www.hamegam.com Open in urlscan Pro
85.9.66.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Submission: On February 22 via api (February 22nd 2023, 4:23:29 pm UTC) from US — Scanned from US

Summary HTTP 16 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 85.9.66.227, located in Iran, Islamic Republic Of and belongs to IR-THR-PTE, IR. The main domain is www.hamegam.com.
TLS certificate: Issued by R3 on February 17th 2023. Valid for: 3 months.

This is the only time www.hamegam.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alaska USA Federal Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	85.9.66.227 85.9.66.227	49100 (IR-THR-PTE) (IR-THR-PTE)
13	107.162.174.66 107.162.174.66	55002 (DEFENSE-NET) (DEFENSE-NET)
1	107.162.171.161 107.162.171.161	55002 (DEFENSE-NET) (DEFENSE-NET)
16	3

2 85.9.66.227 (Iran, Islamic Republic Of)

ASN49100 (IR-THR-PTE, IR)

www.hamegam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 107.162.174.66 (United States)

ASN55002 (DEFENSE-NET, US)

login.alaskausa.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.162.171.161 (United States)

ASN55002 (DEFENSE-NET, US)

www.alaskausa.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	alaskausa.org login.alaskausa.org — Cisco Umbrella Rank: 332746 www.alaskausa.org — Cisco Umbrella Rank: 293723	74 KB
2	hamegam.com www.hamegam.com	12 KB
16	2

	Domain	Requested by
13	login.alaskausa.org	www.hamegam.com login.alaskausa.org
2	www.hamegam.com	login.alaskausa.org
1	www.alaskausa.org	www.hamegam.com
16	3

This site contains links to these domains. Also see Links.

Domain
www.alaskausa.org
login.alaskausa.org

Subject Issuer	Validity	Valid
hamegam.com R3	`2023-02-17` - `2023-05-18`	3 months	crt.sh
login.alaskausa.org DigiCert TLS RSA SHA256 2020 CA1	`2022-05-11` - `2023-06-11`	a year	crt.sh
alaskausa.org DigiCert TLS RSA SHA256 2020 CA1	`2022-08-02` - `2023-09-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Frame ID: 9CE72E812F99C20BC964D11F75A9E0A0
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Forgot Password

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

86 kB
Transfer

131 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.alaskausa.org/

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/ultrabranch/guide.asp?s=loginX
Title: Online Account Access Troubleshooting

Search URL Search Domain Scan URL

URL: https://login.alaskausa.org/efs/ultrabranch/ForgotPAC
Title: Which email should I use?

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/ultrabranch/guide.asp?s=msc
Title: Forgot User ID?

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/ultrabranch/guide.asp
Title: Other issues?

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/contact.asp
Title: More contact information

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/ 12 KB
12 KB 995ms
417ms Document
text/html 85.9.66.227
IR-THR-PTE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.9.66.227 , Iran, Islamic Republic Of, ASN49100 (IR-THR-PTE, IR),
Reverse DNS
Software: Apache /
Resource Hash: 4112c2fd9057fba7dc479efb72556940f4f8536d750bf21303851cc31631b2ea

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
content-length: 12152
content-type: text/html
date: Wed, 22 Feb 2023 16:23:18 GMT
last-modified: Sat, 24 Dec 2022 01:20:26 GMT
server: Apache

GET
H/1.1 200
OK alaska-common.js Show response
login.alaskausa.org/ 21 KB
8 KB 660ms
68ms Script
application/javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.alaskausa.org/alaska-common.js?matcher
Requested by: Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: 0afe5db7762a298d8c109f811bc905d560d4a701f870db4c80868ddfaf4bb75a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 22 Feb 2023 16:23:18 GMT
Content-Encoding: gzip
Via: 1.1 google, 1.1 dca1-bit13018
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: prod
Cache-Control: no-cache, no-store, must-revalidate
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Expires: 0

GET
H/1.1 200
OK alaska-common.js Show response
login.alaskausa.org/ 21 KB
8 KB 661ms
69ms Script
application/javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.alaskausa.org/alaska-common.js?cache
Requested by: Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: 0afe5db7762a298d8c109f811bc905d560d4a701f870db4c80868ddfaf4bb75a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

