185.86.150.62 Open in urlscan Pro
185.86.150.62 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://185.86.150.62/online/ATB/Validation/
Submission: On March 31 via automatic, source openphish (March 31st 2019, 4:20:19 pm UTC)

Summary HTTP 11 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 0 domains to perform 11 HTTP transactions. The main IP is 185.86.150.62, located in Latvia and belongs to MAKONIX, LV. The main domain is 185.86.150.62.

This is the only time 185.86.150.62 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ATB Financial (Banking)

Domain & IP information

	IP Address		AS Autonomous System
11	185.86.150.62 185.86.150.62		52173 (MAKONIX) (MAKONIX)
11	2

11 185.86.150.62 (Latvia)

ASN52173 (MAKONIX, LV)
PTR: shell.raven.ninja

185.86.150.62	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	0

	Domain	Requested by
11	0

This site contains links to these domains. Also see Links.

Domain
www.atb.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://185.86.150.62/online/ATB/Validation/
Frame ID: D2A11CA527680CB479C043462B8BF3FB
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

237 kB
Transfer

534 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://www.atb.com/important-information/privacy-security/Pages/online-guarantee.aspx?utm_source=atbol&utm_medium=login&utm_campaign=security-commitment-guarantee
Title: Online Banking Guarantee

Search URL Search Domain Scan URL

URL: http://www.atb.com/important-information/privacy-security/Pages/Privacy-and-Security-Tips.aspx?utm_source=atbol&utm_medium=login&utm_campaign=security-commitment-security-tips
Title: Security Tips

Search URL Search Domain Scan URL

URL: http://www.atb.com/
Title: atb.com

Search URL Search Domain Scan URL

URL: https://www.atb.com/contact-us/Pages/default.aspx
Title: Contact us

Search URL Search Domain Scan URL

URL: http://www.atb.com/SiteCollectionDocuments/ImportantInformation/Personal_Online_Terms_and_Conditions.pdf
Title: Terms

