i-life.ir Open in urlscan Pro
185.49.84.244 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://i-life.ir/verify-account/
Effective URL:
http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qm...
Submission: On September 14 via manual (September 14th 2018, 5:20:26 pm UTC) from IN

Summary HTTP 10 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 10 HTTP transactions. The main IP is 185.49.84.244, located in Iran, Islamic Republic Of and belongs to ASIATECH, IR. The main domain is i-life.ir.

This is the only time i-life.ir was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address		AS Autonomous System
3 12	185.49.84.244 185.49.84.244		43754 (ASIATECH) (ASIATECH)
1	172.227.92.198 172.227.92.198		16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
10	2

12 185.49.84.244 (Iran, Islamic Republic Of) 3 redirects

ASN43754 (ASIATECH, IR)
PTR: hosted-by.hostdl.com.asiatech.ir

i-life.ir	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.227.92.198 (Cambridge, United States)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a172-227-92-198.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	i-life.ir 3 redirects i-life.ir	245 KB
1	paypalobjects.com www.paypalobjects.com	2 KB
10	2

	Domain	Requested by
12	i-life.ir	3 redirects i-life.ir
1	www.paypalobjects.com	i-life.ir
10	2

This site contains no links.

Subject Issuer	Validity	Valid
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2018-08-14` - `2020-08-18`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Frame ID: 3685579F37170586724588404788F17C
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://i-life.ir/verify-account/ HTTP 302
http://i-life.ir/verify-account/4cb2f8a36 HTTP 301
http://i-life.ir/verify-account/4cb2f8a36/ HTTP 302
http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%... Page URL

Detected technologies

Backbone.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^Backbone$/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

PayPal (Payment Processors) Expand

Overall confidence: 100%
Detected patterns

env /^PAYPAL$/i

RequireJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /require.*\.js/i
env /^requirejs$/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
env /^Modernizr$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^Backbone$/i

Page Statistics

10
Requests

10 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

246 kB
Transfer

714 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://i-life.ir/verify-account/ HTTP 302
http://i-life.ir/verify-account/4cb2f8a36 HTTP 301
http://i-life.ir/verify-account/4cb2f8a36/ HTTP 302
http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request signin.php Show response
i-life.ir/verify-account/4cb2f8a36/
Redirect Chain

http://i-life.ir/verify-account/
http://i-life.ir/verify-account/4cb2f8a36
http://i-life.ir/verify-account/4cb2f8a36/
http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ

3 KB
2 KB

716ms
715ms

Document
text/html

185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 70c1f6e1b15989a28bc635332c7333a620748a8af2cec5de76bdcd6e5bfffba6

Request headers

Host: i-life.ir
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=hgujplkr4pl9p7d2f7bn4d7ah0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 3685579F37170586724588404788F17C

Response headers

Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0,public
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 1421
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Fri, 14 Sep 2018 17:20:14 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Connection: Keep-Alive

Redirect headers

Set-Cookie: PHPSESSID=hgujplkr4pl9p7d2f7bn4d7ah0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0 ,public
Pragma: no-cache
location: signin.php?country.x=DE&locale.x=en_DE&safeAuth-v= jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Date: Fri, 14 Sep 2018 17:20:13 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Connection: Keep-Alive

GET
H/1.1 200
OK loading.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 267 KB
95 KB 85ms
84ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/loading.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 11e920cde02a09eec268c769426911645d8411a7880ef5317c7a00662c8d89e2

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "42daf-5b9bedcc-14d6e009c7738793;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 97009
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
H/1.1 200
OK fucked.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 20 KB
7 KB 160ms
80ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/fucked.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "4f65-5b9bedcc-b2863eeca815772d;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 6918
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
H/1.1 200
OK signin.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 704 B
736 B 160ms
80ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/signin.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 0585bd39f9008970b437553e06d3ec5073862f255b7c3df10947db94363187d7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "2c0-5b9bedcc-17f63b61d8f90e1c;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 335
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
H/1.1 200
OK modernizr.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 4 KB
2 KB 161ms
81ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/modernizr.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "edf-5b9bedcc-2d1d67567f3675c2;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1876
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
H/1.1 200
OK paypal-css.css
i-life.ir/verify-account/4cb2f8a36/ 43 KB
11 KB 159ms
79ms Stylesheet
text/css 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/paypal-css.css
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: ead0c2dc47f72d80e567dab7653a88e2aba255990d5b2c825376457e2e05da32

