t.co Open in urlscan Pro
104.244.42.5 Malicious Activity! Public Scan

URL:
https://t.co/eXFBkKZbWR
Submission: On October 12 via manual (October 12th 2017, 10:56:53 am UTC) from GB

Summary HTTP 9 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 9 HTTP transactions. The main IP is 104.244.42.5, located in San Francisco, United States and belongs to TWITTER - Twitter Inc., US. The main domain is t.co.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 25th 2017. Valid for: a year.

This is the only time t.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER - Twitter Inc.)
1	207.241.228.152 207.241.228.152	7941 (INTERNET-...) (INTERNET-ARCHIVE - Internet Archive)
3	185.148.144.161 185.148.144.161	44901 (BELCLOUD) (BELCLOUD)
1	193.163.251.53 193.163.251.53	15423 (MAERSK) (MAERSK)
1 1	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2a00:1450:400... 2a00:1450:4001:825::2001	15169 (GOOGLE) (GOOGLE - Google Inc.)
9	6

1 104.244.42.5 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 207.241.228.152 (San Francisco, United States)

ASN7941 (INTERNET-ARCHIVE - Internet Archive, US)
PTR: ia801502.us.archive.org

ia801502.us.archive.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.148.144.161 (Bulgaria)

ASN44901 (BELCLOUD, BG)
PTR: ns111.truehoster.net

iregal.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.163.251.53 (Denmark)

ASN15423 (MAERSK, DK)

www.maersk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200e (Ireland) 1 redirects

ASN15169 (GOOGLE - Google Inc., US)

drive.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2001 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

doc-0s-7k-docs.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	iregal.site iregal.site Failed	13 KB
1	googleusercontent.com doc-0s-7k-docs.googleusercontent.com	486 KB
1	google.com 1 redirects drive.google.com	798 B
1	maersk.com www.maersk.com	5 KB
1	archive.org ia801502.us.archive.org Failed	231 B
1	t.co t.co	231 B
9	6

	Domain	Requested by
3	iregal.site	iregal.site
1	doc-0s-7k-docs.googleusercontent.com	iregal.site
1	drive.google.com	1 redirects
1	www.maersk.com	iregal.site
1	ia801502.us.archive.org	t.co
1	t.co
9	6

This site contains links to these domains. Also see Links.

Domain
t.co

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 Extended Validation Server CA	`2017-07-25` - `2018-11-05`	a year	crt.sh
*.us.archive.org Go Daddy Secure Certificate Authority - G2	`2016-12-19` - `2020-02-21`	3 years	crt.sh
iregal.atania.site cPanel, Inc. Certification Authority	`2017-10-01` - `2017-12-30`	3 months	crt.sh
maersk.com GeoTrust SSL CA - G3	`2017-09-29` - `2020-02-02`	2 years	crt.sh
*.googleusercontent.com Google Internet Authority G2	`2017-09-26` - `2017-12-19`	3 months	crt.sh

This page contains 3 frames:

Frame: https://ia801502.us.archive.org/35/items/eiqarBm/b1okXK1Tlj6.html
Frame ID: 28335.1
Requests: 2 HTTP requests in this frame

Frame: https://iregal.site/2315552067/inHNKoee.php?l=eA5GxiaZAIwXS7tUuUMJ0iwOY1Vm2jK9UNsCOebKjxkW5XjDepMYMxC0yRQlNrHIW9Jp4xajXNLi4VX1wxUAIwXS7tUuSwun1
Frame ID: 28359.1
Requests: 2 HTTP requests in this frame

Frame: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
Frame ID: 28370.1
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

9
Requests

78 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

504 kB
Transfer

536 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://t.co/HAqz4PlLBI
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://drive.google.com/uc?export=view&id=0B7FiDjVNHKRsdGhZNkgycnhPM3M HTTP 302
https://doc-0s-7k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t8tumlmh93eeh65cj3af0qrclb3d8d8i/1507802400000/08972908063980297529/*/0B7FiDjVNHKRsdGhZNkgycnhPM3M?e=view

9 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request eXFBkKZbWR Show response
t.co/ 353 B
231 B 140ms
121ms Document
text/html 104.244.42.5
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/eXFBkKZbWR

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

aa7a48e32b9604f271c139661a3b339dc40c0003c88d02077f4e3116a4add996

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block

Request headers

:path: /eXFBkKZbWR
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: t.co
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

x-response-time: 115
date: Thu, 12 Oct 2017 10:56:41 GMT
content-encoding: gzip
server: tsa_o
strict-transport-security: max-age=0
content-type: text/html; charset=utf-8
status: 200
set-cookie: muc=0dee6724-e2f7-4c79-a41d-a590c6999a88; Expires=Sat, 12 Oct 2019 10:56:41 UTC; Domain=t.co
cache-control: private,max-age=300
x-connection-hash: 0773c9324aef59dc16fe039970bafa10
content-length: 222
x-xss-protection: 1; mode=block
expires: Thu, 12 Oct 2017 11:01:41 GMT

