plasniqcola.ga Open in urlscan Pro
80.85.156.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://plasniqcola.ga/avangates/files/confusicate/?email=baqai@comsats.net
Effective URL:
http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4...
Submission: On January 03 via manual (January 3rd 2019, 2:17:10 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 80.85.156.55, located in Russian Federation and belongs to CHELYABINSK-SIGNAL-AS, RU. The main domain is plasniqcola.ga.

This is the only time plasniqcola.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 2	80.85.156.55 80.85.156.55		44493 (CHELYABIN...) (CHELYABINSK-SIGNAL-AS)
24 33	138.201.86.176 138.201.86.176		24940 (HETZNER-AS) (HETZNER-AS)
11	3

2 80.85.156.55 (Russian Federation) 1 redirects

ASN44493 (CHELYABINSK-SIGNAL-AS, RU)
PTR: node2.host.profitserver.ru

plasniqcola.ga	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 138.201.86.176 (Germany) 24 redirects

ASN24940 (HETZNER-AS, DE)
PTR: srv2.fishouse.it

cristofoli.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.cristofoli.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
33	cristofoli.it 24 redirects cristofoli.it www.cristofoli.it	600 KB
2	plasniqcola.ga 1 redirects plasniqcola.ga	8 KB
0	comsats.net Failed comsats.net Failed
11	3

	Domain	Requested by
17	www.cristofoli.it	8 redirects plasniqcola.ga
16	cristofoli.it	16 redirects
2	plasniqcola.ga	1 redirects
0	comsats.net Failed	plasniqcola.ga
11	4

This site contains no links.

Subject Issuer	Validity	Valid
www.cristofoli.it RapidSSL RSA CA 2018	`2018-08-23` - `2019-10-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: B5C9379A366272A033025E343CEE095E
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://plasniqcola.ga/avangates/files/confusicate/?email=baqai@comsats.net HTTP 302
http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightas... Page URL

Detected technologies

RoundCube (Web Mail) Expand

Overall confidence: 100%
Detected patterns

env /^(?:rcmail|rcube_|roundcube)/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

env /^(?:rcmail|rcube_|roundcube)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js/i
env /^jQuery$/i
script /jquery-ui(?:-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery-ui(?:-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery-ui.*\.js/i

Page Statistics

11
Requests

82 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

603 kB
Transfer

599 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://plasniqcola.ga/avangates/files/confusicate/?email=baqai@comsats.net HTTP 302
http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879

