aet%3A1589492097%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A980409943941%3Arqn%3A1%3Arn%3A282891644%3Ahid%3A326322316%3Ads%3A1%2C123%2C51%2C1%2C5%2C0%2C0%2C%2C%2C207%2C%2C%2C%3Agdpr%3A14%3Av%3A1853%3Awv%3A2%3Arqnl%3A1%3Ast%3A1589492097%3Au%3A1589492097101767423%3At%3ARedirecting HTTP 302
https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fr9xpGA&charset=utf-8&browser-info=ti%3A10%3Ans%3A1589492096121%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200514233456%3Aet%3A1589492097%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A980409943941%3Arqn%3A1%3Arn%3A282891644%3Ahid%3A326322316%3Ads%3A1%2C123%2C51%2C1%2C5%2C0%2C0%2C%2C%2C207%2C%2C%2C%3Agdpr%3A14%3Av%3A1853%3Awv%3A2%3Arqnl%3A1%3Ast%3A1589492097%3Au%3A1589492097101767423%3At%3ARedirecting

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set r9xpGA
u.to/ 1003 B
1021 B 175ms
51ms Document
text/html 195.216.243.155
DDOS-GUARD

General

Check archive.org

Show headers Download Go to

Full URL: https://u.to/r9xpGA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.216.243.155 Moscow, Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS: s5.unet.com
Software: nginx/1.8.0 /
Resource Hash

Request headers

Host: u.to
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx/1.8.0
Date: Thu, 14 May 2020 21:34:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Set-Cookie: lng=en; path=/; expires=Fri, 14-May-2021 21:34:56 GMT; domain=.u.to;
Cache-Control: no-cache no-store
Pragma: no-cache
Vary: host
Content-Encoding: gzip

GET
H/1.1 200
OK Cookie set drupal.php
drupal.zserver.mindlogicsinc.com/useca/ 85 B
598 B 456ms
414ms Document
text/html 2606:4700:3035::6818:6813
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://drupal.zserver.mindlogicsinc.com/useca/drupal.php
Requested by: Host: u.to
URL: https://u.to/r9xpGA
Protocol: HTTP/1.1
Server: 2606:4700:3035::6818:6813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Host: drupal.zserver.mindlogicsinc.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 14 May 2020 21:34:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dd278c308374f25c209915fc120a484881589492096; expires=Sat, 13-Jun-20 21:34:56 GMT; path=/; domain=.mindlogicsinc.com; HttpOnly; SameSite=Lax
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 5937bf026dd464d9-FRA
Content-Encoding: gzip
cf-request-id: 02b6b5b581000064d9e6b62200000001

GET
H/1.1 200
OK tag.js
mc.yandex.ru/metrika/ 363 KB
92 KB 192ms
95ms Script
application/javascript 2a02:6b8::1:119
YANDEX

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: u.to
URL: https://u.to/r9xpGA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN13238 (YANDEX, RU),

Reverse DNS

Software

nginx/1.14.2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://u.to/r9xpGA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 14 May 2020 21:34:56 GMT
Content-Encoding: br
Last-Modified: Wed, 13 May 2020 17:57:22 GMT
Server: nginx/1.14.2
ETag: "5ebc3502-16faf"
Strict-Transport-Security: max-age=31536000
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600
Connection: keep-alive
Content-Length: 94127
Expires: Thu, 14 May 2020 22:34:56 GMT

GET
H/1.1

200
OK

hit;utostat
counter.yadro.ru/
Redirect Chain

https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/r9xpGA;1589492096325
https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/r9xpGA;1589492096325

43 B
421 B

50ms
50ms

Image
image/gif

88.212.201.204
UNITEDNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/r9xpGA;1589492096325
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 88.212.201.204 , Russian Federation, ASN39134 (UNITEDNET, RU),
Reverse DNS: host204.rax.ru
Software: nginx/1.17.9 /
Resource Hash

Request headers

Referer: https://u.to/r9xpGA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 May 2020 21:34:56 GMT
Server: nginx/1.17.9
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Cache-control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 15 May 2019 21:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 14 May 2020 21:34:56 GMT
Server: nginx/1.17.9
P3P: policyref="/w3c/p3p.xml", CP="UNI"
Location: https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/r9xpGA;1589492096325
Cache-control: no-cache
Connection: keep-alive
Content-Type: text/html
Content-Length: 32
Expires: Wed, 15 May 2019 21:00:00 GMT

GET

1
mc.yandex.ru/watch/51604940/
Redirect Chain

https://mc.yandex.ru/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2Fr9xpGA&charset=utf-8&browser-info=ti%3A10%3Ans%3A1589492096121%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3...
https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fr9xpGA&charset=utf-8&browser-info=ti%3A10%3Ans%3A1589492096121%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101...