GET b1okXK1Tlj6.html
ia801502.us.archive.org/35/items/eiqarBm/ 0
0

GET
H/1.1 200
OK b1okXK1Tlj6.html Show response
ia801502.us.archive.org/35/items/eiqarBm/ Frame 2835 242 B
231 B 877ms
220ms Document
text/html 207.241.228.152
Internet Archive

General

Check archive.org

Show headers Download Go to

Full URL: https://ia801502.us.archive.org/35/items/eiqarBm/b1okXK1Tlj6.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 207.241.228.152 San Francisco, United States, ASN7941 (INTERNET-ARCHIVE - Internet Archive, US),
Reverse DNS: ia801502.us.archive.org
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 7f31e7dfb3bb463ace3c592cf48c2e3814d7e68ffd423f962f648aa3ecf66971

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ia801502.us.archive.org
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://t.co/eXFBkKZbWR
Connection: keep-alive
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
Referer: https://t.co/eXFBkKZbWR
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 12 Oct 2017 10:56:41 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Oct 2017 16:39:07 GMT
Server: nginx/1.4.6 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: text/html
Cache-Control: max-age=21600
Connection: keep-alive
Expires: Thu, 12 Oct 2017 16:56:41 GMT

GET inHNKoee.php
iregal.site/2315552067/ Frame 2835 0
0

GET
H2 200 inHNKoee.php Show response
iregal.site/2315552067/ Frame 2837 265 B
265 B 531ms
251ms Document
text/html 185.148.144.161
BELCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://iregal.site/2315552067/inHNKoee.php?l=eA5GxiaZAIwXS7tUuUMJ0iwOY1Vm2jK9UNsCOebKjxkW5XjDepMYMxC0yRQlNrHIW9Jp4xajXNLi4VX1wxUAIwXS7tUuSwun1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.148.144.161 , Bulgaria, ASN44901 (BELCLOUD, BG),
Reverse DNS: ns111.truehoster.net
Software: LiteSpeed /
Resource Hash: 58bea621645079b7f7bffe20337bab72420f87c994c4f4a307aa28141c5c28eb

Request headers

:path: /2315552067/inHNKoee.php?l=eA5GxiaZAIwXS7tUuUMJ0iwOY1Vm2jK9UNsCOebKjxkW5XjDepMYMxC0yRQlNrHIW9Jp4xajXNLi4VX1wxUAIwXS7tUuSwun1
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: iregal.site
referer: https://ia801502.us.archive.org/35/items/eiqarBm/b1okXK1Tlj6.html
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
Referer: https://ia801502.us.archive.org/35/items/eiqarBm/b1okXK1Tlj6.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 12 Oct 2017 10:56:42 GMT
content-encoding: gzip
server: LiteSpeed
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 200
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 247

GET
H2 200 ac0cb1.php Show response
iregal.site/2315552067/ Frame 2837 34 KB
10 KB 802ms
802ms Document
text/html 185.148.144.161
BELCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.148.144.161 , Bulgaria, ASN44901 (BELCLOUD, BG),
Reverse DNS: ns111.truehoster.net
Software: LiteSpeed /
Resource Hash: 9c6e88597c5bb55270702e1507dfff381e5d531eb6d4058426b8c38f4f82c677

Request headers

:path: /2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: iregal.site
referer: https://iregal.site/2315552067/inHNKoee.php?l=eA5GxiaZAIwXS7tUuUMJ0iwOY1Vm2jK9UNsCOebKjxkW5XjDepMYMxC0yRQlNrHIW9Jp4xajXNLi4VX1wxUAIwXS7tUuSwun1
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
Referer: https://iregal.site/2315552067/inHNKoee.php?l=eA5GxiaZAIwXS7tUuUMJ0iwOY1Vm2jK9UNsCOebKjxkW5XjDepMYMxC0yRQlNrHIW9Jp4xajXNLi4VX1wxUAIwXS7tUuSwun1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 12 Oct 2017 10:56:43 GMT
content-encoding: gzip
server: LiteSpeed
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 200
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
set-cookie: PHPSESSID=i4i2voj5i6agpq6bjjuavjdo23; path=/
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 10068
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 style.css
iregal.site/2315552067/=/ Frame 2837 8 KB
3 KB 67ms
67ms Stylesheet
text/css 185.148.144.161
BELCLOUD

