www.ghattiaproduct.com Open in urlscan Pro
178.238.230.89 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Submission: On March 27 via automatic, source openphish (March 27th 2017, 8:00:18 pm UTC)

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 178.238.230.89, located in Germany and belongs to CONTABO, DE. The main domain is www.ghattiaproduct.com.

This is the only time www.ghattiaproduct.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3	178.238.230.89 178.238.230.89	51167 (CONTABO) (CONTABO)
4	13.32.113.23 13.32.113.23	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5	2400:cb00:204... 2400:cb00:2048:1::6810:641d	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
1	2a00:1450:401... 2a00:1450:4010:c01::5f	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2a00:1450:400... 2a00:1450:400f:805::2003	15169 (GOOGLE) (GOOGLE - Google Inc.)
14	5

3 178.238.230.89 (Germany)

ASN51167 (CONTABO, DE)
PTR: webserver.hosthof.com

www.ghattiaproduct.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.113.23 (Norwalk, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

cf.dropboxstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2400:cb00:2048:1::6810:641d (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

cfl.dropboxstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4010:c01::5f (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400f:805::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dropboxstatic.com cf.dropboxstatic.com cfl.dropboxstatic.com	86 KB
3	ghattiaproduct.com www.ghattiaproduct.com	15 KB
1	gstatic.com fonts.gstatic.com	14 KB
1	googleapis.com fonts.googleapis.com	559 B
14	4

	Domain	Requested by
5	cfl.dropboxstatic.com	www.ghattiaproduct.com
4	cf.dropboxstatic.com	www.ghattiaproduct.com
3	www.ghattiaproduct.com	www.ghattiaproduct.com
1	fonts.gstatic.com	www.ghattiaproduct.com
1	fonts.googleapis.com	www.ghattiaproduct.com
14	5

This site contains no links.

Subject Issuer	Validity	Valid
cf.dropboxstatic.com DigiCert SHA2 High Assurance Server CA	`2016-12-05` - `2020-02-19`	3 years	crt.sh
cfl.dropboxstatic.com DigiCert SHA2 High Assurance Server CA	`2016-03-01` - `2019-03-06`	3 years	crt.sh
*.googleapis.com Google Internet Authority G2	`2017-03-16` - `2017-06-08`	3 months	crt.sh
*.google.com Google Internet Authority G2	`2017-03-16` - `2017-06-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Frame ID: 10012.1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

14
Requests

79 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

115 kB
Transfer

457 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request document.html Show response
www.ghattiaproduct.com/cgi-bin1/read/1/c/ 14 KB
14 KB 82ms
69ms Document
text/html 178.238.230.89
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Protocol: HTTP/1.1
Server: 178.238.230.89 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: webserver.hosthof.com
Software: Apache/2.4.25 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: a070107093da3127d17d4d33eefbcebe722612cce8de79774a507b055b23a385

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: www.ghattiaproduct.com
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Mon, 27 Mar 2017 15:00:06 GMT
Last-Modified: Mon, 17 Oct 2016 14:07:46 GMT
Server: Apache/2.4.25 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
ETag: "80fc186b-38b5-53f1019a7b080"
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 14517

GET
H/1.1 200
OK base-vflN4g7TO.css
cf.dropboxstatic.com/static/css/dropbox/ 22 KB
4 KB 77ms
24ms Stylesheet
text/css 13.32.113.23
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.dropboxstatic.com/static/css/dropbox/base-vflN4g7TO.css

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.113.23 Norwalk, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

9f2e5339eb669c0288b3eb81311e9f42d1b915b95d2caecdfcf0479e7ea8542d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Origin: http://www.ghattiaproduct.com
Accept-Encoding: gzip, deflate, sdch, br
Host: cf.dropboxstatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Origin: http://www.ghattiaproduct.com