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:13 GMT
Server: LiteSpeed
ETag: "adb5-5b9bedcd-f93e855b1edf27ea;gz"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=2592000,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 10657
Expires: Sun, 14 Oct 2018 17:20:14 GMT

GET
H/1.1 200
OK require.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 15 KB
7 KB 161ms
81ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/require.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 0a13b51f78b6183b7c52ccfec2feaf937063d49f31f3dc04a01f3954f2f2424f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "3a0c-5b9bedcc-6174f80b01802fd;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 6594
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
H/1.1 200
OK app_.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 288 KB
105 KB 256ms
88ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/app_.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 9c27c95c29c348a4dd8bd17a5cd3a0706d3c905f186b1b611fe8015c266688f0

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "4815c-5b9bedcc-806da40765f1819d;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 107420
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
H/1.1 200
OK pa.js Show response
i-life.ir/verify-account/4cb2f8a36/data/ 68 KB
14 KB 256ms
89ms Script
application/javascript 185.49.84.244
ASIATECH

General

Check archive.org

Show headers Download Go to

Full URL: http://i-life.ir/verify-account/4cb2f8a36/data/pa.js
Requested by: Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Protocol: HTTP/1.1
Server: 185.49.84.244 , Iran, Islamic Republic Of, ASN43754 (ASIATECH, IR),
Reverse DNS: hosted-by.hostdl.com.asiatech.ir
Software: LiteSpeed /
Resource Hash: 3234214fd14c98cd08cf5c2e18ec08228b6da2d2d1d5a0e0635aaac101338d52

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: i-life.ir
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
Connection: keep-alive
Cache-Control: no-cache
Referer: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 14 Sep 2018 17:20:14 GMT
Content-Encoding: gzip
Last-Modified: Fri, 14 Sep 2018 17:20:12 GMT
Server: LiteSpeed
ETag: "10ebb-5b9bedcc-de4ce185d9ee9715;gz"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=604800,public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 14382
Expires: Fri, 21 Sep 2018 17:20:14 GMT

GET
S 200 paypal-logo-129x32.svg
www.paypalobjects.com/images/shared/ 5 KB
2 KB 8ms
8ms Image
image/svg+xml 172.227.92.198
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paypalobjects.com/images/shared/paypal-logo-129x32.svg

Requested by

Host: i-life.ir
URL: http://i-life.ir/verify-account/4cb2f8a36/signin.php?country.x=DE&locale.x=en_DE&safeAuth-v=%20jsXI15EuvU3Xa2C7qmEaMsjQGWQaKwZFAQFU8drJ

Protocol

SPDY

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

172.227.92.198 Cambridge, United States, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a172-227-92-198.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: http://i-life.ir/verify-account/4cb2f8a36/paypal-css.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 14 Sep 2018 17:20:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 24 Oct 2014 22:52:57 GMT
server: Apache
status: 200
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 1929
expires: Sun, 14 Oct 2018 17:20:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| Aes object| Base64 object| Utf8 object| _0xce15 object| html5 object| Modernizr function| require function| requirejs function| define function| getGlobal object| dust function| extend function| _ object| Backbone object| PAYPAL object| fpti string| fptiserverurl object| jQuery180031468139796174066 boolean| webkit

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i-life.ir
www.paypalobjects.com
172.227.92.198
185.49.84.244
0585bd39f9008970b437553e06d3ec5073862f255b7c3df10947db94363187d7
0a13b51f78b6183b7c52ccfec2feaf937063d49f31f3dc04a01f3954f2f2424f
11e920cde02a09eec268c769426911645d8411a7880ef5317c7a00662c8d89e2
3234214fd14c98cd08cf5c2e18ec08228b6da2d2d1d5a0e0635aaac101338d52
70c1f6e1b15989a28bc635332c7333a620748a8af2cec5de76bdcd6e5bfffba6
847c86ae982abe9180233276125b930b4a1b6f1bd12649b0c07535c1e984def8
9c27c95c29c348a4dd8bd17a5cd3a0706d3c905f186b1b611fe8015c266688f0
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
ead0c2dc47f72d80e567dab7653a88e2aba255990d5b2c825376457e2e05da32