balevibrands.eu Open in urlscan Pro
95.168.250.166 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Submission: On September 28 via manual (September 28th 2023, 11:52:00 pm UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 95.168.250.166, located in Manole, Bulgaria and belongs to ANGELSOFT Bulgaria, BG. The main domain is balevibrands.eu.
TLS certificate: Issued by R3 on September 11th 2023. Valid for: 3 months.

This is the only time balevibrands.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fedex (Transportation)

Domain & IP information

	IP Address		AS Autonomous System
13	95.168.250.166 95.168.250.166		12829 (ANGELSOFT...) (ANGELSOFT Bulgaria)
1	2606:4700::68... 2606:4700::6812:1634		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:190e		13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	3

13 95.168.250.166 (Manole, Bulgaria)

ASN12829 (ANGELSOFT Bulgaria, BG)
PTR: mail.evromes.bg

balevibrands.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1634 (United States)

ASN13335 (CLOUDFLARENET, US)

pro.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	balevibrands.eu balevibrands.eu	94 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 410	3 KB
1	fontawesome.com pro.fontawesome.com — Cisco Umbrella Rank: 11170	29 KB
15	3

	Domain	Requested by
13	balevibrands.eu	balevibrands.eu
1	cdnjs.cloudflare.com	balevibrands.eu
1	pro.fontawesome.com	balevibrands.eu
15	3

This site contains no links.

Subject Issuer	Validity	Valid
balevibrands.eu R3	`2023-09-11` - `2023-12-10`	3 months	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2022-11-22` - `2023-12-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Frame ID: 6CAC687C329CACA8BF9320B215FBFEF1
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FedEx Info | FedEx

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

127 kB
Transfer

530 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request cc.php Show response
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/ 10 KB
3 KB 153ms
40ms Document
text/html 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 018715400bf96fc172b0b3040141b9b661d8ea0ffdc927d6edc05669b6ccc074

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 2303
Content-Type: text/html; charset=UTF-8
Date: Thu, 28 Sep 2023 23:51:54 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=100
Pragma: no-cache
Server: Apache/2.4.29 (Ubuntu)
Vary: Accept-Encoding

GET
H/1.1 200
OK bootstrap.css
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/css/ 188 KB
25 KB 47ms
47ms Stylesheet
text/css 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/css/bootstrap.css
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "2f1f7-60632cf69a762-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 24828

GET
H/1.1 200
OK test.css
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/css/ 2 KB
965 B 109ms
37ms Stylesheet
text/css 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/css/test.css
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 8e63d5a105a1e787341fb90033b94d3e6da431e5b16ee42bbca450d0be6f8fea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "6c2-60632cf69a762-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 629

GET
H/1.1 200
OK html5shiv.min.js Show response
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/ 3 KB
2 KB 109ms
37ms Script
application/javascript 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/html5shiv.min.js
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "aaa-60632cf69a762-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1348

GET
H/1.1 200
OK respond.min.js Show response
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/ 4 KB
3 KB 113ms
36ms Script
application/javascript 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/respond.min.js
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "11f1-60632cf69b702-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2218

GET
H2 200 all.css
pro.fontawesome.com/releases/v5.10.0/css/ 153 KB
29 KB 565ms
521ms Stylesheet
text/css 2606:4700::6812:1634
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.10.0/css/all.css
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec

Request headers

Referer: https://balevibrands.eu/
Origin: https://balevibrands.eu
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Thu, 28 Sep 2023 23:51:55 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Mon, 28 Jun 2021 16:54:32 GMT
server: cloudflare
x-amz-request-id: BX2492QKBMZ8WDWT
etag: W/"aa1272633e7e552395d147a499bad186"
access-control-max-age: 3000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
access-control-allow-origin: *
content-type: text/css
cache-control: max-age=31556926
cf-ray: 80dfe5a79e562bbe-FRA
x-amz-id-2: Z8B79aiAFn3sxyxZsQd7sQ8One62hnnm1SSjKhAFWsk8B/QXD++yf4dhVFtP4WqE++n2whVUKnI=

GET
H/1.1 200
OK logo.png
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/ 4 KB
4 KB 40ms
39ms Image
image/png 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/logo.png
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 9f8ae5767c7da740d0e60bf68fc6c1a53bccb8802abe086d46c919b3617d7d47

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "ef9-60632cf69a762"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 3833

GET
H/1.1 200
OK card.png
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/ 4 KB
5 KB 42ms
41ms Image
image/png 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/card.png
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 8b69fb0ee936f66308c49a4ee93c7d24ceb0f974f9b29f42edb137e8cd6ebc6d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "11cd-60632cf69a762"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 4557

