printkea.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 2001:8d8:100f:f000::28b, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is printkea.com.

This is the only time printkea.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 4	2001:8d8:100f... 2001:8d8:100f:f000::28b		8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
3	2

4 2001:8d8:100f:f000::28b (Germany) 1 redirects

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)

printkea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	printkea.com 1 redirects printkea.com	3 MB
3	1

	Domain	Requested by
4	printkea.com	1 redirects printkea.com
3	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://printkea.com/modules/cronjobs/classes/proforma/
Frame ID: B68F620FB2B20E5EA62ACFA0760231F9
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://printkea.com/modules/cronjobs/classes/proforma HTTP 301
http://printkea.com/modules/cronjobs/classes/proforma/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

3
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

3476 kB
Transfer

3490 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://printkea.com/modules/cronjobs/classes/proforma HTTP 301
http://printkea.com/modules/cronjobs/classes/proforma/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response printkea.com/modules/cronjobs/classes/proforma/ Redirect Chain http://printkea.com/modules/cronjobs/classes/proforma http://printkea.com/modules/cronjobs/classes/proforma/	16 KB 12 KB	57ms 57ms	Document text/html	2001:8d8:100f:f000::28b ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://printkea.com/modules/cronjobs/classes/proforma/ Protocol HTTP/1.1 Server 2001:8d8:100f:f000::28b , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / PHP/7.1.33 Resource Hash `59cf024c1c3c75df4deef0c754af5f08840e8b7ad1eee809596f62c6dd7958d3` Request headers Host printkea.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=15 Date Mon, 20 Jul 2020 19:33:16 GMT Server Apache X-Powered-By PHP/7.1.33 Content-Encoding gzip Redirect headers Content-Type text/html; charset=iso-8859-1 Content-Length 262 Connection keep-alive Keep-Alive timeout=15 Date Mon, 20 Jul 2020 19:33:16 GMT Server Apache Location http://printkea.com/modules/cronjobs/classes/proforma/
GET H/1.1	403 Forbidden	google_analytics_auto.js printkea.com/	0 0	39ms 39ms	Script text/html	2001:8d8:100f:f000::28b ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Full URL http://printkea.com/google_analytics_auto.js Requested by Host: printkea.com URL: http://printkea.com/modules/cronjobs/classes/proforma/ Protocol HTTP/1.1 Server 2001:8d8:100f:f000::28b , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / PHP/7.1.33 Resource Hash Request headers Referer http://printkea.com/modules/cronjobs/classes/proforma/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 20 Jul 2020 19:33:16 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/7.1.33 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Connection keep-alive Keep-Alive timeout=15
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d9761c7ea32ff03a2cec49392fa8c50350213e05560227246285914c16c8bc10` Request headers Referer http://printkea.com/modules/cronjobs/classes/proforma/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fa9c80b1c77af30d4bbf5930a20883e28909b4591c0f9d5d045d1e5f22fa9dcc` Request headers Referer http://printkea.com/modules/cronjobs/classes/proforma/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	pobg.gif printkea.com/modules/cronjobs/classes/proforma/	3 MB 3 MB	12ms 11ms	Image image/gif	2001:8d8:100f:f000::28b ONEANDONE-AS Brau...
General Check archive.org Show headers Download Go to Show image Full URL http://printkea.com/modules/cronjobs/classes/proforma/pobg.gif Requested by Host: printkea.com URL: http://printkea.com/modules/cronjobs/classes/proforma/ Protocol HTTP/1.1 Server 2001:8d8:100f:f000::28b , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE), Reverse DNS Software Apache / Resource Hash `a210b28a6b1be655e3f077da0b9be0e2384cc4d0424add48d7690b8ef27f807a` Request headers Referer http://printkea.com/modules/cronjobs/classes/proforma/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 20 Jul 2020 19:33:16 GMT Last-Modified Wed, 04 Mar 2020 03:23:52 GMT Server Apache ETag "361fc2-59ffef3152da7" Content-Type image/gif Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=15 Content-Length 3547074

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

printkea.com
2001:8d8:100f:f000::28b
59cf024c1c3c75df4deef0c754af5f08840e8b7ad1eee809596f62c6dd7958d3
a210b28a6b1be655e3f077da0b9be0e2384cc4d0424add48d7690b8ef27f807a
d9761c7ea32ff03a2cec49392fa8c50350213e05560227246285914c16c8bc10
fa9c80b1c77af30d4bbf5930a20883e28909b4591c0f9d5d045d1e5f22fa9dcc

printkea.com Open in urlscan Pro 2001:8d8:100f:f000::28b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

3 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

3476 kBTransfer

3490 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

printkea.com Open in urlscan Pro
2001:8d8:100f:f000::28b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

3476 kB
Transfer

3490 kB
Size

0
Cookies

3 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!