0
0

GET advert.gif
mc.yandex.ru/metrika/ 0
0

GET
H/1.1

200
OK

Primary Request login.php Show response
site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/
Redirect Chain

http://site.pcplus.ge/img/banners/78467/
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/
http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php

802 B
1 KB

180ms
179ms

Document
text/html

188.93.88.27
CLOUD9

General

Check archive.org

Show headers Download Go to

Full URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
Protocol: HTTP/1.1
Server: 188.93.88.27 Tbilisi, Georgia, ASN57814 (CLOUD9, GE),
Reverse DNS: mail.it-solutions.ge
Software: Apache /
Resource Hash: 02f440149089609df683c2a735da235fe95316980ccfa145a9d5f44a0e05128e

Request headers

Host: site.pcplus.ge
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://drupal.zserver.mindlogicsinc.com/useca/drupal.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://drupal.zserver.mindlogicsinc.com/useca/drupal.php

Response headers

Date: Thu, 14 May 2020 21:34:57 GMT
Server: Apache
Access-Control-Allow-Origin: http://wineshop.ge
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

Redirect headers

Date: Thu, 14 May 2020 21:34:57 GMT
Server: Apache
Location: login.php
Access-Control-Allow-Origin: http://wineshop.ge
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK 1.png
site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/img/ 56 KB
56 KB 111ms
110ms Image
image/png 188.93.88.27
CLOUD9

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/img/1.png
Requested by: Host: site.pcplus.ge
URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
Protocol: HTTP/1.1
Server: 188.93.88.27 Tbilisi, Georgia, ASN57814 (CLOUD9, GE),
Reverse DNS: mail.it-solutions.ge
Software: Apache /
Resource Hash: 5aa417962afd642ad2fe47f59fb974c6f02654a2f630025cd33b9f7ca027eed1

Request headers

Referer: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 14 May 2020 21:34:57 GMT
Last-Modified: Thu, 14 May 2020 21:34:56 GMT
Server: Apache
Content-Type: image/png
Access-Control-Allow-Origin: http://wineshop.ge
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 57022

GET
H/1.1 404
Not Found login.png
site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/ 5 KB
5 KB 230ms
229ms Image
text/html 188.93.88.27
CLOUD9

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.png
Requested by: Host: site.pcplus.ge
URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
Protocol: HTTP/1.1
Server: 188.93.88.27 Tbilisi, Georgia, ASN57814 (CLOUD9, GE),
Reverse DNS: mail.it-solutions.ge
Software: Apache /
Resource Hash: 1310a7a75b884219a11a5ae01cc684edd49a6e213b5d4bd8b3a04b45f7655e57

Request headers

Referer: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 May 2020 21:34:58 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html
Access-Control-Allow-Origin: http://wineshop.ge
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 404
Not Found login.png
site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/ 7 KB
7 KB 635ms
606ms Image
text/html 188.93.88.27
CLOUD9

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.png
Requested by: Host: site.pcplus.ge
URL: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
Protocol: HTTP/1.1
Server: 188.93.88.27 Tbilisi, Georgia, ASN57814 (CLOUD9, GE),
Reverse DNS: mail.it-solutions.ge
Software: Apache /
Resource Hash: 5f9e66ca5d42a2ec35771b3eb907cb64425f8d7e7eb86e6919968173fc2f9208

Request headers

Referer: http://site.pcplus.ge/img/banners/78467/6a65c5a40b4a05c1037509aab070f29eNzkyMzc3MzQxNTc0MzdiY2NiODIzZDNlNjFiNWUwZGY=/login.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 14 May 2020 21:34:58 GMT
Server: Apache
Transfer-Encoding: chunked
Content-Type: text/html
Access-Control-Allow-Origin: http://wineshop.ge
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Expires: Thu, 19 Nov 1981 08:52:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mc.yandex.ru
URL: https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2Fr9xpGA&charset=utf-8&browser-info=ti%3A10%3Ans%3A1589492096121%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20200514233456%3Aet%3A1589492097%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Als%3A980409943941%3Arqn%3A1%3Arn%3A282891644%3Ahid%3A326322316%3Ads%3A1%2C123%2C51%2C1%2C5%2C0%2C0%2C%2C%2C207%2C%2C%2C%3Agdpr%3A14%3Av%3A1853%3Awv%3A2%3Arqnl%3A1%3Ast%3A1589492097%3Au%3A1589492097101767423%3At%3ARedirecting

Domain: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/advert.gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Bank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			site.pcplus.ge/	1969-12-31 23:59:59	Name: PHPSESSID Value: ft68bnji64hdgd7du5ffv6q4q3

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

counter.yadro.ru
drupal.zserver.mindlogicsinc.com
mc.yandex.ru
site.pcplus.ge
u.to
mc.yandex.ru
188.93.88.27
195.216.243.155
2606:4700:3035::6818:6813
2a02:6b8::1:119
88.212.201.204
02f440149089609df683c2a735da235fe95316980ccfa145a9d5f44a0e05128e
1310a7a75b884219a11a5ae01cc684edd49a6e213b5d4bd8b3a04b45f7655e57
5aa417962afd642ad2fe47f59fb974c6f02654a2f630025cd33b9f7ca027eed1
5f9e66ca5d42a2ec35771b3eb907cb64425f8d7e7eb86e6919968173fc2f9208

site.pcplus.ge Open in urlscan Pro 188.93.88.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

30 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

6 IPs

3 Countries

163 kBTransfer

433 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

site.pcplus.ge Open in urlscan Pro
188.93.88.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

30 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

163 kB
Transfer

433 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!