GET
H/1.1 200
OK logo-footer.gif
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/ 1 KB
1 KB 76ms
36ms Image
image/gif 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/logo-footer.gif
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "460-60632cf69a762"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 1120

GET
H/1.1 200
OK search.png
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/ 2 KB
2 KB 79ms
35ms Image
image/png 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/search.png
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: c071ec308404a22b060a1266d3d836c545c88a3a8afd8e29db699acd15f1cabc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "85a-60632cf69a762"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 2138

GET
H/1.1 200
OK media.png
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/ 2 KB
2 KB 69ms
37ms Image
image/png 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/media.png
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 2a032fa265ae439e56a80e3d76f47ac554380de3bfc817a857924d7ea48e1626

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "61e-60632cf69a762"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1566

GET
H/1.1 200
OK canada.png
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/ 964 B
1 KB 64ms
36ms Image
image/png 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/image/canada.png
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a1c42b7d341f59fdffdb0615859ecefc71c18b1d40830a60c562b43fe683f0a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "3c4-60632cf69a762"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 964

GET
H/1.1 200
OK jquery-3.5.1.min.js Show response
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/ 87 KB
31 KB 47ms
46ms Script
application/javascript 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/jquery-3.5.1.min.js
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "15d84-60632cf69b702-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 30910

GET
H/1.1 200
OK bootstrap.min.js Show response
balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/ 61 KB
16 KB 43ms
42ms Script
application/javascript 95.168.250.166
ANGELSOFT Bulgaria

General

Check archive.org

Show headers Download Go to

Full URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/js/bootstrap.min.js
Requested by: Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.168.250.166 Manole, Bulgaria, ASN12829 (ANGELSOFT Bulgaria, BG),
Reverse DNS: mail.evromes.bg
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Date: Thu, 28 Sep 2023 23:51:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 25 Sep 2023 18:05:58 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "f3cb-60632cf69a762-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 16021

GET
H2 200 jquery.payment.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/ 8 KB
3 KB 43ms
16ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.payment/3.0.0/jquery.payment.min.js

Requested by

Host: balevibrands.eu
URL: https://balevibrands.eu/wp-content/uploads/2023/09/ango/ap/cc.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://balevibrands.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Thu, 28 Sep 2023 23:51:54 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 6979429
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2420
last-modified: Mon, 04 May 2020 16:11:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec3-210b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=59CmWreei0j%2FObT9%2BUb8FqVBbaXijhnFWYR7P%2BIv59zAWAMcrQl4UXAXawr40PBOJp2emu8SbDeyjXEUcO%2FWHJRjeeF7lCtRqqJpRsLTXRYeiqEtBR45M%2BiCbt%2BZadkXk4rM8f65loXajSdjmgwbHCCE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 80dfe5a84b914d79-FRA
expires: Tue, 17 Sep 2024 23:51:54 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fedex (Transportation)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| html5 object| respond function| $ function| jQuery number| uidEvent object| bootstrap

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			balevibrands.eu/	1969-12-31 23:59:59	Name: PHPSESSID Value: ck60foe3plhtrd7e84265ogcs8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

balevibrands.eu
cdnjs.cloudflare.com
pro.fontawesome.com
2606:4700::6811:190e
2606:4700::6812:1634
95.168.250.166
018715400bf96fc172b0b3040141b9b661d8ea0ffdc927d6edc05669b6ccc074
0c159070e198b7ed2a9162d6c9751f5914ff62803914d8512d60b1f5ffde4334
1944a255577a8ed66ae984c6f6356281ff6f29dc84a2af6f1facf258c7dab62e
1c192944e83b1e02fe33b614ba139866c0f81f6f37cfe00add496440b037dc3b
2909d4fa86cf09191e768576e1a6eab7f2635a2627549c45d29595ffac9c0da9
2a032fa265ae439e56a80e3d76f47ac554380de3bfc817a857924d7ea48e1626
2af905d92cfd34b5413126a54f639da408166cbbcb54318e413ad5e10b5bf6ec
6c4ba1c662b440b3aefe5e5147ea2df72f80e510e4979c65485a7b0fff894e37
8b69fb0ee936f66308c49a4ee93c7d24ceb0f974f9b29f42edb137e8cd6ebc6d
8e63d5a105a1e787341fb90033b94d3e6da431e5b16ee42bbca450d0be6f8fea
9f8ae5767c7da740d0e60bf68fc6c1a53bccb8802abe086d46c919b3617d7d47
a1c42b7d341f59fdffdb0615859ecefc71c18b1d40830a60c562b43fe683f0a8
c071ec308404a22b060a1266d3d836c545c88a3a8afd8e29db699acd15f1cabc
dc9cbf19b48bae0d28f72e59e67d6ec34ab1644087ec2e8e42954180d1586b48
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d