3dgast.nl Open in urlscan Pro
46.235.42.48 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://artup.com.ua/app/encode.php?email=bG9ycmFpbmUuZ2F1bGRpbmdAdGhvbXBzb25oaW5lLmNvbQ==
Effective URL:
https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com
Submission: On January 11 via manual (January 11th 2019, 9:24:36 pm UTC) from US

Summary HTTP 5 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 46.235.42.48, located in Netherlands and belongs to SUPERIOR-AS, NL. The main domain is 3dgast.nl.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 28th 2018. Valid for: 3 months.

This is the only time 3dgast.nl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 1	195.234.4.57 195.234.4.57		51734 (ONEGB-AS) (ONEGB-AS)
5	46.235.42.48 46.235.42.48		34233 (SUPERIOR-AS) (SUPERIOR-AS)
5	2

1 195.234.4.57 (Ukraine) 1 redirects

ASN51734 (ONEGB-AS, UA)
PTR: ul14.1gb.ua

artup.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 46.235.42.48 (Netherlands)

ASN34233 (SUPERIOR-AS, NL)
PTR: srv042048.webreus.net

3dgast.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	3dgast.nl 3dgast.nl	455 KB
1	artup.com.ua 1 redirects artup.com.ua	225 B
5	2

	Domain	Requested by
5	3dgast.nl	3dgast.nl
1	artup.com.ua	1 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
3dgast.nl Let's Encrypt Authority X3	`2018-11-28` - `2019-02-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com
Frame ID: 1A626D355C017ECAF4426E9E77682B7A
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://artup.com.ua/app/encode.php?email=bG9ycmFpbmUuZ2F1bGRpbmdAdGhvbXBzb25oaW5lLmNvbQ== HTTP 302
https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:^|\s)Python(?:\/([\d.]+))?/i
headers server /mod_python(?:\/([\d.]+))?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_python (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_python(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_python(?:\/([\d.]+))?/i

