admintre.square7.ch Open in urlscan Pro
148.251.48.69  Malicious Activity! Public Scan

Submitted URL: http://bit.ly/2zCQf0n
Effective URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Submission: On December 28 via automatic, source openphish

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 148.251.48.69, located in Germany and belongs to HETZNER-AS, DE. The main domain is admintre.square7.ch.
This is the only time admintre.square7.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 395224 (BITLY-AS)
8 148.251.48.69 24940 (HETZNER-AS)
1 2a01:4f8:162:... 24940 (HETZNER-AS)
1 104.197.47.161 15169 (GOOGLE)
10 3
Domain Requested by
8 admintre.square7.ch admintre.square7.ch
1 www.tradeadexchange.com www.bplaced.net
1 www.bplaced.net admintre.square7.ch
1 bit.ly 1 redirects
10 4

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Frame ID: (4BD6A3BFAC778C94FA5323EE3B759EBE)
Requests: 10 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://bit.ly/2zCQf0n HTTP 301
    http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

10
Requests

0 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

0 kB
Transfer

231 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bit.ly/2zCQf0n HTTP 301
    http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Redirect Chain
  • http://bit.ly/2zCQf0n
  • http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
2 KB
0
Document
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
f41440fbc8ab50f46e563c5f2378be8ffaef5cd5403bd0868b0384241a674dc1

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:00 GMT
Server
Apache/2.4
ETag
"758-5615461488a3a"
Vary
Accept-Encoding
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
1961

Redirect headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Server
nginx
Content-Type
text/html; charset=utf-8
Location
http://admintre.square7.ch/HUSH DROP TODA-EDITED/
Set-Cookie
_bit=hbs0UU-80b7ef74313f289514-006; Domain=bit.ly; Expires=Tue, 26 Jun 2018 00:56:56 GMT
Cache-Control
private, max-age=90
Connection
keep-alive
Content-Length
136
officelogo.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
9 KB
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/officelogo.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
010da445e8c3df9019ed05532d7caaa0879eaef62761289bca71f93782fe9d56

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:22 GMT
Server
Apache/2.4
ETag
"229f-561546294ffb0"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=499
Content-Length
8863
googlelogo.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
3 KB
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/googlelogo.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
47d4e3ecf486cf9e611f4efd0ee3fb1353bad7b78e49310168ba5e5102b1de33

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:18 GMT
Server
Apache/2.4
ETag
"a30-5615462571bec"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
2608
outlooklogo.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
4 KB
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/outlooklogo.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
5536cdcf45ed63ad03a3214f532bfd01364f8f016b31c019959080e753aeed36

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:25 GMT
Server
Apache/2.4
ETag
"fc9-5615462bcfa13"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
4041
aollogo.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
919 B
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/aollogo.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
33cf2383e9a88578a6e92a30db80f030773d28055b6e7008a849ac7f8c8acb0a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:13 GMT
Server
Apache/2.4
ETag
"397-56154620bcaa7"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
919
yahoologo.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
4 KB
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/yahoologo.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
19dcc4f189dbc6b7d5c7745b26a153c5f38b263bea0dca4fd9f68791d77caefa

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:27 GMT
Server
Apache/2.4
ETag
"fe2-5615462e4f475"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
4066
weblogo.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
583 B
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/weblogo.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
554bb7b59a3ea1243bfa5b684ca0d2fe8df727d1e7007f1e1c0a5afd995516a2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:26 GMT
Server
Apache/2.4
ETag
"247-5615462d50654"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
583
bpa.js
www.bplaced.net/pub/
290 B
0
Script
General
Full URL
http://www.bplaced.net/pub/bpa.js
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
2a01:4f8:162:4306::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
Apache /
Resource Hash
27306980aebf9834eed9db219b1c67998ba46614eba6c7355c88711bad38638a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.bplaced.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
*/*
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Upgrade, Keep-Alive
Content-Length
155
X-BP-NSA-REQID
(null) a.14UID=195
Last-Modified
Sat, 07 May 2016 08:07:31 GMT
Server
Apache
ETag
"122-5323c112ad6c0-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Cache-Control
max-age=7200
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=4, max=500
Expires
Thu, 28 Dec 2017 02:56:56 GMT
background2.png
admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
209 KB
0
Image
General
Full URL
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/images/background2.png
Requested by
Host: admintre.square7.ch
URL: http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
1453db407b4b59ed96519b1c90d53a6d88be708ad66180c664bb3b7ef902aa4f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admintre.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Last-Modified
Wed, 27 Dec 2017 15:52:15 GMT
Server
Apache/2.4
ETag
"34264-56154622bb689"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=498
Content-Length
213604
display.php
www.tradeadexchange.com/a/
0
0
Script
General
Full URL
http://www.tradeadexchange.com/a/display.php?r=421215
Requested by
Host: www.bplaced.net
URL: http://www.bplaced.net/pub/bpa.js
Protocol
HTTP/1.1
Server
104.197.47.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
161.47.197.104.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.tradeadexchange.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Accept
*/*
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admintre.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 28 Dec 2017 00:56:56 GMT
Referrer-Policy
no-referrer
Server
openresty
Connection
keep-alive
Vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint

0 Cookies