ar-ey.net Open in urlscan Pro
185.139.172.42  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://www.ar-ey.net/zab.htm Page URL
2. http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	zab.htm Show response www.ar-ey.net/	304 B 304 B	272ms 112ms	Document text/html	185.139.172.42 GRABOTO
General Check archive.org Show headers Download Go to Full URL http://www.ar-ey.net/zab.htm Protocol HTTP/1.1 Server 185.139.172.42 , Norway, ASN203295 (GRABOTO, NO), Reverse DNS Software Apache / Resource Hash c5fea5bd1cef73632a9ac4370c43087e62bd8d7001b07c04e2162d584481802c Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.ar-ey.net Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:42 GMT Last-Modified Fri, 31 Mar 2017 09:38:07 GMT Server Apache Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=1, max=30 Content-Length 304
GET H/1.1	200 OK	Primary Request / Show response ar-ey.net/wp-content/plugins/wp-optimize/sub/	39 KB 39 KB	271ms 241ms	Document text/html	185.139.172.42 GRABOTO
General Check archive.org Show headers Download Go to Full URL http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Protocol HTTP/1.1 Server 185.139.172.42 , Norway, ASN203295 (GRABOTO, NO), Reverse DNS Software Apache / Resource Hash 48fe708fd2d4643c15d55a0a54429527fbd42b7354b3c807d0e130dcf3f9f2b7 Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host ar-ey.net Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Referer http://www.ar-ey.net/zab.htm Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://www.ar-ey.net/zab.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:42 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=1, max=30 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	favicon.ico www.ar-ey.net/	328 B 328 B	54ms 54ms	Other text/html	185.139.172.42 GRABOTO
General Check archive.org Show headers Download Go to Full URL http://www.ar-ey.net/favicon.ico Protocol HTTP/1.1 Server 185.139.172.42 , Norway, ASN203295 (GRABOTO, NO), Reverse DNS Software Apache / Resource Hash 6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host www.ar-ey.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/*,*/*;q=0.8 Referer http://www.ar-ey.net/zab.htm Connection keep-alive Cache-Control no-cache Referer http://www.ar-ey.net/zab.htm User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:42 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=1, max=29 Content-Length 328 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	Cookie set ubs_styles.min.css 3ds.cardcenter.ch/acspage/de_DE_base_UBS/	48 KB 48 KB	1082ms 51ms	Stylesheet text/css	212.243.129.42 SWISSCOM Swisscom...
General Check archive.org Show headers Download Go to Full URL https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/ubs_styles.min.css Requested by Host: ar-ey.net URL: http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 212.243.129.42 Volketswil, Switzerland, ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH), Reverse DNS 3ds.cardcenter.ch Software / Resource Hash f0b661773a05628a9dfa906d3d7404894cacb2017c8a6a98c66eb236d68c972d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host 3ds.cardcenter.ch Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:44 GMT Last-Modified Thu, 20 Aug 2015 14:57:20 GMT ETag "23674b-bfe3-5e345400" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type text/css Set-Cookie TS01fe755f=0129824a048a81666c787f15a474b8cb7e8128cb481c29cb201bf80c18d2d9d5d4ab35bd9e; Path=/ Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 49123
GET H/1.1	200 OK	Cookie set x-out.js Show response 3ds.cardcenter.ch/acspage/de_DE_base_UBS/	4 KB 4 KB	1073ms 42ms	Script application/x-javascript	212.243.129.42 SWISSCOM Swisscom...
General Check archive.org Show headers Download Go to Full URL https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/x-out.js Requested by Host: ar-ey.net URL: http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 212.243.129.42 Volketswil, Switzerland, ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH), Reverse DNS 3ds.cardcenter.ch Software / Resource Hash 327b92231325994099d667ba75555c94b2c5b54c8e4e51bb39f11487d4d03850 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host 3ds.cardcenter.ch Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept */* Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:44 GMT Last-Modified Thu, 20 Aug 2015 14:57:20 GMT ETag "236755-f7a-5e345400" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type application/x-javascript Set-Cookie TS01fe755f=0129824a04437afe0b83c96918928640edf4266462f6f0fac002c1a3eb5482bfc84b253c1c; Path=/ Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 3962
GET H/1.1	200 OK	Cookie set pwdbase.js Show response 3ds.cardcenter.ch/acspage/de_DE_base_UBS/	6 KB 6 KB	1068ms 36ms	Script application/x-javascript	212.243.129.42 SWISSCOM Swisscom...
General Check archive.org Show headers Download Go to Full URL https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/pwdbase.js Requested by Host: ar-ey.net URL: http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 212.243.129.42 Volketswil, Switzerland, ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH), Reverse DNS 3ds.cardcenter.ch Software / Resource Hash e7374eda7dd537f9888f31aeaf279ab586ea5768b79adc706b701ca75190d31f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host 3ds.cardcenter.ch Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept */* Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:44 GMT Last-Modified Thu, 20 Aug 2015 14:57:18 GMT ETag "2566ad-1605-5e15cf80" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type application/x-javascript Set-Cookie TS01fe755f=0129824a04cb2e7f87a54d8563f466ea098655450e314532b56a5e64bb4313e2d3397a35e5; Path=/ Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=100 Content-Length 5637
GET H/1.1	404 Not Found	alert-box.js ar-ey.net/wp-content/plugins/wp-optimize/sub/	0 0	54ms 53ms	Script text/html	185.139.172.42 GRABOTO
General Check archive.org Show headers Download Go to Full URL http://ar-ey.net/wp-content/plugins/wp-optimize/sub/alert-box.js Requested by Host: ar-ey.net URL: http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Protocol HTTP/1.1 Server 185.139.172.42 , Norway, ASN203295 (GRABOTO, NO), Reverse DNS Software Apache / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host ar-ey.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept */* Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:43 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=1, max=29 Content-Length 364 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	pdf.png 3ds.cardcenter.ch/acspage/de_DE_base_UBS/images/	508 B 508 B	19ms 19ms	Image image/png	212.243.129.42 SWISSCOM Swisscom...
General Check archive.org Show headers Download Go to Show image Full URL https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/images/pdf.png Requested by Host: www.ar-ey.net URL: http://www.ar-ey.net/zab.htm Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 212.243.129.42 Volketswil, Switzerland, ASN3303 (SWISSCOM Swisscom (Switzerland) Ltd, CH), Reverse DNS 3ds.cardcenter.ch Software / Resource Hash 2d125e492f66572abe0f989497deadfd72e894efc6cb2a1f5a0bc7d08ce5e4c1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host 3ds.cardcenter.ch Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/*,*/*;q=0.8 Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Cookie TS01fe755f=0129824a048a81666c787f15a474b8cb7e8128cb481c29cb201bf80c18d2d9d5d4ab35bd9e Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:44 GMT Last-Modified Thu, 20 Aug 2015 14:57:18 GMT ETag "220fa78-1fc-5e15cf80" Strict-Transport-Security max-age=31536000; includeSubDomains Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=10, max=99 Content-Length 508
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7865525be8e3ad6b21468201db9c78a76e2398c17a1a88363e3d3e5d3d7cdd8d Request headers Response headers
GET DATA	200 OK	truncated /	526 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 329a54a4d1966abb2a846911add2bbee0944c6afd17cff49f3a86cb24a2e2c37 Request headers Response headers
GET DATA	200 OK	truncated /	9 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 68216d74836e1f020cbce76c33e5f9c370bcf66a64021668c33dc4400f439dd8 Request headers Response headers
GET		frutiger-light-webfont.woff 3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/	0 0
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 12f5b303a8e06b4da682c9c6da77e5937d65ad0eab005525868688bc7827606f Request headers Response headers
GET H/1.1	404 Not Found	alert-box.js ar-ey.net/wp-content/plugins/wp-optimize/sub/	0 0	83ms 51ms	Script text/html	185.139.172.42 GRABOTO
General Check archive.org Show headers Download Go to Full URL http://ar-ey.net/wp-content/plugins/wp-optimize/sub/alert-box.js Requested by Host: ar-ey.net URL: http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Protocol HTTP/1.1 Server 185.139.172.42 , Norway, ASN203295 (GRABOTO, NO), Reverse DNS Software Apache / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host ar-ey.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept */* Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:44 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=1, max=30 Content-Length 364 Content-Type text/html; charset=iso-8859-1
GET		frutiger-light-webfont.ttf 3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/	0 0
GET		frutiger-webfont.woff 3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/	0 0
GET H/1.1	404 Not Found	favicon.ico ar-ey.net/	328 B 328 B	51ms 51ms	Other text/html	185.139.172.42 GRABOTO
General Check archive.org Show headers Download Go to Full URL http://ar-ey.net/favicon.ico Protocol HTTP/1.1 Server 185.139.172.42 , Norway, ASN203295 (GRABOTO, NO), Reverse DNS Software Apache / Resource Hash 6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host ar-ey.net Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Accept image/webp,image/*,*/*;q=0.8 Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ Connection keep-alive Cache-Control no-cache Referer http://ar-ey.net/wp-content/plugins/wp-optimize/sub/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36 Response headers Date Sat, 15 Apr 2017 04:23:44 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=1, max=29 Content-Length 328 Content-Type text/html; charset=iso-8859-1
GET		frutiger-webfont.ttf 3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

