blluetekgroup.com Open in urlscan Pro
202.38.172.223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://blluetekgroup.com/blog/dropbox/login.live.com
Effective URL:
https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.64...
Submission: On September 08 via automatic, source openphish (September 8th 2017, 4:23:23 pm UTC)

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 202.38.172.223, located in India and belongs to RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN. The main domain is blluetekgroup.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 13th 2017. Valid for: 3 months.

This is the only time blluetekgroup.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook (Online) Generic (Online)

Domain & IP information

	IP Address		AS Autonomous System
17	202.38.172.223 202.38.172.223		56202 (RIA-INFOS...) (RIA-INFOSOLUTIONS-IN Suite no 10)
17	1

17 202.38.172.223 (India)

ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN)

blluetekgroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	blluetekgroup.com blluetekgroup.com	109 KB
17	1

	Domain	Requested by
17	blluetekgroup.com	blluetekgroup.com
17	1

This site contains no links.

Subject Issuer	Validity	Valid
blluetekgroup.com cPanel, Inc. Certification Authority	`2017-07-13` - `2017-10-11`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email=
Frame ID: 20830.1
Requests: 3 HTTP requests in this frame

Frame: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm
Frame ID: 20830.2
Requests: 11 HTTP requests in this frame

Frame: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US.htm
Frame ID: 20830.3
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

