dirtycustomz.net Open in urlscan Pro
77.104.146.156 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://dirtycustomz.net/adobie/invoice2.htm
Submission: On January 27 via automatic, source openphish (January 27th 2017, 9:03:24 pm UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 77.104.146.156, located in United States and belongs to SINGLEHOP-LLC - SingleHop, Inc., US. The main domain is dirtycustomz.net.

This is the only time dirtycustomz.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer) Generic Email (Online) Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
5	77.104.146.156 77.104.146.156	32475 (SINGLEHOP...) (SINGLEHOP-LLC - SingleHop)
3	68.65.122.38 68.65.122.38	22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap)
8	2

5 77.104.146.156 (United States)

ASN32475 (SINGLEHOP-LLC - SingleHop, Inc., US)
PTR: ip-77-104-146-156.siteground.com

dirtycustomz.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 68.65.122.38 (United States)

ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: s163.web-hosting.com

jiukkang.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	dirtycustomz.net dirtycustomz.net	16 KB
3	jiukkang.com jiukkang.com	109 KB
8	2

	Domain	Requested by
5	dirtycustomz.net	dirtycustomz.net
3	jiukkang.com	dirtycustomz.net
8	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://dirtycustomz.net/adobie/invoice2.htm
Frame ID: 19105.1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

8
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

125 kB
Transfer

125 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request invoice2.htm Show response
dirtycustomz.net/adobie/ 14 KB
14 KB 374ms
118ms Document
text/html 77.104.146.156
SingleHop

General

Check archive.org

Show headers Download Go to

Full URL

http://dirtycustomz.net/adobie/invoice2.htm

Protocol

HTTP/1.1

Server

77.104.146.156 , United States, ASN32475 (SINGLEHOP-LLC - SingleHop, Inc., US),

Reverse DNS

ip-77-104-146-156.siteground.com

Software

nginx /

Resource Hash

e8920630eaec1e4e551776a474ec5c76eee010d8fc6ed484b7f8f8b85579ea4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: dirtycustomz.net
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36

Response headers

ETag: "38d8-546fe59dc7e1f"
Accept-Ranges: bytes
Content-Length: 14552
Last-Modified: Thu, 26 Jan 2017 12:18:46 GMT
Server: nginx
Content-Type: text/html
Host-Header: 192fc2e7e50945beb8231a492d6a8024
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Proxy-Cache: MISS
Date: Fri, 27 Jan 2017 21:03:14 GMT
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK pdf-logo.png
jiukkang.com/dobe/ 31 KB
31 KB 385ms
172ms Image
image/png 68.65.122.38
Namecheap

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jiukkang.com/dobe/pdf-logo.png
Requested by: Host: dirtycustomz.net
URL: http://dirtycustomz.net/adobie/invoice2.htm
Protocol: HTTP/1.1
Server: 68.65.122.38 , United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS: s163.web-hosting.com
Software: Apache /
Resource Hash: d5a135bd47b11881dc1a223ea1ea946e6ca5e7cb3b1af58eef8629ea017dbd4e

Request headers

Accept-Encoding: gzip, deflate, sdch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Pragma: no-cache
Host: jiukkang.com
Accept-Language: en-US,en;q=0.8
Connection: keep-alive
Cache-Control: no-cache
Referer: http://dirtycustomz.net/adobie/invoice2.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36

Response headers

Date: Fri, 27 Jan 2017 21:03:15 GMT
Last-Modified: Thu, 23 Jun 2016 15:06:54 GMT
Server: Apache
Accept-Ranges: bytes
Content-Length: 31580
Content-Type: image/png

GET
H/1.1 200
OK 100Secure.jpg
jiukkang.com/dobe/ 5 KB
5 KB 393ms
177ms Image
image/jpeg 68.65.122.38
Namecheap

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jiukkang.com/dobe/100Secure.jpg
Requested by: Host: dirtycustomz.net
URL: http://dirtycustomz.net/adobie/invoice2.htm
Protocol: HTTP/1.1
Server: 68.65.122.38 , United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS: s163.web-hosting.com
Software: Apache /
Resource Hash: 2f71bea7601b970d07eea91af38bcee8b1c9fc197b5f85cbe9bae3b9f2b705c5

