dr-karimzadeh.ir Open in urlscan Pro
158.58.187.174  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response dr-karimzadeh.ir/vklcxx/6yter35/	3 KB 2 KB	1410ms 969ms	Document text/html	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash d18ac166ea1fb39897e631de04a3052876722b11953b776ed160d7f871f3f187 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers :method GET :authority dr-karimzadeh.ir :scheme https :path /vklcxx/6yter35/login.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers set-cookie PHPSESSID=af1cd6abdb0216c7b5b14ba72ea4d943; path=/; secure expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache content-type text/html; charset=UTF-8 content-length 1125 content-encoding br vary Accept-Encoding date Sat, 23 Jan 2021 00:14:59 GMT x-content-type nosniff x_forwarded_for 104.16.77.187 remote_addr 104.16.77.187 server www.fbi.gov host www.fbi.gov origin https://www.fbi.gov referer https://www.fbi.gov x-forwarded-host www.fbi.gov x-forwarded-proto https x-xss-protection 1; mode=block alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET H3-Q050	200	bootstrap.css dr-karimzadeh.ir/vklcxx/6yter35/assets/css/	138 KB 19 KB	579ms 347ms	Stylesheet text/css	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/css/bootstrap.css Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 19095 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:27:51 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type text/css cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	login.css dr-karimzadeh.ir/vklcxx/6yter35/assets/css/	2 KB 914 B	519ms 288ms	Stylesheet text/css	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/css/login.css Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 35c946cbc580e838b6b3255ee94576ad8c31a741af87ee42a9fc27ccdb852f54 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 584 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:27:52 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type text/css cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	jquery.min.js Show response dr-karimzadeh.ir/vklcxx/6yter35/assets/js/	85 KB 29 KB	579ms 348ms	Script application/javascript	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/js/jquery.min.js Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 29658 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:28:00 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	popper.min.js Show response dr-karimzadeh.ir/vklcxx/6yter35/assets/js/	20 KB 7 KB	579ms 348ms	Script application/javascript	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/js/popper.min.js Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58 Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 6953 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:28:01 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	bootstrap.min.js Show response dr-karimzadeh.ir/vklcxx/6yter35/assets/js/	100 KB 13 KB	519ms 288ms	Script application/javascript	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/js/bootstrap.min.js Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 829ad53bf9c48fdeef3adbea95a53e8b57c4499198be68b1b7c1ac353790f50c Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 13441 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:27:59 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	logo.svg dr-karimzadeh.ir/vklcxx/6yter35/assets/images/	4 KB 1 KB	123ms 122ms	Image image/svg+xml	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Show image Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/images/logo.svg Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 1369 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:27:56 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	ellipsis_white.svg dr-karimzadeh.ir/vklcxx/6yter35/assets/images/	915 B 289 B	123ms 123ms	Image image/svg+xml	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Show image Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/images/ellipsis_white.svg Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/login.php Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/login.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT content-encoding br origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 220 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:27:55 GMT x-forwarded-host www.fbi.gov host www.fbi.gov vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT
GET H3-Q050	200	background.jpg dr-karimzadeh.ir/vklcxx/6yter35/assets/images/	277 KB 277 KB	124ms 123ms	Image image/jpeg	158.58.187.174 RAYANEGAR
General Check archive.org Show headers Download Go to Show image Full URL https://dr-karimzadeh.ir/vklcxx/6yter35/assets/images/background.jpg Requested by Host: dr-karimzadeh.ir URL: https://dr-karimzadeh.ir/vklcxx/6yter35/assets/css/login.css Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 158.58.187.174 Tehran, Iran, Islamic Republic Of, ASN48732 (RAYANEGAR, IR), Reverse DNS 158-58-187-174.hostnegar.com Software www.fbi.gov / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://dr-karimzadeh.ir/vklcxx/6yter35/assets/css/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 23 Jan 2021 00:15:00 GMT origin https://www.fbi.gov x_forwarded_for 104.16.77.187 x-forwarded-proto https content-length 283351 x-xss-protection 1; mode=block server www.fbi.gov x-content-type nosniff remote_addr 104.16.77.187 last-modified Mon, 29 Jun 2020 11:27:54 GMT x-forwarded-host www.fbi.gov host www.fbi.gov content-type image/jpeg cache-control public, max-age=604800 referer https://www.fbi.gov accept-ranges bytes expires Sat, 30 Jan 2021 00:15:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			dr-karimzadeh.ir/	1969-12-31 23:59:59	Name: PHPSESSID Value: af1cd6abdb0216c7b5b14ba72ea4d943

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dr-karimzadeh.ir
158.58.187.174
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
35c946cbc580e838b6b3255ee94576ad8c31a741af87ee42a9fc27ccdb852f54
3beb48429a842d5c330b9b4cc0a518652e1eca16121f40bdc1d4c41e4ff1a08c
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
829ad53bf9c48fdeef3adbea95a53e8b57c4499198be68b1b7c1ac353790f50c
d18ac166ea1fb39897e631de04a3052876722b11953b776ed160d7f871f3f187
d30b6114fb9496ae46b2a8cdf59379c8ffdb957534bd1dd73e626c7c61c7e67d