Response headers

Date: Mon, 13 Feb 2017 23:06:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 3617603
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
X-Dropbox-Request-Id: b78114fbf80c9cd351bfb269319e663d
Connection: keep-alive
Via: 1.1 0e80e709b8a551fb76216f2292913241.cloudfront.net (CloudFront)
Last-Modified: Mon, 13 Feb 2017 22:01:23 GMT
Server: nginx
ETag: W/"58a22cb3-5783"
Vary: Accept-Encoding
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000 public, immutable
Timing-Allow-Origin: https://www.dropbox.com
X-Amz-Cf-Id: Lf7VjA7rKANzkRcneVfKFx7XJQLP6UUcL8twQRHzsXvG-XNsm2XVCg==
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 components-vflVDco9P.css
cfl.dropboxstatic.com/static/css/packaged/ 72 KB
10 KB 375ms
10ms Stylesheet
text/css 2400:cb00:2048:1::6810:641d
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL

https://cfl.dropboxstatic.com/static/css/packaged/components-vflVDco9P.css

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:641d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

5d46185d3009a2f6831c3f2bd427c4f54af80cd3dae01cbd2b808eaea62ce865

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /static/css/packaged/components-vflVDco9P.css
pragma: no-cache
origin: http://www.ghattiaproduct.com
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cfl.dropboxstatic.com
referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Origin: http://www.ghattiaproduct.com

Response headers

date: Mon, 27 Mar 2017 20:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 3464ef208a7364ed-FRA
status: 200
last-modified: Mon, 27 Mar 2017 18:01:56 GMT
server: cloudflare-nginx
etag: W/"58d95394-121a9"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000 public, immutable
x-dropbox-request-id: 28b1496cec2c97d8010c8e359ad10b96
set-cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807; expires=Tue, 27-Mar-18 20:00:07 GMT; path=/; domain=.dropboxstatic.com; HttpOnly
timing-allow-origin: https://www.dropbox.com
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 react_locale_selector-vflhGMsCx.css
cfl.dropboxstatic.com/static/css/components/ 429 B
181 B 384ms
19ms Stylesheet
text/css 2400:cb00:2048:1::6810:641d
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL

https://cfl.dropboxstatic.com/static/css/components/react_locale_selector-vflhGMsCx.css

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:641d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

a1dd783dbacda534e01b0cb55a71b3b6925bfa2651f3d01da30fb995074832f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /static/css/components/react_locale_selector-vflhGMsCx.css
pragma: no-cache
origin: http://www.ghattiaproduct.com
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cfl.dropboxstatic.com
referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Origin: http://www.ghattiaproduct.com

Response headers

date: Mon, 27 Mar 2017 20:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
content-length: 163
timing-allow-origin: https://www.dropbox.com
last-modified: Mon, 27 Mar 2017 18:12:38 GMT
server: cloudflare-nginx
etag: "58d95616-a3"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000 public, immutable
x-dropbox-request-id: 14d0231f5aba996677d610a917b5595c
set-cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807; expires=Tue, 27-Mar-18 20:00:07 GMT; path=/; domain=.dropboxstatic.com; HttpOnly
cf-ray: 3464ef208a7564ed-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main-vflBjGT-W.css
cfl.dropboxstatic.com/static/css/ 258 KB
35 KB 378ms
14ms Stylesheet
text/css 2400:cb00:2048:1::6810:641d
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL

https://cfl.dropboxstatic.com/static/css/main-vflBjGT-W.css

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:641d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

a5a5a6082a672b13706d8c66ded5464a7bd7f9e9600d35fe578715e0654092c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /static/css/main-vflBjGT-W.css
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cfl.dropboxstatic.com
referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
:scheme: https
:method: GET
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

date: Mon, 27 Mar 2017 20:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 3464ef208a7664ed-FRA
status: 200
last-modified: Mon, 27 Mar 2017 11:01:48 GMT
server: cloudflare-nginx
etag: W/"58d8f11c-40697"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000 public, immutable
x-dropbox-request-id: 90b190f9b70760e44499538cc75e980e
set-cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807; expires=Tue, 27-Mar-18 20:00:07 GMT; path=/; domain=.dropboxstatic.com; HttpOnly
timing-allow-origin: https://www.dropbox.com
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 upgrade_page-vflwHt5Yt.css
cfl.dropboxstatic.com/static/css/payments/ 39 KB
6 KB 383ms
19ms Stylesheet
text/css 2400:cb00:2048:1::6810:641d
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL

https://cfl.dropboxstatic.com/static/css/payments/upgrade_page-vflwHt5Yt.css

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:641d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

