art-sticker.fr - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 217.160.0.222, located in Germany and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is art-sticker.fr.

This is the only time art-sticker.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cox (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
3	217.160.0.222 217.160.0.222	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
1 2	67.222.128.97 67.222.128.97	393398 (ASN-DIS) (ASN-DIS)
1	151.101.113.167 151.101.113.167	54113 (FASTLY) (FASTLY)
5	3

3 217.160.0.222 (Germany)

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)
PTR: 217-160-0-222.elastic-ssl.ui-r.com

art-sticker.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.222.128.97 (Dallas, United States) 1 redirects

ASN393398 (ASN-DIS, US)
PTR: host.pchpserver.com

hospiceofcitrus.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
friendsofcitrus.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.167 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

t3.ftcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	art-sticker.fr art-sticker.fr	96 KB
1	ftcdn.net t3.ftcdn.net	24 KB
1	friendsofcitrus.org friendsofcitrus.org	35 KB
1	hospiceofcitrus.org 1 redirects hospiceofcitrus.org	247 B
5	4

	Domain	Requested by
3	art-sticker.fr	art-sticker.fr
1	t3.ftcdn.net	art-sticker.fr
1	friendsofcitrus.org	art-sticker.fr
1	hospiceofcitrus.org	1 redirects
5	4

This site contains no links.

Subject Issuer	Validity	Valid
friendsofcitrus.org cPanel, Inc. Certification Authority	`2020-02-27` - `2020-05-27`	3 months	crt.sh
*.b.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2018-08-14` - `2020-11-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
Frame ID: FDE46057AB82B6F161C30421A1924AF4
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

40 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

155 kB
Transfer

163 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

http://hospiceofcitrus.org/wp-content/uploads/2015/06/creditcard-logos.jpg HTTP 301
https://friendsofcitrus.org/wp-content/uploads/2015/06/creditcard-logos.jpg

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request way.php Show response
art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/ 12 KB
3 KB 123ms
80ms Document
text/html 217.160.0.222
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
Protocol: HTTP/1.1
Server: 217.160.0.222 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS: 217-160-0-222.elastic-ssl.ui-r.com
Software: Apache / PHP/4.4.9
Resource Hash: 45a77d6927b7ca0bfbe68bb490274c4e14f296ab9198e39e1023eb44492deef8

Request headers

Host: art-sticker.fr
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=15
Date: Fri, 06 Mar 2020 07:55:23 GMT
Server: Apache
X-Powered-By: PHP/4.4.9
Content-Encoding: gzip

GET
H/1.1 200
OK header.png
art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/ 29 KB
30 KB 39ms
39ms Image
image/png 217.160.0.222
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/header.png
Requested by: Host: art-sticker.fr
URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
Protocol: HTTP/1.1
Server: 217.160.0.222 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS: 217-160-0-222.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: 56b960f68e43fea5225293d57e670b9624a5a4a0b1932f1f14b4b8e1767c025b

Request headers

Referer: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 06 Mar 2020 07:55:23 GMT
Last-Modified: Tue, 06 Aug 2019 01:18:46 GMT
Server: Apache
ETag: "7523-58f689b27c980"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 29987

GET
H2

200

creditcard-logos.jpg
friendsofcitrus.org/wp-content/uploads/2015/06/
Redirect Chain

http://hospiceofcitrus.org/wp-content/uploads/2015/06/creditcard-logos.jpg
https://friendsofcitrus.org/wp-content/uploads/2015/06/creditcard-logos.jpg

35 KB
35 KB

402ms
127ms

Image
image/jpeg

67.222.128.97
ASN-DIS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://friendsofcitrus.org/wp-content/uploads/2015/06/creditcard-logos.jpg
Requested by: Host: art-sticker.fr
URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 67.222.128.97 Dallas, United States, ASN393398 (ASN-DIS, US),
Reverse DNS: host.pchpserver.com
Software: LiteSpeed /
Resource Hash: be7de0d84665c677630fc172a513dc01b0bc62328fe8a633d859860e02b6ab42

Request headers

Referer: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 07:55:24 GMT
last-modified: Fri, 21 Sep 2018 21:33:21 GMT
server: LiteSpeed
etag: "8d00-5ba563a1-78db3746dc1ca784;;;"
content-type: image/jpeg
status: 200
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000
content-length: 36096
expires: Fri, 13 Mar 2020 07:55:24 GMT

Redirect headers

Location: https://friendsofcitrus.org/wp-content/uploads/2015/06/creditcard-logos.jpg
Date: Fri, 06 Mar 2020 07:55:23 GMT
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 705
Content-Type: text/html

GET
H2 200 240_F_36718088_nJyrSIMb92JjivK6osNY7fIJ0bdpb4XF.jpg
t3.ftcdn.net/jpg/00/36/71/80/ 24 KB
24 KB 124ms
37ms Image
image/jpeg 151.101.113.167
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t3.ftcdn.net/jpg/00/36/71/80/240_F_36718088_nJyrSIMb92JjivK6osNY7fIJ0bdpb4XF.jpg

Requested by

Host: art-sticker.fr
URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.113.167 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

30cf6662011218c29e34d5646bd8a20ad31b4ba38404aa111a9492a52421f08a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 06 Mar 2020 07:55:23 GMT
last-modified: Sun, 22 May 2016 03:22:23 GMT
age: 15605888
strict-transport-security: max-age=31536000
x-cache: HIT, HIT
content-type: image/jpeg
status: 200
cache-control: public, max-age=31536000
x-cache-hits: 1, 1
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24114
x-served-by: cache-cdg20733-CDG, cache-hhn4057-HHN

GET
H/1.1 200
OK footer.png
art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/ 63 KB
63 KB 74ms
54ms Image
image/png 217.160.0.222
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/footer.png
Requested by: Host: art-sticker.fr
URL: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
Protocol: HTTP/1.1
Server: 217.160.0.222 , Germany, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS: 217-160-0-222.elastic-ssl.ui-r.com
Software: Apache /
Resource Hash: bcb3685d562e58c95374905fc4a58f17832fbce54ee03289e4285ebcd2f4aabe

Request headers

Referer: http://art-sticker.fr/humby/librairies/manual/ab40db1a73005ddbeab463fa60681225/way.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 06 Mar 2020 07:55:23 GMT
Last-Modified: Tue, 06 Aug 2019 01:18:46 GMT
Server: Apache
ETag: "fc06-58f689b27c980"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=15
Content-Length: 64518

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cox (Telecommunication)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

art-sticker.fr
friendsofcitrus.org
hospiceofcitrus.org
t3.ftcdn.net
151.101.113.167
217.160.0.222
67.222.128.97
30cf6662011218c29e34d5646bd8a20ad31b4ba38404aa111a9492a52421f08a
45a77d6927b7ca0bfbe68bb490274c4e14f296ab9198e39e1023eb44492deef8
56b960f68e43fea5225293d57e670b9624a5a4a0b1932f1f14b4b8e1767c025b
bcb3685d562e58c95374905fc4a58f17832fbce54ee03289e4285ebcd2f4aabe
be7de0d84665c677630fc172a513dc01b0bc62328fe8a633d859860e02b6ab42

art-sticker.fr Open in urlscan Pro 217.160.0.222 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

40 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

155 kBTransfer

163 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

art-sticker.fr Open in urlscan Pro
217.160.0.222 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

40 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

155 kB
Transfer

163 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!