X-Ion-Hop: prod
Date: Wed, 22 Feb 2023 16:23:18 GMT
Cache-Control: public, max-age=3600, immutable
Content-Encoding: gzip
Via: 1.1 google, 1.1 dca1-bit11040
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Type: application/javascript; charset=UTF-8

GET
H/1.1 200
OK alaska-common.js Show response
login.alaskausa.org/ 951 B
1 KB 62ms
61ms Script
application/javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.alaskausa.org/alaska-common.js?async
Requested by: Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: ecaf03c4b28c22fac47e629ecd2b364f8103f6cdcb8418032fd84b12c11c099c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 22 Feb 2023 16:23:19 GMT
Content-Encoding: gzip
Via: 1.1 google, 1.1 dca1-bit16014
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: prod
Cache-Control: no-cache, no-store, must-revalidate
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Expires: 0

GET
H/1.1 200
OK ub-main.css
login.alaskausa.org/efs/efs/jsp/inc/css/ 21 KB
8 KB 1191ms
599ms Stylesheet
text/css 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-main.css?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

8fa8e715548a8766cb3cebb3ab325d56263ae0c58afdd6964af42c20bddef830

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:19 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit16014
Last-Modified: Fri, 17 Feb 2023 03:01:50 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100

GET
H/1.1 200
OK ub-login-new.css
login.alaskausa.org/efs/efs/jsp/inc/css/ 8 KB
4 KB 1278ms
686ms Stylesheet
text/css 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

110d05d5cdb82977d18e04fd15b60ea781df07cc6d2fccce3e836bd86463b926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:19 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:05:32 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100

GET
H/1.1 200
OK common_functions.js Show response
login.alaskausa.org/efs/efs/jslibrary/ 8 KB
3 KB 1145ms
552ms Script
application/x-javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jslibrary/common_functions.js?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

0a5bb7450bce69fd47e82eb792d6fe0460cbc433ac194e45f3917b801ac89cfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:02:02 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:01:50 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 2449

GET
H/1.1 200
OK open_window.js Show response
login.alaskausa.org/efs/efs/jslibrary/ 5 KB
3 KB 951ms
359ms Script
application/x-javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jslibrary/open_window.js?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

6951260bdde918664e5015241cb5985ef5cd11928f1f46c5b9e8bdd407554121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:17 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:05:32 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 1852

GET
H/1.1 200
OK akusafcu_logo.png
login.alaskausa.org/efs/efs/grafx/akusa/ 16 KB
17 KB 220ms
220ms Image
image/png 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/akusafcu_logo.png

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

a3941d5f3a221368776c19f01fef5fdcff8825460e416580fc809dbdd83972cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:02:02 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:05:30 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=99
Content-Length: 16729

GET
H/1.1 200
OK logo-ehl-tri.gif
login.alaskausa.org/efs/efs/grafx/akusa/ 2 KB
3 KB 217ms
217ms Image
image/gif 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/logo-ehl-tri.gif?

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

e9d50b964802b2bb60004481eb67394bd994ba4c6f8a67e3ded7574ef58fcfc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:19 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:05:30 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Type: image/gif
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=99
Content-Length: 2358

GET
H/1.1 200
OK logo-ncua.gif
login.alaskausa.org/efs/efs/grafx/akusa/ 4 KB
5 KB 115ms
114ms Image
image/gif 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/logo-ncua.gif?

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

dcfdce79105743aeda2d194642ba6c291664dd193002cf0e761762896af7ac08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:18 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:01:50 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Type: image/gif
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=99
Content-Length: 4343

GET
H/1.1 200
OK ub-print.css
login.alaskausa.org/efs/efs/jsp/inc/css/ 3 KB
3 KB 626ms
526ms Stylesheet
text/css 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-print.css?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

ae0a9f620731be24cc8c6fc0f2cc46e789f276f497e96ad92734bd7facd2f9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:02:03 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Fri, 17 Feb 2023 03:05:32 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100