16181b96821799c4c07fbf65c60bb4e7001bb6b94564349df536f68eb8c3e13c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /static/css/payments/upgrade_page-vflwHt5Yt.css
pragma: no-cache
origin: http://www.ghattiaproduct.com
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: cfl.dropboxstatic.com
referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Origin: http://www.ghattiaproduct.com

Response headers

date: Mon, 27 Mar 2017 20:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cf-ray: 3464ef208a7464ed-FRA
status: 200
last-modified: Mon, 27 Mar 2017 18:01:56 GMT
server: cloudflare-nginx
etag: W/"58d95394-9c70"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=315360000 public, immutable
x-dropbox-request-id: 4ce7162e2d6b7172920d8f43cb8ca3e1
set-cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807; expires=Tue, 27-Mar-18 20:00:07 GMT; path=/; domain=.dropboxstatic.com; HttpOnly
timing-allow-origin: https://www.dropbox.com
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 404
Not Found html5shiv.js
www.ghattiaproduct.com/static/javascript/compiled/external/ 0
0 68ms
61ms Script
text/html 178.238.230.89
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://www.ghattiaproduct.com/static/javascript/compiled/external/html5shiv.js
Requested by: Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Protocol: HTTP/1.1
Server: 178.238.230.89 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: webserver.hosthof.com
Software: Apache/2.4.25 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: www.ghattiaproduct.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Mon, 27 Mar 2017 15:00:06 GMT
Server: Apache/2.4.25 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 365
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK sign-in-vflchypbO.png
cf.dropboxstatic.com/static/images/empty_states/ 29 KB
29 KB 74ms
23ms Image
image/png 13.32.113.23
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cf.dropboxstatic.com/static/images/empty_states/sign-in-vflchypbO.png

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.113.23 Norwalk, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

87dbdc4222e35d4c110e0b33b3fea9a0588b0d08195b8c098a95e906f57ad651

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: cf.dropboxstatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Wed, 08 Mar 2017 12:25:12 GMT
Via: 1.1 a83878ab138bfe1ba334c102434a7924.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1668895
X-Cache: Hit from cloudfront
X-Dropbox-Request-Id: 55b51d2e70e1739286e902779167a707
Connection: keep-alive
Content-Length: 29861
Last-Modified: Fri, 17 Feb 2017 00:01:20 GMT
Server: nginx
ETag: "58a63d50-74a5"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000 public, immutable
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.dropbox.com
X-Amz-Cf-Id: BItG0DJ3FU1OlQ8yJoUTng9SYsMthKCFFKa7x8cTSbqbxFKxpx6kVA==
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
559 B 127ms
44ms Stylesheet
text/css 2a00:1450:4010:c01::5f
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:500

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4010:c01::5f , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

ESF /

Resource Hash

6e7291c883743c781da206f644e41f09b1ffd1dc4e8ab620a145cf8354ea4621

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /css?family=Roboto:500
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: fonts.googleapis.com
referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

date: Mon, 27 Mar 2017 20:00:07 GMT
content-encoding: br
last-modified: Mon, 27 Mar 2017 20:00:07 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-frame-options: SAMEORIGIN
status: 200
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="37,36,35"
x-xss-protection: 1; mode=block
expires: Mon, 27 Mar 2017 20:00:07 GMT

GET
H/1.1 200
OK dropbox_logo_glyph_2015-vfl4ZOqXa.svg
cf.dropboxstatic.com/static/images/about/ 1 KB
514 B 24ms
24ms Image
image/svg+xml 13.32.113.23
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cf.dropboxstatic.com/static/images/about/dropbox_logo_glyph_2015-vfl4ZOqXa.svg

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.113.23 Norwalk, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

