u-h-x.com Open in urlscan Pro
142.44.163.33 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://u-h-x.com/ATB/
Submission: On September 12 via manual (September 12th 2018, 7:12:18 pm UTC) from RU

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 142.44.163.33, located in Victoria, Canada and belongs to OVH, FR. The main domain is u-h-x.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 10th 2018. Valid for: 3 months.

This is the only time u-h-x.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ATB Financial (Banking)

Domain & IP information

	IP Address	AS Autonomous System
12	142.44.163.33 142.44.163.33	16276 (OVH) (OVH)
3	23.38.53.224 23.38.53.224	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
15	3

12 142.44.163.33 (Victoria, Canada)

ASN16276 (OVH, FR)
PTR: 33.ip-142-44-163.net

u-h-x.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.38.53.224 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-53-224.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	u-h-x.com u-h-x.com	474 KB
3	typekit.net use.typekit.net
15	2

	Domain	Requested by
12	u-h-x.com	u-h-x.com
3	use.typekit.net	u-h-x.com
15	2

This site contains no links.

Subject Issuer	Validity	Valid
u-h-x.com cPanel, Inc. Certification Authority	`2018-09-10` - `2018-12-09`	3 months	crt.sh
*.typekit.net DigiCert SHA2 Secure Server CA	`2018-07-20` - `2020-01-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://u-h-x.com/ATB/
Frame ID: 5465A63014670D21A275CC93D53FE5F2
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

474 kB
Transfer

507 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
u-h-x.com/ATB/ 9 KB
9 KB 2612ms
95ms Document
text/html 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: 27ea790011890a1be0cc6b3f4b09a80807a9386793b289a462d77764751a0725

Request headers

Host: u-h-x.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 5465A63014670D21A275CC93D53FE5F2

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Server: Apache
Last-Modified: Thu, 28 Jun 2018 03:11:14 GMT
Accept-Ranges: bytes
Content-Length: 9423
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

GET
H/1.1 200
OK modal.js Show response
u-h-x.com/ATB/login_files/ 14 KB
14 KB 96ms
94ms Script
application/javascript 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/login_files/modal.js
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: 3cac4b1254742ce96465863630f4eac5855ab8ae37d7a1b5f053ff9cb53a2ad0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 14159

GET
H/1.1 200
OK fonts.css
u-h-x.com/ATB/login_files/ 100 KB
101 KB 190ms
94ms Stylesheet
text/css 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/login_files/fonts.css
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 102888

GET
H/1.1 200
OK commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
u-h-x.com/ATB/login_files/ 281 KB
281 KB 282ms
93ms Stylesheet
text/css 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: 0d907e7f625414ada5233eca976a1ec7e692ae3c60fd5ec5aa7b30eb68a65462

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 287542

GET
H/1.1 200
OK publicStyles_86C5E2F4EF393FED31A1B696F3DC0460.css
u-h-x.com/ATB/login_files/ 4 KB
4 KB 287ms
96ms Stylesheet
text/css 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/login_files/publicStyles_86C5E2F4EF393FED31A1B696F3DC0460.css
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: 7f7b5082551c8790782e5a20e8bdbde2383128eb25a3e2843418b862c5b5fb82

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4286

GET
H/1.1 200
OK header-gradient.jpg
u-h-x.com/ATB/login_files/ 760 B
1002 B 94ms
94ms Image
image/jpeg 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-h-x.com/ATB/login_files/header-gradient.jpg
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: 72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 760

GET
H/1.1 200
OK DESGetFiles.css
u-h-x.com/ATB/login_files/ 1 KB
1 KB 288ms
97ms Stylesheet
text/css 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/login_files/DESGetFiles.css
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: ea8b70eabe7e46cf87aa92355da0498dc4d47d41c95871e4bcdf96423dbcb38a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1220

GET
H/1.1 200
OK error.gif
u-h-x.com/ATB/login_files/ 129 B
370 B 94ms
94ms Image
image/gif 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-h-x.com/ATB/login_files/error.gif
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: 205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:06 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 129

GET
H/1.1 200
OK CMP-c3ca772b-20c8-0984-cab4-5d14a1b57c76.jpg
u-h-x.com/ATB/login_files/ 61 KB
61 KB 94ms
94ms Image
image/jpeg 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u-h-x.com/ATB/login_files/CMP-c3ca772b-20c8-0984-cab4-5d14a1b57c76.jpg
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash: ad399792d355e57c5d14641567e1541a702e814d3cda1676b53a4aeb40a37190

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://u-h-x.com/ATB/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://u-h-x.com/ATB/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Wed, 12 Sep 2018 19:12:07 GMT
Last-Modified: Sat, 20 Jan 2018 22:27:46 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 62270

GET
S 404 l
use.typekit.net/af/c46797/00000000000000000001709a/27/ 0
0 144ms
131ms Font
text/plain 23.38.53.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/c46797/00000000000000000001709a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3

Requested by

Host: u-h-x.com
URL: https://u-h-x.com/ATB/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.53.224 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-53-224.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://u-h-x.com/ATB/
Origin: https://u-h-x.com