General

Check archive.org

Show headers Download Go to

Full URL: https://iregal.site/2315552067/=/style.css
Requested by: Host: iregal.site
URL: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 185.148.144.161 , Bulgaria, ASN44901 (BELCLOUD, BG),
Reverse DNS: ns111.truehoster.net
Software: LiteSpeed /
Resource Hash: 76c5e90dbc360de833504b8e20c62ac98d33cdc2a1a8b56d1396c0af50cfa1fa

Request headers

:path: /2315552067/=/style.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: iregal.site
cookie: PHPSESSID=i4i2voj5i6agpq6bjjuavjdo23
:scheme: https
referer: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
:method: GET
Referer: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 12 Oct 2017 10:56:43 GMT
content-encoding: gzip
last-modified: Fri, 04 Nov 2016 20:47:26 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="35,37,38,39"
content-length: 2695
expires: Thu, 19 Oct 2017 10:56:43 GMT

GET
H/1.1 200
OK Cookie set header-logo.ashx
www.maersk.com/-/media/testdata/ Frame 2837 5 KB
5 KB 192ms
56ms Image
image/jpeg 193.163.251.53
MAERSK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.maersk.com/-/media/testdata/header-logo.ashx?h=32&w=143&la=en&hash=DE95D2A1F27716C0408EF590E8DDD773E92887F1
Requested by: Host: iregal.site
URL: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 193.163.251.53 , Denmark, ASN15423 (MAERSK, DK),
Reverse DNS
Software: /
Resource Hash: fbfb0ab52d8a6dc26a1d0b21a79cf73da1d78e19b637c1d1e7fef2a850891939

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: www.maersk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
Connection: keep-alive
Cache-Control: no-cache
Referer: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 12 Oct 2017 10:56:52 GMT
Last-Modified: Tue, 25 Apr 2017 07:31:53 GMT
Server
Content-Type: image/jpeg
Cache-Control: private, max-age=604800
Content-Disposition: inline; filename="header-logo.jpg"
Set-Cookie: BIGipServerCSC_Sitecore_WD_ILB_80=2407137034.20480.0000; path=/; Httponly; Secure
Accept-Ranges: bytes
Content-Length: 4738
Expires: Thu, 19 Oct 2017 10:56:53 GMT

GET
DATA 200
OK truncated
/ Frame 2837 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82a4690a2c25a5a52fbb5086a0f6771a6f9f2f3f5ffa832ab9770ad16d0a25f2

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H2

200

0B7FiDjVNHKRsdGhZNkgycnhPM3M
doc-0s-7k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t8tumlmh93eeh65cj3af0qrclb3d8d8i/1507802400000/08972908063980297529/*/ Frame 2837
Redirect Chain

https://drive.google.com/uc?export=view&id=0B7FiDjVNHKRsdGhZNkgycnhPM3M
https://doc-0s-7k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t8tumlmh93eeh65cj3af0qrclb3d8d8i/1507802400000/08972908063980297529/*/0B7FiDjVNHKRsdGhZNkgycnhPM3M?e=view

485 KB
486 KB

224ms
203ms

Image
image/jpeg

2a00:1450:4001:825::2001
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://doc-0s-7k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t8tumlmh93eeh65cj3af0qrclb3d8d8i/1507802400000/08972908063980297529/*/0B7FiDjVNHKRsdGhZNkgycnhPM3M?e=view
Requested by: Host: iregal.site
URL: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2a00:1450:4001:825::2001 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: a8a0b21ac9b2896e521066d359e33f4c7c4713bb88a5bf0b2744589001d114ed

Request headers

:path: /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t8tumlmh93eeh65cj3af0qrclb3d8d8i/1507802400000/08972908063980297529/*/0B7FiDjVNHKRsdGhZNkgycnhPM3M?e=view
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: doc-0s-7k-docs.googleusercontent.com
referer: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
:scheme: https
:method: GET
Referer: https://iregal.site/2315552067/ac0cb1.php?l=KIH4PY9OOVPUIHZEP5TOR27F3920RHJ1RRX5EXJSGYBQ61VLXEZD6WI0XAQDI040HRVMC54JU60RYL3KQSOLFXC1XS45IZVQGG2JCWUXUJDHX6SBP5OUSQKE7F9G5UXB1O
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/61.0.3163.100 Safari/537.36