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response 185.86.150.62/online/ATB/Validation/	9 KB 3 KB	37ms 36ms	Document text/html	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `49903faeea968a9cc524158dc01c7b3db24663bc546187fa563e5bf4ed99a319` Request headers Host 185.86.150.62 Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Server Apache/2.4.18 (Ubuntu) Last-Modified Tue, 12 Feb 2019 05:37:36 GMT ETag "2217-581abd2962800-gzip" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 2500 Keep-Alive timeout=5, max=96 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	fonts.css 185.86.150.62/online/ATB/Validation/index_files/	100 KB 75 KB	51ms 49ms	Stylesheet text/css	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Validation/index_files/fonts.css Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Content-Encoding gzip Last-Modified Fri, 20 Apr 2018 14:58:08 GMT Server Apache/2.4.18 (Ubuntu) ETag "191e8-56a48ea800000-gzip" Vary Accept-Encoding Content-Type text/css Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95
GET H/1.1	200 OK	commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css 185.86.150.62/online/ATB/Validation/index_files/	281 KB 53 KB	74ms 72ms	Stylesheet text/css	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `68f2754a833a25d7b577b98dbd1995d2ee46122c912750991b6e0e2aac71f809` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Content-Encoding gzip Last-Modified Fri, 20 Apr 2018 14:58:08 GMT Server Apache/2.4.18 (Ubuntu) ETag "4635c-56a48ea800000-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 53464
GET H/1.1	200 OK	publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css 185.86.150.62/online/ATB/Validation/index_files/	5 KB 2 KB	34ms 33ms	Stylesheet text/css	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Validation/index_files/publicStyles_B4C3D7BDA526D6057A111A01AA17270B.css Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `da369623e388d7bf36bb00ef742ba81af294e4b10cab7a27ec1f216c333f2710` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Content-Encoding gzip Last-Modified Fri, 20 Apr 2018 14:58:08 GMT Server Apache/2.4.18 (Ubuntu) ETag "12ae-56a48ea800000-gzip" Vary Accept-Encoding Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 1296
GET H/1.1	200 OK	header-gradient.jpg 185.86.150.62/online/ATB/Validation/index_files/	760 B 1 KB	34ms 33ms	Image image/jpeg	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Show image Full URL http://185.86.150.62/online/ATB/Validation/index_files/header-gradient.jpg Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Last-Modified Fri, 20 Apr 2018 14:58:08 GMT Server Apache/2.4.18 (Ubuntu) ETag "2f8-56a48ea800000" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 760
GET H/1.1	200 OK	error.gif 185.86.150.62/online/ATB/Validation/index_files/	129 B 412 B	36ms 34ms	Image image/gif	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Show image Full URL http://185.86.150.62/online/ATB/Validation/index_files/error.gif Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Last-Modified Fri, 20 Apr 2018 14:58:08 GMT Server Apache/2.4.18 (Ubuntu) ETag "81-56a48ea800000" Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 129
GET H/1.1	200 OK	CMP-dfa73e51-8381-c626-42c8-7f6a0eda31f6.jpg 185.86.150.62/online/ATB/Validation/index_files/	103 KB 103 KB	33ms 32ms	Image image/jpeg	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Show image Full URL http://185.86.150.62/online/ATB/Validation/index_files/CMP-dfa73e51-8381-c626-42c8-7f6a0eda31f6.jpg Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash `7ec4c461e573068c57d27b5d1d4ad7939aab5fb2c209b5c0016b0ed26917dc93` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Last-Modified Fri, 20 Apr 2018 14:58:08 GMT Server Apache/2.4.18 (Ubuntu) ETag "19c64-56a48ea800000" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 105572
GET H/1.1	404 Not Found	banner1.js.download 185.86.150.62/online/ATB/Validation/index_files/	0 0	67ms 32ms	Script text/html	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Validation/index_files/banner1.js.download Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://185.86.150.62/online/ATB/Validation/ Connection keep-alive Cache-Control no-cache Referer http://185.86.150.62/online/ATB/Validation/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 31 Mar 2019 16:20:03 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 330 Content-Type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated /	13 KB 0		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `936aaa639be8fa6c83d6090a016cf175282c6102980ebb6ef79e84cd25ecf950` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/fonts.css Origin http://185.86.150.62 Response headers Content-Type application/x-font-woff2
GET DATA	200 OK	truncated /	13 KB 0		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `14a174147ddbddee334cdcacd0d485cfa340080b2f28f312cbed56fd1ec9b482` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/fonts.css Origin http://185.86.150.62 Response headers Content-Type application/x-font-woff2
GET H/1.1	404 Not Found	fontawesome-webfont.woff2 185.86.150.62/online/ATB/Themes/fonts/font-awesome/fonts/	0 0	37ms 36ms	Font text/html	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash Request headers Pragma no-cache Origin http://185.86.150.62 Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Origin http://185.86.150.62 Response headers Date Sun, 31 Mar 2019 16:20:04 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=94 Content-Length 345 Content-Type text/html; charset=iso-8859-1
GET DATA	200 OK	truncated /	5 KB 0		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `297a5269f31b7c501886f8f980b01e5e14048f7f8f279ce1fb76f33e3edd6a14` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/fonts.css Origin http://185.86.150.62 Response headers Content-Type application/x-font-woff2
GET DATA	200 OK	truncated /	5 KB 0		Font application/x-font-woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `138376ba413b29d8a4354768884cfa9f31417e682385990bdc02136cc2616087` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/fonts.css Origin http://185.86.150.62 Response headers Content-Type application/x-font-woff2
GET H/1.1	404 Not Found	fontawesome-webfont.woff 185.86.150.62/online/ATB/Themes/fonts/font-awesome/fonts/	0 0	37ms 37ms	Font text/html	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Themes/fonts/font-awesome/fonts/fontawesome-webfont.woff?v=4.7.0 Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash Request headers Pragma no-cache Origin http://185.86.150.62 Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Origin http://185.86.150.62 Response headers Date Sun, 31 Mar 2019 16:20:04 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=93 Content-Length 344 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	fontawesome-webfont.ttf 185.86.150.62/online/ATB/Themes/fonts/font-awesome/fonts/	0 0	39ms 38ms	Font text/html	185.86.150.62 MAKONIX
General Check archive.org Show headers Download Go to Full URL http://185.86.150.62/online/ATB/Themes/fonts/font-awesome/fonts/fontawesome-webfont.ttf?v=4.7.0 Requested by Host: 185.86.150.62 URL: http://185.86.150.62/online/ATB/Validation/ Protocol HTTP/1.1 Server 185.86.150.62 , Latvia, ASN52173 (MAKONIX, LV), Reverse DNS shell.raven.ninja Software Apache/2.4.18 (Ubuntu) / Resource Hash Request headers Pragma no-cache Origin http://185.86.150.62 Accept-Encoding gzip, deflate Host 185.86.150.62 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://185.86.150.62/online/ATB/Validation/index_files/commonStyles_5932C9A3B926A146025EB2EA9D8165E8.css Origin http://185.86.150.62 Response headers Date Sun, 31 Mar 2019 16:20:04 GMT Server Apache/2.4.18 (Ubuntu) Connection Keep-Alive Keep-Alive timeout=5, max=92 Content-Length 343 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ATB Financial (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

185.86.150.62
138376ba413b29d8a4354768884cfa9f31417e682385990bdc02136cc2616087
14a174147ddbddee334cdcacd0d485cfa340080b2f28f312cbed56fd1ec9b482
205c6b68b92fd475a63ba98b6e120351ae70d3e3b7572523bb9ebd1727b0e42f
297a5269f31b7c501886f8f980b01e5e14048f7f8f279ce1fb76f33e3edd6a14
49903faeea968a9cc524158dc01c7b3db24663bc546187fa563e5bf4ed99a319
68f2754a833a25d7b577b98dbd1995d2ee46122c912750991b6e0e2aac71f809
72da7b996e10c7a2a69be39a1a403fbc0eea85182551d12c1b47e02821a86411
7ec4c461e573068c57d27b5d1d4ad7939aab5fb2c209b5c0016b0ed26917dc93
936aaa639be8fa6c83d6090a016cf175282c6102980ebb6ef79e84cd25ecf950
bc1d20c0f75e6882604dc25043446dcdf17c5634c98b56a667b2c56779b83b5a
da369623e388d7bf36bb00ef742ba81af294e4b10cab7a27ec1f216c333f2710

185.86.150.62 Open in urlscan Pro 185.86.150.62 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

0 %HTTPS

0 %IPv6

0 Domains

0 Subdomains

2 IPs

1 Countries

237 kBTransfer

534 kBSize

0 Cookies

5 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

185.86.150.62 Open in urlscan Pro
185.86.150.62 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

0 %
HTTPS

0 %
IPv6

0
Domains

0
Subdomains

2
IPs

1
Countries

237 kB
Transfer

534 kB
Size

0
Cookies

11 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!