hammsconstruction.com Open in urlscan Pro
160.153.45.129  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request maer.php Show response hammsconstruction.com/cgi-bin/wx/Maerskk/	62 KB 14 KB	423ms 387ms	Document text/html	160.153.45.129 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol HTTP/1.1 Server 160.153.45.129 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS ip-160-153-45-129.ip.secureserver.net Software Apache / PHP/7.1.33 Resource Hash 714c06bbe427769a66369066d6a462677ae4114db0e6601ab628267de9e7b7c6 Request headers Host hammsconstruction.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Date Wed, 09 Jun 2021 17:34:15 GMT Server Apache X-Powered-By PHP/7.1.33 Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 14374 Keep-Alive timeout=5 Content-Type text/html; charset=UTF-8
GET H2	200	cl0ey7e.jpg i.imgur.com/	79 KB 80 KB	142ms 46ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/cl0ey7e.jpg Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 6a886549c9d681c34da102683fca2a0a08d1b05130b359b46ff15e7f923f9db4 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer http://hammsconstruction.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Wed, 09 Jun 2021 17:34:15 GMT x-content-type-options nosniff age 557780 x-cache HIT, HIT content-length 81332 x-served-by cache-bwi5134-BWI, cache-hhn4031-HHN last-modified Sat, 14 Oct 2017 06:30:48 GMT server cat factory 1.0 x-timer S1623260056.622121,VS0,VE1 etag "6aa18577a2870b1ece766d53f56557f0" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	IxrIQm0.jpg i.imgur.com/	101 KB 102 KB	207ms 111ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/IxrIQm0.jpg Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash d597c3d708407da5ce18fa360eec0dd53ee51d1ff5eef23a75adb1645094cc7c Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer http://hammsconstruction.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Wed, 09 Jun 2021 17:34:15 GMT x-content-type-options nosniff age 40303 x-cache HIT, HIT content-length 103913 x-served-by cache-bwi5169-BWI, cache-hhn4031-HHN last-modified Sat, 14 Oct 2017 06:31:29 GMT server cat factory 1.0 x-timer S1623260056.622178,VS0,VE1 etag "6dda235d100d6293158a6a8fa5676e3a" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	P4heblb.jpg i.imgur.com/	257 KB 257 KB	231ms 136ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/P4heblb.jpg Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 367d0864d0351debf1853661701c1bdbad536a2ae6c6037d49be6845a266e494 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer http://hammsconstruction.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Wed, 09 Jun 2021 17:34:15 GMT x-content-type-options nosniff age 1077947 x-cache HIT, HIT x-amz-storage-class STANDARD_IA content-length 262856 x-served-by cache-bwi5169-BWI, cache-hhn4031-HHN last-modified Sat, 14 Oct 2017 06:31:57 GMT server cat factory 1.0 x-timer S1623260056.622431,VS0,VE2 etag "9ecf023655bd87a8e61391bf76eec261" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	efg2UyP.jpg i.imgur.com/	71 KB 71 KB	231ms 135ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/efg2UyP.jpg Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 31991918c0dec8fe0ddccc26599b10d1092577b7b144e5f3921b9154221a92b3 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer http://hammsconstruction.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Wed, 09 Jun 2021 17:34:15 GMT x-content-type-options nosniff age 1755554 x-cache HIT, HIT content-length 72555 x-served-by cache-bwi5149-BWI, cache-hhn4031-HHN last-modified Sat, 14 Oct 2017 06:32:51 GMT server cat factory 1.0 x-timer S1623260056.622413,VS0,VE1 etag "a70dee98c12e056a35551a99562d3a25" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	jVGCBow.jpg i.imgur.com/	137 KB 138 KB	231ms 135ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/jVGCBow.jpg Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 2777bc74278aa72442707899f26c28a9e075b09dbbab6cd5edf9d1a93bb4f4f2 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer http://hammsconstruction.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Wed, 09 Jun 2021 17:34:15 GMT x-content-type-options nosniff age 539148 x-cache HIT, HIT x-amz-storage-class STANDARD_IA content-length 140686 x-served-by cache-bwi5168-BWI, cache-hhn4031-HHN last-modified Sat, 14 Oct 2017 06:33:32 GMT server cat factory 1.0 x-timer S1623260056.622406,VS0,VE2 etag "14c23df577f52eda8c9191a4c0432998" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	b6.jpg i.imgur.com/iSktaNi.jpg./images/	594 KB 594 KB	231ms 136ms	Image image/jpeg	151.101.112.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/iSktaNi.jpg./images/b6.jpg Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 4cea85792ec7c35e40d195d550b5bf764308d922e2e780dc45c6dbea3ae736c5 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer http://hammsconstruction.com/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Wed, 09 Jun 2021 17:34:15 GMT x-content-type-options nosniff age 468650 x-cache HIT, HIT x-amz-storage-class STANDARD_IA content-length 607849 x-served-by cache-bwi5121-BWI, cache-hhn4031-HHN last-modified Sat, 14 Oct 2017 06:34:16 GMT server cat factory 1.0 x-timer S1623260056.622420,VS0,VE3 etag "a34a8ea15aeeb0f8d08231a2c61bb29d" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H/1.1	500 Internal Server Error	pattern.png hammsconstruction.com/cgi-bin/wx/images/	3 KB 1 KB	1306ms 1306ms	Image text/html	160.153.45.129 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Show image Full URL http://hammsconstruction.com/cgi-bin/wx/images/pattern.png Requested by Host: hammsconstruction.com URL: http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Protocol HTTP/1.1 Server 160.153.45.129 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS ip-160-153-45-129.ip.secureserver.net Software Apache / PHP/7.1.33 Resource Hash fb02cd7fa6b4bc58afd00d55f8366c15d446297a1c321d7fef2e725283255da2 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host hammsconstruction.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php Connection keep-alive Cache-Control no-cache Referer http://hammsconstruction.com/cgi-bin/wx/Maerskk/maer.php User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Date Wed, 09 Jun 2021 17:34:15 GMT Content-Encoding gzip Server Apache X-Powered-By PHP/7.1.33 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=utf-8 Cache-Control no-cache, must-revalidate, max-age=0 Connection close Content-Length 1184 Expires Wed, 11 Jan 1984 05:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Maersk (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hammsconstruction.com
i.imgur.com
151.101.112.193
160.153.45.129
2777bc74278aa72442707899f26c28a9e075b09dbbab6cd5edf9d1a93bb4f4f2
31991918c0dec8fe0ddccc26599b10d1092577b7b144e5f3921b9154221a92b3
367d0864d0351debf1853661701c1bdbad536a2ae6c6037d49be6845a266e494
4cea85792ec7c35e40d195d550b5bf764308d922e2e780dc45c6dbea3ae736c5
6a886549c9d681c34da102683fca2a0a08d1b05130b359b46ff15e7f923f9db4
714c06bbe427769a66369066d6a462677ae4114db0e6601ab628267de9e7b7c6
d597c3d708407da5ce18fa360eec0dd53ee51d1ff5eef23a75adb1645094cc7c
fb02cd7fa6b4bc58afd00d55f8366c15d446297a1c321d7fef2e725283255da2