3ds.cardcenter.ch

URL

https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/frutiger-light-webfont.woff

Domain

3ds.cardcenter.ch

URL

https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/frutiger-light-webfont.ttf

Domain

3ds.cardcenter.ch

URL

https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/frutiger-webfont.woff

Domain

3ds.cardcenter.ch

URL

https://3ds.cardcenter.ch/acspage/de_DE_base_UBS/fonts/frutiger-webfont.ttf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UBS (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3ds.cardcenter.ch
ar-ey.net
www.ar-ey.net
3ds.cardcenter.ch
185.139.172.42
212.243.129.42
12f5b303a8e06b4da682c9c6da77e5937d65ad0eab005525868688bc7827606f
2d125e492f66572abe0f989497deadfd72e894efc6cb2a1f5a0bc7d08ce5e4c1
327b92231325994099d667ba75555c94b2c5b54c8e4e51bb39f11487d4d03850
329a54a4d1966abb2a846911add2bbee0944c6afd17cff49f3a86cb24a2e2c37
48fe708fd2d4643c15d55a0a54429527fbd42b7354b3c807d0e130dcf3f9f2b7
68216d74836e1f020cbce76c33e5f9c370bcf66a64021668c33dc4400f439dd8
6b62a3658ad247e8f30d3e9f35da5e00ffac1ea09785bd1f0a9830f659cf01da
7865525be8e3ad6b21468201db9c78a76e2398c17a1a88363e3d3e5d3d7cdd8d
c5fea5bd1cef73632a9ac4370c43087e62bd8d7001b07c04e2162d584481802c
e7374eda7dd537f9888f31aeaf279ab586ea5768b79adc706b701ca75190d31f
f0b661773a05628a9dfa906d3d7404894cacb2017c8a6a98c66eb236d68c972d