109 kB
Transfer

117 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request accts.php Show response blluetekgroup.com/blog/dropbox/login.live.com/ Redirect Chain https://blluetekgroup.com/blog/dropbox/login.live.com/ https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3in...	7 KB 7 KB	993ms 993ms	Document text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash `367ace28051f7526fa8f8015fe5df37b31e8d68951114f1baf41f85b7bd3d21a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Server Apache Connection Keep-Alive X-Powered-By PHP/5.5.38 Transfer-Encoding chunked Keep-Alive timeout=5, max=98 Content-Type text/html Redirect headers Date Fri, 08 Sep 2017 16:23:00 GMT Server Apache X-Powered-By PHP/5.5.38 Content-Type text/html location accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 0
GET H/1.1	200 OK	R3WinLive1033.css blluetekgroup.com/blog/dropbox/login.live.com/hellion/	25 KB 25 KB	148ms 144ms	Stylesheet text/css	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/R3WinLive1033.css Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `f90a5583d32bfb95b3667da7d6e4e2192b482a99a49f11f612fb18a8dcb0d629` Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 25349
GET H/1.1	200 OK	EN-US(1).htm Show response blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	2 KB 2 KB	424ms 147ms	Document text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `320013aa2c1dde9714565e2d05b52a9d012427bf8d359f172aae4b27820e110a` Request headers Upgrade-Insecure-Requests 1 Referer https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1937
GET H/1.1	200 OK	EN-US.htm Show response blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	627 B 627 B	424ms 144ms	Document text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US.htm Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `1d2216be7e7f5ec07ae65fc21adc3b3e6011cc0c494df1a972f4d16735478f4d` Request headers Upgrade-Insecure-Requests 1 Referer https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 627
GET H/1.1	404 Not Found	controls.png blluetekgroup.com/blog/dropbox/login.live.com/hellion/hig/img/	8 KB 0	1159ms 1158ms	Image text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Show image Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/hig/img/controls.png Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/accts.php?login.srf?wa=wsignin1.0&rpsnv=12&ct=1425083828&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=httpsbay169.mail.live.com%default.aspxFrru3inbox&lc=1033&id=64855&mkt=en-us&cbcxt=mai&email= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash `01306728c439cfeb7dc188c44b6df68616c7d26a3813dd2de2d11bf3fede2663` Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/R3WinLive1033.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:01 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=96 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	style.css blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	6 KB 6 KB	143ms 143ms	Stylesheet text/css	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/style.css Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `d54419ea535786304292eab15c8cd83dd727045e52c05c76324f9ddbfc0f9b2c` Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5719
GET H/1.1	404 Not Found	mbox.js blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	1383ms 1382ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/mbox.js Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:01 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	event blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	1308ms 1307ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/event Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:01 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	Outlook_SISU%20Refresh_Categories.jpg blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	63 KB 63 KB	435ms 146ms	Image image/jpeg	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Show image Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/Outlook_SISU%20Refresh_Categories.jpg Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `beeb8672e0f8f04e8afd9814718f6d61ae2ebffb41dd573ed37b181f63e87440` Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 64545
GET H/1.1	200 OK	style_win8.css blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	2 KB 2 KB	289ms 144ms	Stylesheet text/css	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/style_win8.css Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `1201c9e70331fab3bfeaae83d453b392f35eeccc008f0674c30b74492e9b1fa0` Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:01 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1622
GET H/1.1	404 Not Found	bk-coretag.js blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	1419ms 1411ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/bk-coretag.js Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:01 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	standard blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	1095ms 1095ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/standard Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:02 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=96 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	header.css blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	1669ms 1397ms	Stylesheet text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/header.css Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:01 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	logo_mail.png blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	5 KB 5 KB	440ms 143ms	Image image/png	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Show image Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/logo_mail.png Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / Resource Hash `6b1af85883b2ab64690488468bf9fb0699b82e0b8c3239129847e726bcd79c1b` Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Date Fri, 08 Sep 2017 16:23:02 GMT Last-Modified Tue, 03 Mar 2015 13:53:06 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5104
GET H/1.1	404 Not Found	event blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	826ms 732ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/event Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:03 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=99 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	bk-coretag.js blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	751ms 751ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/bk-coretag.js Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:03 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	404 Not Found	standard blluetekgroup.com/blog/dropbox/login.live.com/hellion/ Frame 2083	0 0	1085ms 776ms	Script text/html	202.38.172.223 RIA-INFOSOLUTIONS...
General Check archive.org Show headers Download Go to Full URL https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/standard Requested by Host: blluetekgroup.com URL: https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 202.38.172.223 , India, ASN56202 (RIA-INFOSOLUTIONS-IN Suite no 10, Level 5; C Wing, IN), Reverse DNS Software Apache / PHP/5.5.38 Resource Hash Request headers Referer https://blluetekgroup.com/blog/dropbox/login.live.com/hellion/EN-US(1).htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36 Response headers Pragma no-cache Date Fri, 08 Sep 2017 16:23:04 GMT Server Apache X-Powered-By PHP/5.5.38 X-Pingback https://blluetekgroup.com/blog/xmlrpc.php Content-Type text/html; charset=UTF-8 Cache-Control no-cache, must-revalidate, max-age=0 Transfer-Encoding chunked Connection Keep-Alive Keep-Alive timeout=5, max=100 Expires Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook (Online) Generic (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blluetekgroup.com
202.38.172.223
01306728c439cfeb7dc188c44b6df68616c7d26a3813dd2de2d11bf3fede2663
1201c9e70331fab3bfeaae83d453b392f35eeccc008f0674c30b74492e9b1fa0
1d2216be7e7f5ec07ae65fc21adc3b3e6011cc0c494df1a972f4d16735478f4d
320013aa2c1dde9714565e2d05b52a9d012427bf8d359f172aae4b27820e110a
367ace28051f7526fa8f8015fe5df37b31e8d68951114f1baf41f85b7bd3d21a
6b1af85883b2ab64690488468bf9fb0699b82e0b8c3239129847e726bcd79c1b
beeb8672e0f8f04e8afd9814718f6d61ae2ebffb41dd573ed37b181f63e87440
d54419ea535786304292eab15c8cd83dd727045e52c05c76324f9ddbfc0f9b2c
f90a5583d32bfb95b3667da7d6e4e2192b482a99a49f11f612fb18a8dcb0d629

blluetekgroup.com Open in urlscan Pro 202.38.172.223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

109 kBTransfer

117 kBSize

0 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

blluetekgroup.com Open in urlscan Pro
202.38.172.223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

109 kB
Transfer

117 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!