Request headers

Accept: image/webp,image/*,*/*;q=0.8
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Connection: keep-alive
Cache-Control: no-cache
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Host: jiukkang.com
Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Referer: http://dirtycustomz.net/adobie/invoice2.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36

Response headers

Server: Apache
Accept-Ranges: bytes
Content-Length: 4687
Content-Type: image/jpeg
Date: Fri, 27 Jan 2017 21:03:15 GMT
Last-Modified: Thu, 23 Jun 2016 15:06:43 GMT

GET
H/1.1 200
OK bg.jpg
jiukkang.com/dobe/ 73 KB
73 KB 399ms
180ms Image
image/jpeg 68.65.122.38
Namecheap

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://jiukkang.com/dobe/bg.jpg
Requested by: Host: dirtycustomz.net
URL: http://dirtycustomz.net/adobie/invoice2.htm
Protocol: HTTP/1.1
Server: 68.65.122.38 , United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS: s163.web-hosting.com
Software: Apache /
Resource Hash: bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf

Request headers

Accept-Encoding: gzip, deflate, sdch
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Connection: keep-alive
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Cache-Control: no-cache
Pragma: no-cache
Host: jiukkang.com
Accept-Language: en-US,en;q=0.8
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://dirtycustomz.net/adobie/invoice2.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36

Response headers

Content-Length: 74994
Content-Type: image/jpeg
Date: Fri, 27 Jan 2017 21:03:15 GMT
Last-Modified: Thu, 23 Jun 2016 15:06:51 GMT
Server: Apache
Accept-Ranges: bytes

GET
H/1.1 404
Not Found Cookie set small.png
dirtycustomz.net/adobie/ 860 B
866 B 1131ms
1131ms Image
text/html 77.104.146.156
SingleHop

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://dirtycustomz.net/adobie/small.png

Requested by

Host: dirtycustomz.net
URL: http://dirtycustomz.net/adobie/invoice2.htm

Protocol

HTTP/1.1

Server

77.104.146.156 , United States, ASN32475 (SINGLEHOP-LLC - SingleHop, Inc., US),

Reverse DNS

ip-77-104-146-156.siteground.com

Software

nginx /

Resource Hash

57ee51a5bc96d3b35fead3096f0586b7580f50865a27e0fb054a14bbc7056b8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Pragma: no-cache
Host: dirtycustomz.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Connection: keep-alive
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Referer: http://dirtycustomz.net/adobie/invoice2.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36

Response headers

Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Date: Fri, 27 Jan 2017 21:03:15 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Server: nginx
Connection: keep-alive
Set-Cookie: frontend=te53mb8dj8srfnke0u42bhhbn0; expires=Fri, 27-Jan-2017 22:03:15 GMT; Max-Age=3600; path=/; domain=dirtycustomz.net; HttpOnly
Host-Header: 192fc2e7e50945beb8231a492d6a8024
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 404
Not Found Cookie set et-line.woff
dirtycustomz.net/adobie/fonts/ 0
0 1145ms
1033ms Font
text/html 77.104.146.156
SingleHop

General

Check archive.org

Show headers Download Go to

Full URL

http://dirtycustomz.net/adobie/fonts/et-line.woff

Requested by

Host: dirtycustomz.net
URL: http://dirtycustomz.net/adobie/invoice2.htm

Protocol

HTTP/1.1

Server

77.104.146.156 , United States, ASN32475 (SINGLEHOP-LLC - SingleHop, Inc., US),

Reverse DNS

ip-77-104-146-156.siteground.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-US,en;q=0.8
Cache-Control: no-cache
Accept-Encoding: gzip, deflate, sdch
Origin: http://dirtycustomz.net
Host: dirtycustomz.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Accept: */*
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Connection: keep-alive
Pragma: no-cache
Origin: http://dirtycustomz.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Referer: http://dirtycustomz.net/adobie/invoice2.htm

Response headers

Host-Header: 192fc2e7e50945beb8231a492d6a8024
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Set-Cookie: frontend=q6pnb4df730eb0sk1icg7e43b1; expires=Fri, 27-Jan-2017 22:03:15 GMT; Max-Age=3600; path=/; domain=dirtycustomz.net; HttpOnly
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Date: Fri, 27 Jan 2017 21:03:15 GMT
X-Content-Type-Options: nosniff
Server: nginx