254a90a154b85fc441234e9f475034b5415ec428598bb16bba1ce2c8644b514c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: cf.dropboxstatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://cf.dropboxstatic.com/static/css/dropbox/base-vflN4g7TO.css
Cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807
Connection: keep-alive
Cache-Control: no-cache
Referer: https://cf.dropboxstatic.com/static/css/dropbox/base-vflN4g7TO.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Mon, 13 Feb 2017 00:30:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 3698981
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
X-Dropbox-Request-Id: c210ff39323e5e9ee672046098c57cc4
Connection: keep-alive
Via: 1.1 a83878ab138bfe1ba334c102434a7924.cloudfront.net (CloudFront)
Last-Modified: Wed, 07 Dec 2016 17:05:04 GMT
Server: nginx
ETag: W/"58484140-425"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000 public, immutable
Timing-Allow-Origin: https://www.dropbox.com
X-Amz-Cf-Id: k7Ge6qqkVgM-PZzZ2vkaXn2u31nKGhhAbdcGAvVC0HzV-xddc4bOcQ==
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK dropbox_logo_text_2015-vfld7_dJ8.svg
cf.dropboxstatic.com/static/images/about/ 3 KB
1 KB 49ms
24ms Image
image/svg+xml 13.32.113.23
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cf.dropboxstatic.com/static/images/about/dropbox_logo_text_2015-vfld7_dJ8.svg

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.32.113.23 Norwalk, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

Software

nginx /

Resource Hash

165ec8e380b00ca0fbfa4a71797f91cebe6e744a90358d8e5bd5cc01ddbb8034

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: cf.dropboxstatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://cf.dropboxstatic.com/static/css/dropbox/base-vflN4g7TO.css
Cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807
Connection: keep-alive
Cache-Control: no-cache
Referer: https://cf.dropboxstatic.com/static/css/dropbox/base-vflN4g7TO.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 17 Jan 2017 09:36:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 5999003
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
X-Dropbox-Request-Id: b6953d1502c42ffbc4fd665d2b97aff8
Connection: keep-alive
Via: 1.1 a83878ab138bfe1ba334c102434a7924.cloudfront.net (CloudFront)
Last-Modified: Wed, 07 Dec 2016 17:05:04 GMT
Server: nginx
ETag: W/"58484140-ab5"
Content-Type: image/svg+xml
Access-Control-Allow-Origin: *
Cache-Control: max-age=7776000
Timing-Allow-Origin: https://www.dropbox.com
X-Amz-Cf-Id: tHUrwnnUgaFLZy_VEy9IdeIUEx5yrYRSNBodst_pwSV8R5Mm7-UCpA==
Expires: Mon, 17 Apr 2017 09:36:44 GMT

GET
H2 200 google-logo-white-vfltwSoWq.svg
cfl.dropboxstatic.com/static/images/index/ 1 KB
648 B 19ms
19ms Image
image/svg+xml 2400:cb00:2048:1::6810:641d
CloudFlare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cfl.dropboxstatic.com/static/images/index/google-logo-white-vfltwSoWq.svg

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2400:cb00:2048:1::6810:641d , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

7def9565038652f45cda6e2f7e599563060226c4d9188bbe4a56f0a71fb1f1c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /static/images/index/google-logo-white-vfltwSoWq.svg
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: image/webp,image/*,*/*;q=0.8
cache-control: no-cache
:authority: cfl.dropboxstatic.com
cookie: __cfduid=dc52e46510a0b55c828c06b349d4cc8bd1490644807
:scheme: https
referer: https://cfl.dropboxstatic.com/static/css/packaged/components-vflVDco9P.css
:method: GET
Referer: https://cfl.dropboxstatic.com/static/css/packaged/components-vflVDco9P.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

date: Mon, 27 Mar 2017 20:00:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
status: 200
timing-allow-origin: https://www.dropbox.com
last-modified: Thu, 16 Feb 2017 19:08:54 GMT
server: cloudflare-nginx
etag: W/"58a5f8c6-5a8"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=315360000 public, immutable
x-dropbox-request-id: 693ad3c91eb00f25d4f0b820303b5ec2
cf-ray: 3464ef218b5564ed-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2
fonts.gstatic.com/s/roboto/v15/ 14 KB
14 KB 84ms
30ms Font
font/woff2 2a00:1450:400f:805::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v15/RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2