GET
H2 404 alaska-common.js
www.hamegam.com/ 0
0 1988ms
1987ms Script
text/html 85.9.66.227
IR-THR-PTE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.hamegam.com/alaska-common.js?seed=AABg2nmGAQAAcBrf0yanMM6Gk_6l7G8QpIQz_5qJmQ-PmLH1NSMQKbIpSolI&OxHMJUSX2t--z=q
Requested by: Host: login.alaskausa.org
URL: https://login.alaskausa.org/alaska-common.js?async
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.9.66.227 , Iran, Islamic Republic Of, ASN49100 (IR-THR-PTE, IR),
Reverse DNS
Software: Apache / PHP/7.4.33
Resource Hash

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

expires: Wed, 11 Jan 1984 05:00:00 GMT
date: Wed, 22 Feb 2023 16:23:19 GMT
cache-control: no-cache, must-revalidate, max-age=0
server: Apache
x-powered-by: PHP/7.4.33
link: <https://www.hamegam.com/wp-json/>; rel="https://api.w.org/"
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK header_bg.png
login.alaskausa.org/efs/efs/grafx/akusa/ 8 KB
9 KB 351ms
288ms Image
image/png 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/header_bg.png?

Requested by

Host: login.alaskausa.org
URL: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

5cd6b433131a0f7972117a1de73410cd07059f385b4dceb1e99b1c9dd6351fb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:18 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit11040
Last-Modified: Fri, 17 Feb 2023 03:01:50 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 8091

GET
H/1.1 404
Not Found pgMainEdge.png
www.alaskausa.org/css/nav/ 0
0 674ms
395ms Image
text/html 107.162.171.161
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.alaskausa.org/css/nav/pgMainEdge.png
Requested by: Host: www.hamegam.com
URL: https://www.hamegam.com/Akus/57c70bc7df1d0b2af96e22860d6f14da/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.171.161 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

GET
H/1.1 200
OK bullet-right.png
login.alaskausa.org/efs/images/ 154 B
1 KB 460ms
369ms Image
image/png 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/images/bullet-right.png

Requested by

Host: login.alaskausa.org
URL: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

70a46f91c5948576ac320802ed148ed967757b8391f9b3e958c2dcbe1f333d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date: Wed, 22 Feb 2023 16:23:18 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit16014
Last-Modified: Fri, 17 Feb 2023 03:05:32 GMT
X-Permitted-Cross-Domain-Policies: none
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 154

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alaska USA Federal Credit Union (Banking)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.alaskausa.org/css/nav/pgMainEdge.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.hamegam.com/alaska-common.js?seed=AABg2nmGAQAAcBrf0yanMM6Gk_6l7G8QpIQz_5qJmQ-PmLH1NSMQKbIpSolI&OxHMJUSX2t--z=q Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.alaskausa.org
www.alaskausa.org
www.hamegam.com
107.162.171.161
107.162.174.66
85.9.66.227
0a5bb7450bce69fd47e82eb792d6fe0460cbc433ac194e45f3917b801ac89cfe
0afe5db7762a298d8c109f811bc905d560d4a701f870db4c80868ddfaf4bb75a
110d05d5cdb82977d18e04fd15b60ea781df07cc6d2fccce3e836bd86463b926
4112c2fd9057fba7dc479efb72556940f4f8536d750bf21303851cc31631b2ea
5cd6b433131a0f7972117a1de73410cd07059f385b4dceb1e99b1c9dd6351fb6
6951260bdde918664e5015241cb5985ef5cd11928f1f46c5b9e8bdd407554121
70a46f91c5948576ac320802ed148ed967757b8391f9b3e958c2dcbe1f333d14
8fa8e715548a8766cb3cebb3ab325d56263ae0c58afdd6964af42c20bddef830
a3941d5f3a221368776c19f01fef5fdcff8825460e416580fc809dbdd83972cc
ae0a9f620731be24cc8c6fc0f2cc46e789f276f497e96ad92734bd7facd2f9e8
dcfdce79105743aeda2d194642ba6c291664dd193002cf0e761762896af7ac08
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9d50b964802b2bb60004481eb67394bd994ba4c6f8a67e3ded7574ef58fcfc2
ecaf03c4b28c22fac47e629ecd2b364f8103f6cdcb8418032fd84b12c11c099c

www.hamegam.com Open in urlscan Pro 85.9.66.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

86 kBTransfer

131 kBSize

0 Cookies

6 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

25 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

www.hamegam.com Open in urlscan Pro
85.9.66.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

86 kB
Transfer

131 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!