admin3e.square7.ch Open in urlscan Pro
148.251.48.69  Malicious Activity! Public Scan

URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Submission: On December 14 via automatic, source openphish

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 148.251.48.69, located in Germany and belongs to HETZNER-AS, DE. The main domain is admin3e.square7.ch.
This is the only time admin3e.square7.ch was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

IP Address AS Autonomous System
8 148.251.48.69 24940 (HETZNER-AS)
1 2a01:4f8:162:... 24940 (HETZNER-AS)
1 104.197.47.161 15169 (GOOGLE)
10 3
Domain Requested by
8 admin3e.square7.ch admin3e.square7.ch
1 www.tradeadexchange.com www.bplaced.net
1 www.bplaced.net admin3e.square7.ch
10 3

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Frame ID: (F0C7B7E2F0FC5DB749187745C75A9081)
Requests: 10 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

10
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

229 kB
Transfer

231 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
2 KB
0
Document
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
f41440fbc8ab50f46e563c5f2378be8ffaef5cd5403bd0868b0384241a674dc1

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:29 GMT
Server
Apache/2.4
ETag
"758-55f48f36f5204"
Vary
Accept-Encoding
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
1961
officelogo.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
9 KB
9 KB
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/officelogo.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
010da445e8c3df9019ed05532d7caaa0879eaef62761289bca71f93782fe9d56

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:50 GMT
Server
Apache/2.4
ETag
"229f-55f48f4a82fd2"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=499
Content-Length
8863
googlelogo.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
3 KB
3 KB
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/googlelogo.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
47d4e3ecf486cf9e611f4efd0ee3fb1353bad7b78e49310168ba5e5102b1de33

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:46 GMT
Server
Apache/2.4
ETag
"a30-55f48f469cf10"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
2608
outlooklogo.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
4 KB
4 KB
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/outlooklogo.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
5536cdcf45ed63ad03a3214f532bfd01364f8f016b31c019959080e753aeed36

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:53 GMT
Server
Apache/2.4
ETag
"fc9-55f48f4d1ef54"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
4041
aollogo.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
919 B
919 B
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/aollogo.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
33cf2383e9a88578a6e92a30db80f030773d28055b6e7008a849ac7f8c8acb0a

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:41 GMT
Server
Apache/2.4
ETag
"397-55f48f41c89cc"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
919
yahoologo.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
4 KB
4 KB
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/yahoologo.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
19dcc4f189dbc6b7d5c7745b26a153c5f38b263bea0dca4fd9f68791d77caefa

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:55 GMT
Server
Apache/2.4
ETag
"fe2-55f48f4fa9596"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
4066
weblogo.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
583 B
583 B
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/weblogo.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
554bb7b59a3ea1243bfa5b684ca0d2fe8df727d1e7007f1e1c0a5afd995516a2

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:54 GMT
Server
Apache/2.4
ETag
"247-55f48f4eaa775"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=500
Content-Length
583
bpa.js
www.bplaced.net/pub/
290 B
155 B
Script
General
Full URL
http://www.bplaced.net/pub/bpa.js
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
2a01:4f8:162:4306::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
Apache /
Resource Hash
27306980aebf9834eed9db219b1c67998ba46614eba6c7355c88711bad38638a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.bplaced.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
Upgrade, Keep-Alive
Content-Length
155
X-BP-NSA-REQID
(null) a.14UID=275
Last-Modified
Sat, 07 May 2016 08:07:31 GMT
Server
Apache
ETag
"122-5323c112ad6c0-gzip"
Vary
Accept-Encoding
Upgrade
h2,h2c
Cache-Control
max-age=7200
Accept-Ranges
bytes
Content-Type
application/javascript
Keep-Alive
timeout=4, max=500
Expires
Thu, 14 Dec 2017 22:27:36 GMT
display.php
www.tradeadexchange.com/a/
0
0
Script
General
Full URL
http://www.tradeadexchange.com/a/display.php?r=421215
Requested by
Host: www.bplaced.net
URL: http://www.bplaced.net/pub/bpa.js
Protocol
HTTP/1.1
Server
104.197.47.161 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
161.47.197.104.bc.googleusercontent.com
Software
openresty /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.tradeadexchange.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Accept
*/*
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Referrer-Policy
no-referrer
Server
openresty
Connection
keep-alive
Vary
Accept-Encoding
background2.png
admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/
209 KB
209 KB
Image
General
Full URL
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/images/background2.png
Requested by
Host: admin3e.square7.ch
URL: http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Protocol
HTTP/1.1
Server
148.251.48.69 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
client1.square7.ch
Software
Apache/2.4 /
Resource Hash
1453db407b4b59ed96519b1c90d53a6d88be708ad66180c664bb3b7ef902aa4f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
admin3e.square7.ch
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://admin3e.square7.ch/HUSH%20DROP%20TODA-EDITED/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Thu, 14 Dec 2017 20:27:36 GMT
Last-Modified
Fri, 01 Dec 2017 15:23:43 GMT
Server
Apache/2.4
ETag
"34264-55f48f43f252e"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=4, max=499
Content-Length
213604

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint

0 Cookies