bbwstocking.com Open in urlscan Pro
172.94.66.128 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
Submission Tags: @ipnigh
Submission: On April 08 via api (April 8th 2020, 1:46:34 am UTC) from GB

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 172.94.66.128, located in Montreal, Canada and belongs to AMANAHA-NEW, CA. The main domain is bbwstocking.com.

This is the only time bbwstocking.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
6	172.94.66.128 172.94.66.128	32489 (AMANAHA-NEW) (AMANAHA-NEW)
1	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE)
7	3

6 172.94.66.128 (Montreal, Canada)

ASN32489 (AMANAHA-NEW, CA)

bbwstocking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	bbwstocking.com bbwstocking.com	258 KB
1	googleapis.com fonts.googleapis.com	1 KB
7	2

	Domain	Requested by
6	bbwstocking.com	bbwstocking.com
1	fonts.googleapis.com	bbwstocking.com
7	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
Frame ID: CC3E5F224E62512AEB36D5BDD8CE1839
Requests: 3 HTTP requests in this frame

Frame: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
Frame ID: ED8142285054F301331C2090B850052C
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

259 kB
Transfer

263 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request page.php Show response
bbwstocking.com/Quote/UJHYTFJGJFGDFFG/ 19 KB
19 KB 721ms
701ms Document
text/html 172.94.66.128
AMANAHA-NEW

General

Check archive.org

Show headers Download Go to

Full URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
Protocol: HTTP/1.1
Server: 172.94.66.128 Montreal, Canada, ASN32489 (AMANAHA-NEW, CA),
Reverse DNS
Software: Apache /
Resource Hash: 173df5b282221a4507dd572223eb1d0ce1ec86ba4143fddef055c1691563fc94

Request headers

Host: bbwstocking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 01:46:13 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK pobg.gif
bbwstocking.com/Quote/UJHYTFJGJFGDFFG/ 137 KB
137 KB 467ms
453ms Image
image/gif 172.94.66.128
AMANAHA-NEW

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/pobg.gif
Requested by: Host: bbwstocking.com
URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
Protocol: HTTP/1.1
Server: 172.94.66.128 Montreal, Canada, ASN32489 (AMANAHA-NEW, CA),
Reverse DNS
Software: Apache /
Resource Hash: fe8cce076b7f3cf2db9b908fc8c5c60314bf8385d20c7b8e9d47206c52d72932

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 01:46:14 GMT
Last-Modified: Wed, 01 Apr 2020 06:58:30 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 140509

GET
H/1.1 200
OK login.php Show response
bbwstocking.com/Quote/UJHYTFJGJFGDFFG/ Frame ED81 5 KB
5 KB 229ms
228ms Document
text/html 172.94.66.128
AMANAHA-NEW

General

Check archive.org

Show headers Download Go to

Full URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
Requested by: Host: bbwstocking.com
URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
Protocol: HTTP/1.1
Server: 172.94.66.128 Montreal, Canada, ASN32489 (AMANAHA-NEW, CA),
Reverse DNS
Software: Apache /
Resource Hash: e1386281b001a0f7b748db815d331eeb6da52cdb39bdedaf9ac99b03f861eb01

Request headers

Host: bbwstocking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/page.php

Response headers

Date: Wed, 08 Apr 2020 01:46:14 GMT
Server: Apache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.js Show response
bbwstocking.com/Quote/UJHYTFJGJFGDFFG/ Frame ED81 94 KB
94 KB 213ms
213ms Script
application/javascript 172.94.66.128
AMANAHA-NEW

General

Check archive.org

Show headers Download Go to

Full URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/jquery.js
Requested by: Host: bbwstocking.com
URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
Protocol: HTTP/1.1
Server: 172.94.66.128 Montreal, Canada, ASN32489 (AMANAHA-NEW, CA),
Reverse DNS
Software: Apache /
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 01:46:14 GMT
Last-Modified: Wed, 01 Apr 2020 06:58:30 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 96381

GET
H/1.1 200
OK jquery_popup.css
bbwstocking.com/Quote/UJHYTFJGJFGDFFG/ Frame ED81 2 KB
2 KB 472ms
444ms Stylesheet
text/css 172.94.66.128
AMANAHA-NEW

General

Check archive.org

Show headers Download Go to

Full URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/jquery_popup.css
Requested by: Host: bbwstocking.com
URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
Protocol: HTTP/1.1
Server: 172.94.66.128 Montreal, Canada, ASN32489 (AMANAHA-NEW, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1dbe2cdf1aff375b2420bd518650d07a6614455528e2f9400c99a74e4b57dc0

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 01:46:14 GMT
Last-Modified: Wed, 01 Apr 2020 06:58:30 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2231

GET
H/1.1 200
OK jquery_popup.js Show response
bbwstocking.com/Quote/UJHYTFJGJFGDFFG/ Frame ED81 0
253 B 466ms
438ms Script
application/javascript 172.94.66.128
AMANAHA-NEW

General

Check archive.org

Show headers Download Go to

Full URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/jquery_popup.js
Requested by: Host: bbwstocking.com
URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
Protocol: HTTP/1.1
Server: 172.94.66.128 Montreal, Canada, ASN32489 (AMANAHA-NEW, CA),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 01:46:14 GMT
Last-Modified: Wed, 01 Apr 2020 06:58:30 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 0

GET
H/1.1 200
OK css
fonts.googleapis.com/ Frame ED81 2 KB
1 KB 19ms
19ms Stylesheet
text/css 2a00:1450:4001:821::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Fauna+One|Muli

Requested by

Host: bbwstocking.com
URL: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=

Protocol

HTTP/1.1

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

549bcb9274bf24cc98b746e935632ec2cd52b02bf787196070876c1ba20be5cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 01:46:16 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 08 Apr 2020 01:46:16 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Wed, 08 Apr 2020 01:46:16 GMT

GET
DATA 200
OK truncated
/ Frame ED81 622 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82f04c5d953b2ccb07f301b00299566e9a6efcc00a654259cd44ca71bb4db7fb

Request headers

Referer: http://bbwstocking.com/Quote/UJHYTFJGJFGDFFG/login.php?email=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bbwstocking.com
fonts.googleapis.com
172.94.66.128
2a00:1450:4001:821::200a
173df5b282221a4507dd572223eb1d0ce1ec86ba4143fddef055c1691563fc94
549bcb9274bf24cc98b746e935632ec2cd52b02bf787196070876c1ba20be5cc
7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5
82f04c5d953b2ccb07f301b00299566e9a6efcc00a654259cd44ca71bb4db7fb
b1dbe2cdf1aff375b2420bd518650d07a6614455528e2f9400c99a74e4b57dc0
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
e1386281b001a0f7b748db815d331eeb6da52cdb39bdedaf9ac99b03f861eb01
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fe8cce076b7f3cf2db9b908fc8c5c60314bf8385d20c7b8e9d47206c52d72932

bbwstocking.com Open in urlscan Pro 172.94.66.128 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

0 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

259 kBTransfer

263 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

bbwstocking.com Open in urlscan Pro
172.94.66.128 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

259 kB
Transfer

263 kB
Size

0
Cookies

7 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!