GET
H/1.1 404
Not Found Cookie set et-line.ttf
dirtycustomz.net/adobie/fonts/ 0
0 1389ms
1270ms Font
text/html 77.104.146.156
SingleHop

General

Check archive.org

Show headers Download Go to

Full URL

http://dirtycustomz.net/adobie/fonts/et-line.ttf

Requested by

Host: dirtycustomz.net
URL: http://dirtycustomz.net/adobie/invoice2.htm

Protocol

HTTP/1.1

Server

77.104.146.156 , United States, ASN32475 (SINGLEHOP-LLC - SingleHop, Inc., US),

Reverse DNS

ip-77-104-146-156.siteground.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Cookie: frontend=q6pnb4df730eb0sk1icg7e43b1
Connection: keep-alive
Cache-Control: no-cache
Accept-Language: en-US,en;q=0.8
Accept: */*
Accept-Encoding: gzip, deflate, sdch
Host: dirtycustomz.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Pragma: no-cache
Origin: http://dirtycustomz.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Origin: http://dirtycustomz.net

Response headers

Connection: keep-alive
Set-Cookie: frontend=q6pnb4df730eb0sk1icg7e43b1; expires=Fri, 27-Jan-2017 22:03:16 GMT; Max-Age=3600; path=/; domain=dirtycustomz.net; httponly
X-XSS-Protection: 1; mode=block
Date: Fri, 27 Jan 2017 21:03:17 GMT
X-Frame-Options: SAMEORIGIN
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Host-Header: 192fc2e7e50945beb8231a492d6a8024
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
X-Content-Type-Options: nosniff

GET
H/1.1 200
OK favicon.ico
dirtycustomz.net/ 1 KB
1 KB 236ms
119ms Other
image/x-icon 77.104.146.156
SingleHop

General

Check archive.org

Show headers Download Go to

Full URL

http://dirtycustomz.net/favicon.ico

Protocol

HTTP/1.1

Server

77.104.146.156 , United States, ASN32475 (SINGLEHOP-LLC - SingleHop, Inc., US),

Reverse DNS

ip-77-104-146-156.siteground.com

Software

nginx /

Resource Hash

ce2de4b3be943fd5414dc6f3190d332fc9f6369f5dfbf6366b00b261ed02a4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Cache-Control: no-cache
Accept-Encoding: gzip, deflate, sdch
Accept: image/webp,image/*,*/*;q=0.8
Cookie: frontend=q6pnb4df730eb0sk1icg7e43b1
Connection: keep-alive
Referer: http://dirtycustomz.net/adobie/invoice2.htm
Pragma: no-cache
Host: dirtycustomz.net
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.76 Safari/537.36
Referer: http://dirtycustomz.net/adobie/invoice2.htm

Response headers

Last-Modified: Wed, 16 Nov 2016 16:12:03 GMT
Server: nginx
Content-Type: image/x-icon
Host-Header: 192fc2e7e50945beb8231a492d6a8024
Connection: keep-alive
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
Date: Fri, 27 Jan 2017 21:03:17 GMT
X-Content-Type-Options: nosniff
ETag: "47e-5416d5560e76d"
Content-Length: 1150
X-Proxy-Cache: MISS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer) Generic Email (Online) Excel / PDF download (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dirtycustomz.net/	2017-01-27 22:03:17	Name: frontend Value: q6pnb4df730eb0sk1icg7e43b1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dirtycustomz.net
jiukkang.com
68.65.122.38
77.104.146.156
2f71bea7601b970d07eea91af38bcee8b1c9fc197b5f85cbe9bae3b9f2b705c5
57ee51a5bc96d3b35fead3096f0586b7580f50865a27e0fb054a14bbc7056b8f
bfb7362b6a5d508578ebe4f1884a92dba530b76fbe6be8db4a7b771c6aacaccf
ce2de4b3be943fd5414dc6f3190d332fc9f6369f5dfbf6366b00b261ed02a4cf
d5a135bd47b11881dc1a223ea1ea946e6ca5e7cb3b1af58eef8629ea017dbd4e
e8920630eaec1e4e551776a474ec5c76eee010d8fc6ed484b7f8f8b85579ea4c

dirtycustomz.net Open in urlscan Pro 77.104.146.156 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

8 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

125 kBTransfer

125 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

dirtycustomz.net Open in urlscan Pro
77.104.146.156 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

125 kB
Transfer

125 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!