urlscan.io logo urlscan.io
SecurityTrails logo

adminer.square7.ch Open in urlscan Pro
148.251.48.69  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://bit.ly/2E5SH3b
Effective URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Submission: On January 18 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 148.251.48.69, located in Germany and belongs to HETZNER-AS, DE. The main domain is adminer.square7.ch.
This is the only time adminer.square7.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 395224 (BITLY-AS)
8 148.251.48.69 24940 (HETZNER-AS)
1 94.130.236.100 24940 (HETZNER-AS)
1 146.148.55.169 15169 (GOOGLE)
10 3
Apex Domain
Subdomains		 Transfer
8 square7.ch
adminer.square7.ch
233 KB
1 bitadexchange.com
www.bitadexchange.com
160 B
1 bplaced.net
www.bplaced.net
638 B
1 bit.ly
bit.ly
369 B
10 4
Domain Requested by
8 adminer.square7.ch adminer.square7.ch
1 www.bitadexchange.com www.bplaced.net
1 www.bplaced.net adminer.square7.ch
1 bit.ly 1 redirects
10 4

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Frame ID: (7046A8E28A3177508BEB9ECE312BA7B1)
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://bit.ly/2E5SH3b HTTP 301
    http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

10
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

234 kB
Transfer

231 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bit.ly/2E5SH3b HTTP 301
    http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Redirect Chain
  • http://bit.ly/2E5SH3b
  • http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
f41440fbc8ab50f46e563c5f2378be8ffaef5cd5403bd0868b0384241a674dc1

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:27:29 GMT
Server
Apache/2.4
ETag
"758-56169d49175b6"
Vary
Accept-Encoding
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
1961

Redirect headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Server
nginx
Content-Type
text/html; charset=utf-8
Location
http://adminer.square7.ch/HUSH DROP TODA-EDITED/
Set-Cookie
_bit=i0imVc-717964be26eda8a877-00n; Domain=bit.ly; Expires=Tue, 17 Jul 2018 22:57:12 GMT
Cache-Control
private, max-age=90
Connection
keep-alive
Content-Length
135
officelogo.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/officelogo.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
010da445e8c3df9019ed05532d7caaa0879eaef62761289bca71f93782fe9d56

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:28:12 GMT
Server
Apache/2.4
ETag
"229f-56169d71d413e"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=499
Content-Length
8863
googlelogo.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/googlelogo.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
47d4e3ecf486cf9e611f4efd0ee3fb1353bad7b78e49310168ba5e5102b1de33

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:28:02 GMT
Server
Apache/2.4
ETag
"a30-56169d686ae55"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
2608
outlooklogo.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/outlooklogo.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
5536cdcf45ed63ad03a3214f532bfd01364f8f016b31c019959080e753aeed36

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:28:17 GMT
Server
Apache/2.4
ETag
"fc9-56169d76f58e3"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
4041
aollogo.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		919 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/aollogo.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
33cf2383e9a88578a6e92a30db80f030773d28055b6e7008a849ac7f8c8acb0a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:27:50 GMT
Server
Apache/2.4
ETag
"397-56169d5db0ccb"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
919
yahoologo.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/yahoologo.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
19dcc4f189dbc6b7d5c7745b26a153c5f38b263bea0dca4fd9f68791d77caefa

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:28:20 GMT
Server
Apache/2.4
ETag
"fe2-56169d7a24026"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
4066
weblogo.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		583 B
856 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/weblogo.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
554bb7b59a3ea1243bfa5b684ca0d2fe8df727d1e7007f1e1c0a5afd995516a2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:28:19 GMT
Server
Apache/2.4
ETag
"247-56169d78dbe25"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
583
bpa.js
www.bplaced.net/pub/ 		142 B
638 B 		Script
General
Check archive.org
Download Go to
Full URL
http://www.bplaced.net/pub/bpa.js
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
94.130.236.100 , Ukraine, ASN24940 (HETZNER-AS, DE),
Reverse DNS
mx.bplaced.net
Software
Apache /
Resource Hash
4d1b9a00cb37404f2642d46b66af2b15f69585db1799d1a3707211b47b4bc5d1
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Upgrade, Keep-Alive
Content-Length
141
X-BP-NSA-REQID
(null) a.14UID=326
Last-Modified
Mon, 08 Jan 2018 01:31:23 GMT
Server
Apache
ETag
"8e-56239c18610c0-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Cache-Control
max-age=7200
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=4, max=500
Expires
Fri, 19 Jan 2018 00:57:12 GMT
background2.png
adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/ 		209 KB
209 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/images/background2.png
Requested by
Host: adminer.square7.ch
URL: http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
1453db407b4b59ed96519b1c90d53a6d88be708ad66180c664bb3b7ef902aa4f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
adminer.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Last-Modified
Thu, 28 Dec 2017 17:27:56 GMT
Server
Apache/2.4
ETag
"34264-56169d6330070"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=498
Content-Length
213604
display.php
www.bitadexchange.com/a/ 		0
160 B 		Script
General
Check archive.org
Download Go to
Full URL
http://www.bitadexchange.com/a/display.php?r=1867255
Requested by
Host: www.bplaced.net
URL: http://www.bplaced.net/pub/bpa.js
Protocol
HTTP/1.1
Server
146.148.55.169 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
169.55.148.146.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://adminer.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 18 Jan 2018 22:57:12 GMT
Referrer-Policy
no-referrer
Server
openresty
Connection
keep-alive
Vary
Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint

0 Cookies