Requested by

Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:400f:805::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

01a44f86a9b361ef0d3ad5e4f9f0f01d394ab53fc5b0e3dff92466fa411e706b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /s/roboto/v15/RxZJdnzeo3R5zSexge8UUVtXRa8TVwTICgirnJhmVJw.woff2
pragma: no-cache
origin: http://www.ghattiaproduct.com
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: fonts.gstatic.com
referer: https://fonts.googleapis.com/css?family=Roboto:500
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto:500
Origin: http://www.ghattiaproduct.com

Response headers

date: Tue, 14 Mar 2017 17:50:22 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Jan 2015 22:47:38 GMT
server: sffe
age: 1130985
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="37,36,35"
content-length: 14596
x-xss-protection: 1; mode=block
expires: Wed, 14 Mar 2018 17:50:22 GMT

GET
H/1.1 404
Not Found checkmark.png
www.ghattiaproduct.com/cgi-bin1/read/1/c/ 348 B
348 B 45ms
45ms Image
text/html 178.238.230.89
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/checkmark.png
Requested by: Host: www.ghattiaproduct.com
URL: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Protocol: HTTP/1.1
Server: 178.238.230.89 , Germany, ASN51167 (CONTABO, DE),
Reverse DNS: webserver.hosthof.com
Software: Apache/2.4.25 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 /
Resource Hash: 9a2f1b4cacf7b1023628bc6b785ce5db3e0117176a1fdad7198f3d64a14a14f9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: www.ghattiaproduct.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://www.ghattiaproduct.com/cgi-bin1/read/1/c/document.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Mon, 27 Mar 2017 15:00:06 GMT
Server: Apache/2.4.25 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 348
Content-Type: text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cf.dropboxstatic.com
cfl.dropboxstatic.com
fonts.googleapis.com
fonts.gstatic.com
www.ghattiaproduct.com
13.32.113.23
178.238.230.89
2400:cb00:2048:1::6810:641d
2a00:1450:400f:805::2003
2a00:1450:4010:c01::5f
01a44f86a9b361ef0d3ad5e4f9f0f01d394ab53fc5b0e3dff92466fa411e706b
16181b96821799c4c07fbf65c60bb4e7001bb6b94564349df536f68eb8c3e13c
165ec8e380b00ca0fbfa4a71797f91cebe6e744a90358d8e5bd5cc01ddbb8034
254a90a154b85fc441234e9f475034b5415ec428598bb16bba1ce2c8644b514c
5d46185d3009a2f6831c3f2bd427c4f54af80cd3dae01cbd2b808eaea62ce865
6e7291c883743c781da206f644e41f09b1ffd1dc4e8ab620a145cf8354ea4621
7def9565038652f45cda6e2f7e599563060226c4d9188bbe4a56f0a71fb1f1c2
87dbdc4222e35d4c110e0b33b3fea9a0588b0d08195b8c098a95e906f57ad651
9a2f1b4cacf7b1023628bc6b785ce5db3e0117176a1fdad7198f3d64a14a14f9
9f2e5339eb669c0288b3eb81311e9f42d1b915b95d2caecdfcf0479e7ea8542d
a070107093da3127d17d4d33eefbcebe722612cce8de79774a507b055b23a385
a1dd783dbacda534e01b0cb55a71b3b6925bfa2651f3d01da30fb995074832f8
a5a5a6082a672b13706d8c66ded5464a7bd7f9e9600d35fe578715e0654092c2

www.ghattiaproduct.com Open in urlscan Pro 178.238.230.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

14 Requests

79 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

115 kBTransfer

457 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

www.ghattiaproduct.com Open in urlscan Pro
178.238.230.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

79 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

115 kB
Transfer

457 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!