Request Chain 1

http://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532

Request Chain 2

http://cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360

Request Chain 3

http://cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532

Request Chain 4

http://cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532

Request Chain 5

http://cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532

Request Chain 6

http://cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532

Request Chain 7

http://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 HTTP 301
https://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 HTTP 301
http://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 HTTP 301
https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request vi44i81bfgrt2gyroman9ggp.php Show response plasniqcola.ga/avangates/files/confusicate/ Redirect Chain http://plasniqcola.ga/avangates/files/confusicate/?email=baqai@comsats.net http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1...	7 KB 7 KB	96ms 96ms	Document text/html	80.85.156.55 CHELYABINSK-SIGNA...
General Check archive.org Show headers Download Go to Full URL http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol HTTP/1.1 Server 80.85.156.55 , Russian Federation, ASN44493 (CHELYABINSK-SIGNAL-AS, RU), Reverse DNS node2.host.profitserver.ru Software nginx/1.12.2 / PHP/5.4.16 Resource Hash `554d37c5a5358fdd9a771d799b5d918286a3ee9495fd9865d5a178e3abdca4e3` Request headers Host plasniqcola.ga Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie PHPSESSID=cjjhvsiser9839s6ef89t0g7u5 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx/1.12.2 Date Thu, 03 Jan 2019 14:16:54 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive X-Powered-By PHP/5.4.16 Redirect headers Server nginx/1.12.2 Date Thu, 03 Jan 2019 14:16:54 GMT Content-Type text/html Content-Length 0 Connection keep-alive X-Powered-By PHP/5.4.16 Set-Cookie PHPSESSID=cjjhvsiser9839s6ef89t0g7u5; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Location vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1
GET H2	200	styles.css www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 https://cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 http://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 https://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879	46 KB 47 KB	17ms 16ms	Stylesheet text/css	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `c21819444c59933ada030bc71b93325df463d5644fd75181f8bbd5c69c07912a` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-b954" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type text/css status 200 accept-ranges bytes content-length 47444 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	jquery-ui-1.9.2.custom.css www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 https://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 http://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532	40 KB 40 KB	28ms 27ms	Stylesheet text/css	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `82b838c7fa90b82a5bba2e4310b7aa1f2ab436aa060ef4f255fdf8196e5ea42f` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-9fd5" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type text/css status 200 accept-ranges bytes content-length 40917 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.css?s=1399644532 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	ui.js Show response www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 https://cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 http://www.cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 https://www.cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360	34 KB 34 KB	17ms 17ms	Script application/javascript	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `e4048613475c00b1a77c90d3f7a8f9c0986cc710eff9ad990db9701d2e9995c4` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-87be" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type application/javascript status 200 accept-ranges bytes content-length 34750 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/ui.js?s=1382384360 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	jquery.min.js Show response www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 https://cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 http://www.cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 https://www.cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532	94 KB 94 KB	28ms 27ms	Script application/javascript	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-1787d" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type application/javascript status 200 accept-ranges bytes content-length 96381 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/jquery.min.js?s=1399644532 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	common.min.js Show response www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 https://cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 http://www.cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 https://www.cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532	13 KB 13 KB	29ms 28ms	Script application/javascript	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `32f59f8128d42dda46d1e3234d326574d25659bda0cd5762021e619c1a738ea6` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-3227" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type application/javascript status 200 accept-ranges bytes content-length 12839 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/common.min.js?s=1399644532 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	app.min.js Show response www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 https://cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 http://www.cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 https://www.cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532	128 KB 129 KB	28ms 27ms	Script application/javascript	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `f3ffb0e895c8503c8ae77b9ab28700f88c7fc5d966882634c059042f94dc3f85` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-201f5" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type application/javascript status 200 accept-ranges bytes content-length 131573 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/app.min.js?s=1399644532 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	jstz.min.js Show response www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 https://cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 http://www.cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 https://www.cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532	5 KB 5 KB	29ms 28ms	Script application/javascript	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `2d7f43c7ddda4bc107c80e268023650196b790f2b9ebc4b73e8908af1787d4f5` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-1549" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type application/javascript status 200 accept-ranges bytes content-length 5449 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/jstz.min.js?s=1399644532 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET H2	200	jquery-ui-1.9.2.custom.min.js Show response www.cristofoli.it/modules/mod_footer/FILES/ Redirect Chain http://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 https://cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 http://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532	231 KB 232 KB	18ms 17ms	Script application/javascript	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software nginx / PleskLin Resource Hash `f63ffa752044f857838b22cab1b1098dfab0701184ab6fcbf447c63e829660f5` Request headers Referer http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Thu, 03 Jan 2019 14:16:54 GMT etag "5b3f2cb2-39cc5" last-modified Fri, 06 Jul 2018 08:47:46 GMT server nginx x-powered-by PleskLin content-type application/javascript status 200 accept-ranges bytes content-length 236741 Redirect headers Location https://www.cristofoli.it/modules/mod_footer/FILES/jquery-ui-1.9.2.custom.min.js?s=1399644532 Date Thu, 03 Jan 2019 14:16:54 GMT Server nginx Connection keep-alive Content-Length 178 Content-Type text/html
GET		favicon.ico comsats.net/	0 0

GET H2	404	linen.jpg www.cristofoli.it/modules/mod_footer/FILES/images/	0 2 KB	62ms 62ms	Image text/html	138.201.86.176 HETZNER-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.cristofoli.it/modules/mod_footer/FILES/images/linen.jpg?v=0382.14157 Requested by Host: plasniqcola.ga URL: http://plasniqcola.ga/avangates/files/confusicate/vi44i81bfgrt2gyroman9ggp.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=baqai@comsats.net&.rand=13InboxLight.aspx?n=1774256418&fid=4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 138.201.86.176 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS srv2.fishouse.it Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.cristofoli.it/modules/mod_footer/FILES/styles.css?s=1387973879 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: comsats.net
URL: http://comsats.net/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| rcube_mail_ui function| rcube_scroller function| rcube_splitter function| $ function| jQuery number| CONTROL_KEY number| SHIFT_KEY number| CONTROL_SHIFT_KEY function| roundcube_browser object| rcube_event function| rcube_event_engine function| rcube_check_email function| rcube_clone_object function| urlencode function| rcube_find_object function| rcube_mouse_is_over function| setCookie function| getCookie function| rcube_console object| bw object| Base64 function| rcube_webmail object| jstz object| rcmail function| MM_findObj function| MM_validateForm object| jQuery111009887403470873746 function| DP_jQuery_1546525014923 object| UI

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			plasniqcola.ga/	1969-12-31 23:59:59	Name: PHPSESSID Value: cjjhvsiser9839s6ef89t0g7u5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

comsats.net
cristofoli.it
plasniqcola.ga
www.cristofoli.it
comsats.net
138.201.86.176
80.85.156.55
2d7f43c7ddda4bc107c80e268023650196b790f2b9ebc4b73e8908af1787d4f5
32f59f8128d42dda46d1e3234d326574d25659bda0cd5762021e619c1a738ea6
554d37c5a5358fdd9a771d799b5d918286a3ee9495fd9865d5a178e3abdca4e3
82b838c7fa90b82a5bba2e4310b7aa1f2ab436aa060ef4f255fdf8196e5ea42f
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
c21819444c59933ada030bc71b93325df463d5644fd75181f8bbd5c69c07912a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4048613475c00b1a77c90d3f7a8f9c0986cc710eff9ad990db9701d2e9995c4
f3ffb0e895c8503c8ae77b9ab28700f88c7fc5d966882634c059042f94dc3f85
f63ffa752044f857838b22cab1b1098dfab0701184ab6fcbf447c63e829660f5