tecnet.ir Open in urlscan Pro
94.130.53.217 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://smarturl.it/ndfkut
Effective URL:
https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login
Submission: On March 14 via manual (March 14th 2018, 7:47:13 pm UTC) from US

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 94.130.53.217, located in Ukraine and belongs to HETZNER-AS, DE. The main domain is tecnet.ir.
TLS certificate: Issued by Let's Encrypt Authority X3 on February 25th 2018. Valid for: 3 months.

This is the only time tecnet.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	23.21.82.93 23.21.82.93	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 9	94.130.53.217 94.130.53.217	24940 (HETZNER-AS) (HETZNER-AS)
8	1

1 23.21.82.93 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-23-21-82-93.compute-1.amazonaws.com

smarturl.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 94.130.53.217 (Ukraine) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: spring.servers.directweb.pw

tecnet.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tecnet.ir 1 redirects tecnet.ir	292 KB
1	smarturl.it 1 redirects smarturl.it	583 B
8	2

	Domain	Requested by
9	tecnet.ir	1 redirects tecnet.ir
1	smarturl.it	1 redirects
8	2

This site contains no links.

Subject Issuer	Validity	Valid
tecnet.ir Let's Encrypt Authority X3	`2018-02-25` - `2018-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login
Frame ID: 395EFD338B6A3655D8DA24B35A24D7CA
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://smarturl.it/ndfkut HTTP 301
https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/ HTTP 302
https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

292 kB
Transfer

290 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://smarturl.it/ndfkut HTTP 301
https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/ HTTP 302
https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/ Redirect Chain https://smarturl.it/ndfkut https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/ https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login	4 KB 5 KB	49ms 43ms	Document text/html	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `2542fe7ed045222ae8da4c97682d028172c7315410c5f87dbec49bd2de1c6bab` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Cache-Control no-cache Connection keep-alive User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Location ./gsuite/secure/?login Date Wed, 14 Mar 2018 19:47:09 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	b.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	260 KB 260 KB	40ms 39ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/b.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `44112f29e857ef290c47557f8e9d9a678eea9c42ea9a623314ba9ec1809c8fe3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 266258
GET H/1.1	200 OK	1.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	3 KB 3 KB	13ms 6ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/1.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `0a5e2629d7b7dd40073233073465b906dcc8565b9bb6487cac84f8d99609910b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2896
GET H/1.1	200 OK	2.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	5 KB 5 KB	17ms 2ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/2.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `95db1165c8291a24fa591c0d6689e1212155dce5436bec8ad3139f814214e7f7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 4881
GET H/1.1	200 OK	3.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	1 KB 2 KB	21ms 6ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/3.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `7e6663cd30e483abbeb337d28660ec09550a392fad42ad0e69ce2f2c7c52ad2e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1444
GET H/1.1	200 OK	4.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	5 KB 5 KB	21ms 7ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/4.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `01d7a26353df3a3b274ebac1cbfe9282f68aaad8647e23731938921f312d3656` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 4816
GET H/1.1	200 OK	5.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	4 KB 4 KB	22ms 7ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/5.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `7c6a155efc54277e13438c971192079be1a5b13d3b71f53e78c9e555ebd71e7d` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 4199
GET H/1.1	200 OK	6.png tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/	7 KB 8 KB	8ms 7ms	Image image/png	94.130.53.217 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/images/6.png Requested by Host: tecnet.ir URL: https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 94.130.53.217 , Ukraine, ASN24940 (HETZNER-AS, DE), Reverse DNS spring.servers.directweb.pw Software Apache / Resource Hash `dc9110204bc16c0bfc9b97e8348eaf0a66d7a7a0237e10a23cf54efb99b15e84` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host tecnet.ir User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login Connection keep-alive Cache-Control no-cache Referer https://tecnet.ir/wp-content/plugins/css-ready-selectors/u/me/gsuite/secure/?login User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Wed, 14 Mar 2018 19:47:09 GMT Last-Modified Mon, 12 Mar 2018 15:54:40 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 7573

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| unhideBody function| popupwnd

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

smarturl.it
tecnet.ir
23.21.82.93
94.130.53.217
01d7a26353df3a3b274ebac1cbfe9282f68aaad8647e23731938921f312d3656
0a5e2629d7b7dd40073233073465b906dcc8565b9bb6487cac84f8d99609910b
2542fe7ed045222ae8da4c97682d028172c7315410c5f87dbec49bd2de1c6bab
44112f29e857ef290c47557f8e9d9a678eea9c42ea9a623314ba9ec1809c8fe3
7c6a155efc54277e13438c971192079be1a5b13d3b71f53e78c9e555ebd71e7d
7e6663cd30e483abbeb337d28660ec09550a392fad42ad0e69ce2f2c7c52ad2e
95db1165c8291a24fa591c0d6689e1212155dce5436bec8ad3139f814214e7f7
dc9110204bc16c0bfc9b97e8348eaf0a66d7a7a0237e10a23cf54efb99b15e84

tecnet.ir Open in urlscan Pro 94.130.53.217 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

292 kBTransfer

290 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

tecnet.ir Open in urlscan Pro
94.130.53.217 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

292 kB
Transfer

290 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!