mail.benstokes.com Open in urlscan Pro
65.111.178.18 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bit.ly/3d86HuF
Effective URL:
http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Submission: On March 21 via manual (March 21st 2020, 11:19:50 am UTC) from IL

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 11 HTTP transactions. The main IP is 65.111.178.18, located in Miami, United States and belongs to INFOLINK-MIA-, US. The main domain is mail.benstokes.com.

This is the only time mail.benstokes.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network) Bank Hapoalim (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
1 8	65.111.178.18 65.111.178.18	15083 (INFOLINK-...) (INFOLINK-MIA-)
1	2606:4700:303... 2606:4700:3038::681f:6ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
11	5

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 65.111.178.18 (Miami, United States) 1 redirects

ASN15083 (INFOLINK-MIA-, US)
PTR: mail.weboperations.net

mail.benstokes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3038::681f:6ba (United States)

ASN13335 (CLOUDFLARENET, US)

www.jqueryscript.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	benstokes.com 1 redirects mail.benstokes.com	2 MB
1	gstatic.com fonts.gstatic.com	14 KB
1	googleapis.com fonts.googleapis.com	583 B
1	cloudflare.com cdnjs.cloudflare.com	20 KB
1	jqueryscript.net www.jqueryscript.net	894 B
1	bit.ly 1 redirects bit.ly	364 B
11	6

	Domain	Requested by
8	mail.benstokes.com	1 redirects mail.benstokes.com
1	fonts.gstatic.com	mail.benstokes.com
1	fonts.googleapis.com	mail.benstokes.com
1	cdnjs.cloudflare.com	mail.benstokes.com
1	www.jqueryscript.net	mail.benstokes.com
1	bit.ly	1 redirects
11	6

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-01-30` - `2020-10-09`	8 months	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Frame ID: A89DB9434C5BEA8748D538F9A6FFF954
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bit.ly/3d86HuF HTTP 301
http://mail.benstokes.com/dir-bak/pay/il/index.php HTTP 302
http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Page Statistics

11
Requests

36 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

1656 kB
Transfer

1793 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bit.ly/3d86HuF HTTP 301
http://mail.benstokes.com/dir-bak/pay/il/index.php HTTP 302
http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set index.html Show response
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/
Redirect Chain

http://bit.ly/3d86HuF
http://mail.benstokes.com/dir-bak/pay/il/index.php
http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html

4 KB
5 KB

262ms
256ms

Document
text/html

65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: edb718c2a3a28c10a5b4ede13e7a517f15ea594652453532bdbfcf6182af5e96

Request headers

Host: mail.benstokes.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Connection: close
Server: IceWarp/11.4.6.0 (2016-12-12)
Date: Sat, 21 Mar 2020 11:19:32 GMT
Set-Cookie: PHPSESSID=d3d3b51890bf31847c494a067d873cd5; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html

Redirect headers

Connection: close
Server: IceWarp/11.4.6.0 (2016-12-12)
Date: Sat, 21 Mar 2020 11:19:31 GMT
Status: 302 Moved Temporarily
location: 550290eceb7dc13497e8ebe15cc7bc90/index.html
Content-type: text/html

GET
H/1.1 200
OK log.css
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/ 4 KB
4 KB 249ms
220ms Stylesheet
text/css 65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/log.css
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: 4cc44db2cce52906e2c93a8506e50f98295719c9bea1cedeec2ae7a9073372b0

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 21 Mar 2020 11:19:32 GMT
Last-Modified: Sat, 21 Mar 2020 11:19:32 GMT
Server: IceWarp/11.4.6.0 (2016-12-12)
Content-Type: text/css
Content-Length: 3943
Expires: Sat, 21 Mar 2030 11:19:32 GMT

GET
H2 200 jquerysctipttop.css
www.jqueryscript.net/css/ 1 KB
894 B 64ms
20ms Stylesheet
text/css 2606:4700:3038::681f:6ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.jqueryscript.net/css/jquerysctipttop.css
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::681f:6ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e5ba045c7d932bcc1c1f68cd56da1345160eed18ee731b2eec9f413286f92fa

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Sat, 21 Mar 2020 11:19:32 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 23 Nov 2019 15:46:18 GMT
server: cloudflare
age: 6875
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=86400
cf-ray: 5777474c890c325c-FRA
expires: Sun, 22 Mar 2020 09:24:57 GMT

GET
H2 200 bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/bootswatch/4.1.1/flatly/ 157 KB
20 KB 51ms
22ms Stylesheet
text/css 2606:4700::6811:4004
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bootswatch/4.1.1/flatly/bootstrap.min.css

Requested by

Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02aeda04fa99c2250cd9f1dc86545a543ed116c101b68f8aefb7ef4441a39c75

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Sat, 21 Mar 2020 11:19:32 GMT
content-encoding: br
cf-cache-status: HIT
age: 1866994
cf-ray: 5777474c6f85d6c1-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:16:20 GMT
server: cloudflare
etag: W/"5afd4864-273d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
expires: Thu, 11 Mar 2021 11:19:32 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.003

GET
H/1.1 200
OK top1.png
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/ 1 KB
2 KB 255ms
227ms Image
application/octet-stream 65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/top1.png
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: fd57440bfce5de537a49a4c14b305a87be3cd2d6b18591cf8868230d77ae5291