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
server: nginx
date: Wed, 12 Sep 2018 19:12:07 GMT
status: 404, 404 Not Found
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
timing-allow-origin: *
content-length: 9

GET
DATA 200
OK truncated
/ 13 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 14a174147ddbddee334cdcacd0d485cfa340080b2f28f312cbed56fd1ec9b482

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://u-h-x.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 13 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 936aaa639be8fa6c83d6090a016cf175282c6102980ebb6ef79e84cd25ecf950

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://u-h-x.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
H/1.1 404
Not Found fontawesome-webfont.woff2
u-h-x.com/ATB/login_files/ 0
0 98ms
97ms Font
text/html 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/ATB/login_files/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Origin: https://u-h-x.com
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Origin: https://u-h-x.com

Response headers

Date: Wed, 12 Sep 2018 19:12:07 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 358
Content-Type: text/html; charset=iso-8859-1

GET
DATA 200
OK truncated
/ 5 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 297a5269f31b7c501886f8f980b01e5e14048f7f8f279ce1fb76f33e3edd6a14

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://u-h-x.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 5 KB
0 Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 138376ba413b29d8a4354768884cfa9f31417e682385990bdc02136cc2616087

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin: https://u-h-x.com

Response headers

Access-Control-Allow-Origin: *
Content-Type: application/x-font-woff2

GET
H/1.1 404
Not Found fontawesome-webfont.woff
u-h-x.com/Themes/fonts/font-awesome/fonts/ 0
0 94ms
94ms Font
text/html 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff?v=4.7.0
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Origin: https://u-h-x.com
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Origin: https://u-h-x.com

Response headers

Date: Wed, 12 Sep 2018 19:12:07 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 373
Content-Type: text/html; charset=iso-8859-1

GET
S 404 d
use.typekit.net/af/c46797/00000000000000000001709a/27/ 0
0 127ms
127ms Font
text/plain 23.38.53.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/c46797/00000000000000000001709a/27/d?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3

Requested by

Host: u-h-x.com
URL: https://u-h-x.com/ATB/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.53.224 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-53-224.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://u-h-x.com/ATB/
Origin: https://u-h-x.com

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
server: nginx
date: Wed, 12 Sep 2018 19:12:07 GMT
status: 404, 404 Not Found
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
timing-allow-origin: *
content-length: 9

GET
H/1.1 404
Not Found fontawesome-webfont.ttf
u-h-x.com/Themes/fonts/font-awesome/fonts/ 0
0 93ms
93ms Font
text/html 142.44.163.33
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://u-h-x.com/Themes/fonts/font-awesome/fonts/fontawesome-webfont.ttf?v=4.7.0
Requested by: Host: u-h-x.com
URL: https://u-h-x.com/ATB/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 142.44.163.33 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS: 33.ip-142-44-163.net
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Origin: https://u-h-x.com
Accept-Encoding: gzip, deflate
Host: u-h-x.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://u-h-x.com/ATB/login_files/commonStyles_C304D86F2DA8F5DCE9622B2047E948C6.css
Origin: https://u-h-x.com

Response headers

Date: Wed, 12 Sep 2018 19:12:07 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 372
Content-Type: text/html; charset=iso-8859-1

GET
S 404 a
use.typekit.net/af/c46797/00000000000000000001709a/27/ 0
0 127ms
126ms Font
text/plain 23.38.53.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/af/c46797/00000000000000000001709a/27/a?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3

Requested by

Host: u-h-x.com
URL: https://u-h-x.com/ATB/

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.38.53.224 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a23-38-53-224.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://u-h-x.com/ATB/
Origin: https://u-h-x.com

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
server: nginx
date: Wed, 12 Sep 2018 19:12:07 GMT
status: 404, 404 Not Found
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
x-cascade: pass
timing-allow-origin: *
content-length: 9

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ATB Financial (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

u-h-x.com
use.typekit.net
142.44.163.33
23.38.53.224
0d907e7f625414ada5233eca976a1ec7e692ae3c60fd5ec5aa7b30eb68a65462
138376ba413b29d8a4354768884cfa9f31417e682385990bdc02136cc2616087
14a174147ddbddee334cdcacd0d485cfa340080b2f28f312cbed56fd1ec9b482
205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f
27ea790011890a1be0cc6b3f4b09a80807a9386793b289a462d77764751a0725
297a5269f31b7c501886f8f980b01e5e14048f7f8f279ce1fb76f33e3edd6a14
3cac4b1254742ce96465863630f4eac5855ab8ae37d7a1b5f053ff9cb53a2ad0
72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411
7f7b5082551c8790782e5a20e8bdbde2383128eb25a3e2843418b862c5b5fb82
936aaa639be8fa6c83d6090a016cf175282c6102980ebb6ef79e84cd25ecf950
ad399792d355e57c5d14641567e1541a702e814d3cda1676b53a4aeb40a37190
bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a
ea8b70eabe7e46cf87aa92355da0498dc4d47d41c95871e4bcdf96423dbcb38a

u-h-x.com Open in urlscan Pro 142.44.163.33 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

474 kBTransfer

507 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

u-h-x.com Open in urlscan Pro
142.44.163.33 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

474 kB
Transfer

507 kB
Size

0
Cookies

15 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!