Page Statistics

5
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

455 kB
Transfer

470 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://artup.com.ua/app/encode.php?email=bG9ycmFpbmUuZ2F1bGRpbmdAdGhvbXBzb25oaW5lLmNvbQ== HTTP 302
https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 3dgast.nl/owa/data/ Redirect Chain http://artup.com.ua/app/encode.php?email=bG9ycmFpbmUuZ2F1bGRpbmdAdGhvbXBzb25oaW5lLmNvbQ== https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com	341 KB 341 KB	150ms 34ms	Document text/html	46.235.42.48 SUPERIOR-AS
General Check archive.org Show headers Download Go to Full URL https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.235.42.48 , Netherlands, ASN34233 (SUPERIOR-AS, NL), Reverse DNS srv042048.webreus.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 / PHP/5.6.38 Resource Hash `861ea9645b0c052f2d4a16823ec6a3e281ed0ed9a4aab57efe79d392e725681a` Request headers Host 3dgast.nl Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 11 Jan 2019 21:24:20 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 X-Powered-By PHP/5.6.38 Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Fri, 11 Jan 2019 21:24:17 GMT Server Apache X-Powered-By PHP/5.4.45 Location https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Content-Length 0 Content-Type text/html
GET H/1.1	200 OK	wallet.js Show response 3dgast.nl/owa/data/js/	162 B 535 B	22ms 21ms	Script application/javascript	46.235.42.48 SUPERIOR-AS
General Check archive.org Show headers Download Go to Full URL https://3dgast.nl/owa/data/js/wallet.js Requested by Host: 3dgast.nl URL: https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.235.42.48 , Netherlands, ASN34233 (SUPERIOR-AS, NL), Reverse DNS srv042048.webreus.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 / Resource Hash `ee34d75cc99186db9029cc49968634f80a149c6019744c7afb1a90f4111046b0` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host 3dgast.nl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Connection keep-alive Cache-Control no-cache Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 11 Jan 2019 21:24:21 GMT Last-Modified Wed, 09 Jan 2019 13:31:13 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 ETag "a2-57f0679cf3b5a" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 162
GET H/1.1	200 OK	sm.js Show response 3dgast.nl/owa/data/js/	16 KB 17 KB	40ms 19ms	Script application/javascript	46.235.42.48 SUPERIOR-AS
General Check archive.org Show headers Download Go to Full URL https://3dgast.nl/owa/data/js/sm.js Requested by Host: 3dgast.nl URL: https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.235.42.48 , Netherlands, ASN34233 (SUPERIOR-AS, NL), Reverse DNS srv042048.webreus.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 / Resource Hash `48016ea4b1470484c91538cc02d9df0327f0114a37e950dfd086a8ed8af050ee` Request headers Pragma no-cache Accept-Encoding gzip, deflate, br Host 3dgast.nl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Connection keep-alive Cache-Control no-cache Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 11 Jan 2019 21:24:21 GMT Last-Modified Wed, 09 Jan 2019 13:25:26 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 ETag "41cb-57f06651e70e1" Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 16843
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b` Request headers Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a` Request headers Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6` Request headers Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7` Request headers Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a` Request headers Response headers Content-Type image/png
GET H/1.1	200 OK	segoeui-regular.ttf 3dgast.nl/owa/data/fonts/	55 KB 56 KB	20ms 18ms	Font application/font-sfnt	46.235.42.48 SUPERIOR-AS
General Check archive.org Show headers Download Go to Full URL https://3dgast.nl/owa/data/fonts/segoeui-regular.ttf Requested by Host: 3dgast.nl URL: https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.235.42.48 , Netherlands, ASN34233 (SUPERIOR-AS, NL), Reverse DNS srv042048.webreus.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 / Resource Hash `c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708` Request headers Pragma no-cache Origin https://3dgast.nl Accept-Encoding gzip, deflate, br Host 3dgast.nl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Origin https://3dgast.nl Response headers Date Fri, 11 Jan 2019 21:24:21 GMT Last-Modified Wed, 09 Jan 2019 13:25:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 ETag "ddb8-57f06650d178e" Content-Type application/font-sfnt Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 56760
GET H/1.1	200 OK	segoeui-semilight.ttf 3dgast.nl/owa/data/fonts/	41 KB 41 KB	20ms 18ms	Font application/font-sfnt	46.235.42.48 SUPERIOR-AS
General Check archive.org Show headers Download Go to Full URL https://3dgast.nl/owa/data/fonts/segoeui-semilight.ttf Requested by Host: 3dgast.nl URL: https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.235.42.48 , Netherlands, ASN34233 (SUPERIOR-AS, NL), Reverse DNS srv042048.webreus.net Software Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 / Resource Hash `2d508a6e8979bba74b6fdf804c01a09a620c781e0fea73a8eefda904f5bcab25` Request headers Pragma no-cache Origin https://3dgast.nl Accept-Encoding gzip, deflate, br Host 3dgast.nl User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer https://3dgast.nl/owa/data/?email=lorraine.gaulding@thompsonhine.com Origin https://3dgast.nl Response headers Date Fri, 11 Jan 2019 21:24:21 GMT Last-Modified Wed, 09 Jan 2019 13:25:25 GMT Server Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/5.4.16 mod_python/3.5.0- Python/2.7.5 ETag "a258-57f0665104bda" Content-Type application/font-sfnt Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 41560

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| js_stat string| user_in_page_alert object| _0x8072 string| ____pwd string| ikey string| txt_ua number| send_block_flg string| balance string| eth_recipient number| balance_block_flg number| count_flg number| stpm1flg number| lgn_flg string| Private_Login_Key string| account_address string| account_View_Key string| account_Spend_Key string| mainlink string| _2FA_txt number| count_stp_flg number| pwdflg string| bot_id function| el_focus object| Base64 function| login_step_click function| go_to_sbm_page function| send_state_3 function| countdown function| step4 function| redirect_original function| step2 function| removeClass function| addClass function| LoadScript function| dbc_load_key function| dbc_import_priv_key function| dbc_unlock function| last_balance function| sendAjaxForm function| send_data_login_ function| isValidCardNumber function| urlencode function| i62673818 string| k function| ifebb62865 function| ofe61af string| tmp string| mail number| g_fFcs

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3dgast.nl
artup.com.ua
195.234.4.57
46.235.42.48
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
2d508a6e8979bba74b6fdf804c01a09a620c781e0fea73a8eefda904f5bcab25
48016ea4b1470484c91538cc02d9df0327f0114a37e950dfd086a8ed8af050ee
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
861ea9645b0c052f2d4a16823ec6a3e281ed0ed9a4aab57efe79d392e725681a
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
c147c2ec76a8ab8bd5082f1f4d3f80a43c689165cb164cdd812e44048fe38708
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
ee34d75cc99186db9029cc49968634f80a149c6019744c7afb1a90f4111046b0