Response headers

date: Thu, 12 Oct 2017 10:56:44 GMT
access-control-allow-methods: GET,OPTIONS
server: UploadServer
access-control-allow-headers: Accept, Accept-Language, Api-Ai-Dev-Mode, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, GData-Version, google-cloud-resource-prefix, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, Slug, Transfer-Encoding, Want-Digest, x-chrome-connected, X-ClientDetails, X-GData-Client, X-GData-Key, X-Goog-Api-Client, X-Goog-AuthUser, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, X-Goog-Visitor-Id, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Goog-Meeting-Botguardid, X-Goog-Meeting-Debugid, X-Goog-Meeting-Token, X-Client-Data, X-Sfdc-Authorization
status: 200
x-guploader-uploadid: AEnB2UpeWpaOr8Oa-pf-nYnQCBq80mQbafcd6CaX64E8WfQ11huLyR7dCLbtZsxdGwHn1h5ucOPY_zPLsY5vIWVtjJ_J8HJ9kicIiTmndX7VInHOaigCJ1A
x-goog-hash: crc32c=20JiWA==
content-type: image/jpeg
access-control-allow-origin: *
cache-control: private, max-age=0
access-control-allow-credentials: false
content-disposition: inline;filename="M1.jpg";filename*=UTF-8''M1.jpg
alt-svc: quic=":443"; ma=2592000; v="39,38,37,35"
content-length: 497109
expires: Thu, 12 Oct 2017 10:56:44 GMT

Redirect headers

date: Thu, 12 Oct 2017 10:56:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info." CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 302
alt-svc: quic=":443"; ma=2592000; v="39,38,37,35"
content-length: 308
x-xss-protection: 1; mode=block
pragma: no-cache
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://doc-0s-7k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/t8tumlmh93eeh65cj3af0qrclb3d8d8i/1507802400000/08972908063980297529/*/0B7FiDjVNHKRsdGhZNkgycnhPM3M?e=view
cache-control: no-cache, no-store, max-age=0, must-revalidate
set-cookie: NID=114=OqOq0HU5Okra5prY40VuBj2K7CAWInkKO8qse0pEuMZrh4dr54T7BxnYms6EPUOsW0P2thG5iRe-9rc_1ieqEiqv7E2oN577ZXXlV0jbEbeZNdKZtbEb71rbpSYj5WXb;Domain=.google.com;Path=/;Expires=Fri, 13-Apr-2018 10:56:43 GMT;HttpOnly NID=114=pTtoMIBU5XjrYZWEaIzqZ-B265F6nshayM5dTrtlri03N0ziHUdrm0VYfCN8i3BnCb-zrhcAJcVzxyXMjwchG1lDTE9pYZ2eqIZCZObiri2uJavKatK4-3Iz6VtIPwKA;Domain=.google.com;Path=/;Expires=Fri, 13-Apr-2018 10:56:43 GMT;HttpOnly
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 2837 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ia801502.us.archive.org
URL: https://ia801502.us.archive.org/35/items/eiqarBm/b1okXK1Tlj6.html

Domain: iregal.site
URL: https://iregal.site/2315552067/inHNKoee.php?l=eA5GxiaZAIwXS7tUuUMJ0iwOY1Vm2jK9UNsCOebKjxkW5XjDepMYMxC0yRQlNrHIW9Jp4xajXNLi4VX1wxUAIwXS7tUuSwun1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			iregal.site/	1970-01-01 00:00:00	Name: PHPSESSID Value: i4i2voj5i6agpq6bjjuavjdo23

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

doc-0s-7k-docs.googleusercontent.com
drive.google.com
ia801502.us.archive.org
iregal.site
t.co
www.maersk.com
ia801502.us.archive.org
iregal.site
104.244.42.5
185.148.144.161
193.163.251.53
207.241.228.152
2a00:1450:4001:825::2001
2a00:1450:4001:825::200e
58bea621645079b7f7bffe20337bab72420f87c994c4f4a307aa28141c5c28eb
76c5e90dbc360de833504b8e20c62ac98d33cdc2a1a8b56d1396c0af50cfa1fa
7f31e7dfb3bb463ace3c592cf48c2e3814d7e68ffd423f962f648aa3ecf66971
82a4690a2c25a5a52fbb5086a0f6771a6f9f2f3f5ffa832ab9770ad16d0a25f2
9c6e88597c5bb55270702e1507dfff381e5d531eb6d4058426b8c38f4f82c677
a8a0b21ac9b2896e521066d359e33f4c7c4713bb88a5bf0b2744589001d114ed
aa7a48e32b9604f271c139661a3b339dc40c0003c88d02077f4e3116a4add996
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fbfb0ab52d8a6dc26a1d0b21a79cf73da1d78e19b637c1d1e7fef2a850891939

t.co Open in urlscan Pro 104.244.42.5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

9 Requests

78 %HTTPS

33 %IPv6

6 Domains

6 Subdomains

6 IPs

4 Countries

504 kBTransfer

536 kBSize

1 Cookies

1 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

t.co Open in urlscan Pro
104.244.42.5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

78 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

504 kB
Transfer

536 kB
Size

1
Cookies

9 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!