URL: http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af06...
Submission: On June 05 via automatic, source openphish

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 223.130.27.80, located in Melbourne, Australia and belongs to SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU. The main domain is knaus.com.au.
This is the only time knaus.com.au was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

IP Address AS Autonomous System
3 223.130.27.80 45638 (SYNERGYWH...)
3 1
Apex Domain
Subdomains
Transfer
3 knaus.com.au
knaus.com.au
170 KB
3 1
Domain Requested by
3 knaus.com.au knaus.com.au
3 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
Frame ID: 2387.1
Requests: 3 HTTP requests in this frame

Screenshot


Page Statistics

3
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

170 kB
Transfer

176 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request car.php
knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/
8 KB
2 KB
Document
General
Full URL
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
Protocol
HTTP/1.1
Server
223.130.27.80 Melbourne, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS
c1s3-3m-mel.hosting-services.net.au
Software
LiteSpeed /
Resource Hash
f5b3aa7fb86b4ca702c592015dd3d37e8310a150d4a4470f7f16c1d700e1934b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
knaus.com.au
Accept-Language
en-US,en;q=0.8
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Mon, 05 Jun 2017 09:10:45 GMT
Content-Encoding
gzip
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
Connection
close
Accept-Ranges
bytes
Content-Length
1974
bg3.png
knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/img/
160 KB
160 KB
Image
General
Full URL
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/img/bg3.png
Requested by
Host: knaus.com.au
URL: http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
Protocol
HTTP/1.1
Server
223.130.27.80 Melbourne, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS
c1s3-3m-mel.hosting-services.net.au
Software
LiteSpeed /
Resource Hash
5b8b9cc27d26b992dfd8249fae38aec5cc875653da5c194b74ac3fbdf5d1d337

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
knaus.com.au
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
Connection
keep-alive
Cache-Control
no-cache
Referer
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Mon, 05 Jun 2017 09:10:45 GMT
Last-Modified
Mon, 21 Nov 2016 15:00:10 GMT
Server
LiteSpeed
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
164260
Expires
Mon, 12 Jun 2017 09:10:45 GMT
favicon.ico
knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/img/
8 KB
8 KB
Other
General
Full URL
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/img/favicon.ico
Protocol
HTTP/1.1
Server
223.130.27.80 Melbourne, Australia, ASN45638 (SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD, AU),
Reverse DNS
c1s3-3m-mel.hosting-services.net.au
Software
LiteSpeed /
Resource Hash
32e5ff0a3c5413a166f5739c30275e96689fbac8f9cc7843f5f4f23768b6e04e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate, sdch
Host
knaus.com.au
Accept-Language
en-US,en;q=0.8
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
Accept
image/webp,image/*,*/*;q=0.8
Referer
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
Connection
keep-alive
Cache-Control
no-cache
Referer
http://knaus.com.au/v2/wp-includes/js/UUSS/49873/dir/car.php?cmd=_account-details&session=cf410010a707afafbd67c4af0677e5dc&dispatch=be23b8d345e3070a2a8098f99118a81813c51b38
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Response headers

Date
Mon, 05 Jun 2017 09:10:47 GMT
Last-Modified
Mon, 21 Nov 2016 15:00:10 GMT
Server
LiteSpeed
Content-Type
image/vnd.microsoft.icon
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
7782
Expires
Mon, 12 Jun 2017 09:10:47 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

knaus.com.au
223.130.27.80
32e5ff0a3c5413a166f5739c30275e96689fbac8f9cc7843f5f4f23768b6e04e
5b8b9cc27d26b992dfd8249fae38aec5cc875653da5c194b74ac3fbdf5d1d337
f5b3aa7fb86b4ca702c592015dd3d37e8310a150d4a4470f7f16c1d700e1934b