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 21 Mar 2020 11:19:32 GMT
Last-Modified: Sat, 21 Mar 2020 11:19:32 GMT
Server: IceWarp/11.4.6.0 (2016-12-12)
Content-Type: application/octet-stream
Content-Length: 1335
Expires: Sat, 21 Mar 2030 11:19:32 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
583 B 19ms
19ms Stylesheet
text/css 2a00:1450:4001:816::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700,400italic

Requested by

Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a25088d400c57f71c7c2625e905f33c0e6baac8f5678f5b4299e1946dd636f44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 21 Mar 2020 11:19:32 GMT
server: ESF
date: Sat, 21 Mar 2020 11:19:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 21 Mar 2020 11:19:32 GMT

GET
H/1.1 200
OK top2.png
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/ 1 KB
1 KB 249ms
242ms Image
application/octet-stream 65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/top2.png
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: a60515735422cbf01df30a784b633b92edf4c3ed818b83e030e27b2d43df0bb3

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 21 Mar 2020 11:19:32 GMT
Last-Modified: Sat, 21 Mar 2020 11:19:32 GMT
Server: IceWarp/11.4.6.0 (2016-12-12)
Content-Type: application/octet-stream
Content-Length: 1122
Expires: Sat, 21 Mar 2030 11:19:32 GMT

GET
H/1.1 200
OK backlog.png
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/ 804 KB
804 KB 249ms
243ms Image
application/octet-stream 65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/backlog.png
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: 3e37ba70a78568c6d6d10e586544b74771d61b21f1f5b9c99581ac8d4fa79ae7

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 21 Mar 2020 11:19:32 GMT
Last-Modified: Sat, 21 Mar 2020 11:19:32 GMT
Server: IceWarp/11.4.6.0 (2016-12-12)
Content-Type: application/octet-stream
Content-Length: 823186
Expires: Sat, 21 Mar 2030 11:19:32 GMT

GET
H/1.1 200
OK inf.png
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/ 525 B
767 B 253ms
247ms Image
application/octet-stream 65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/inf.png
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: 4932506804072609f0a97c6046229408fbcff4dea64b17d6da4fa50d36d2204a

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 21 Mar 2020 11:19:32 GMT
Last-Modified: Sat, 21 Mar 2020 11:19:32 GMT
Server: IceWarp/11.4.6.0 (2016-12-12)
Content-Type: application/octet-stream
Content-Length: 525
Expires: Sat, 21 Mar 2030 11:19:32 GMT

GET
H/1.1 200
OK backlog.PNG
mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/ 804 KB
804 KB 127ms
127ms Image
application/octet-stream 65.111.178.18
INFOLINK-MIA-

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/backlog.PNG
Requested by: Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html
Protocol: HTTP/1.1
Server: 65.111.178.18 Miami, United States, ASN15083 (INFOLINK-MIA-, US),
Reverse DNS: mail.weboperations.net
Software: IceWarp/11.4.6.0 (2016-12-12) /
Resource Hash: 3e37ba70a78568c6d6d10e586544b74771d61b21f1f5b9c99581ac8d4fa79ae7

Request headers

Referer: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/img/log.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 21 Mar 2020 11:19:32 GMT
Last-Modified: Sat, 21 Mar 2020 11:19:32 GMT
Server: IceWarp/11.4.6.0 (2016-12-12)
Content-Type: application/octet-stream
Content-Length: 823186
Expires: Sat, 21 Mar 2030 11:19:32 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2

Requested by

Host: mail.benstokes.com
URL: http://mail.benstokes.com/dir-bak/pay/il/550290eceb7dc13497e8ebe15cc7bc90/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Lato:400,700,400italic
Origin: http://mail.benstokes.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 05 Mar 2020 00:02:28 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:55 GMT
server: sffe
age: 1423024
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14044
x-xss-protection: 0
expires: Fri, 05 Mar 2021 00:02:28 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network) Bank Hapoalim (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mail.benstokes.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d3d3b51890bf31847c494a067d873cd5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
mail.benstokes.com
www.jqueryscript.net
2606:4700:3038::681f:6ba
2606:4700::6811:4004
2a00:1450:4001:816::200a
2a00:1450:4001:81c::2003
65.111.178.18
67.199.248.10
02aeda04fa99c2250cd9f1dc86545a543ed116c101b68f8aefb7ef4441a39c75
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
2e5ba045c7d932bcc1c1f68cd56da1345160eed18ee731b2eec9f413286f92fa
3e37ba70a78568c6d6d10e586544b74771d61b21f1f5b9c99581ac8d4fa79ae7
4932506804072609f0a97c6046229408fbcff4dea64b17d6da4fa50d36d2204a
4cc44db2cce52906e2c93a8506e50f98295719c9bea1cedeec2ae7a9073372b0
a25088d400c57f71c7c2625e905f33c0e6baac8f5678f5b4299e1946dd636f44
a60515735422cbf01df30a784b633b92edf4c3ed818b83e030e27b2d43df0bb3
edb718c2a3a28c10a5b4ede13e7a517f15ea594652453532bdbfcf6182af5e96
fd57440bfce5de537a49a4c14b305a87be3cd2d6b18591cf8868230d77ae5291

mail.benstokes.com Open in urlscan Pro 65.111.178.18 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

36 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

5 IPs

2 Countries

1656 kBTransfer

1793 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

mail.benstokes.com Open in urlscan Pro
65.111.178.18 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

36 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

1656 kB
Transfer

1793 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!