3dbeliever.com - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 192.185.98.7, located in Houston, United States and belongs to CYRUSONE - CyrusOne LLC, US. The main domain is 3dbeliever.com.

This is the only time 3dbeliever.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	192.185.98.7 192.185.98.7	20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC)
2 2	172.104.14.217 172.104.14.217	63949 (LINODE-AP...) (LINODE-AP Linode)
1	104.27.139.141 104.27.139.141	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	192.240.180.202 192.240.180.202	36444 (NEXCESS-NET) (NEXCESS-NET - NEXCESS.NET L.L.C.)
5	3

3 192.185.98.7 (Houston, United States)

ASN20013 (CYRUSONE - CyrusOne LLC, US)
PTR: 192-185-98-7.unifiedlayer.com

3dbeliever.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.104.14.217 (Absecon, United States) 2 redirects

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1749-217.members.linode.com

www.guidingtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.27.139.141 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.guidingtech.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.240.180.202 (Southfield, United States)

ASN36444 (NEXCESS-NET - NEXCESS.NET L.L.C., US)
PTR: eep5-07.nexcess.net

www.demandware.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	guidingtech.com 2 redirects www.guidingtech.com cdn.guidingtech.com	12 KB
3	3dbeliever.com 3dbeliever.com	2 KB
1	demandware.com www.demandware.com	1 KB
5	3

	Domain	Requested by
3	3dbeliever.com	3dbeliever.com
2	www.guidingtech.com	2 redirects
1	www.demandware.com	3dbeliever.com
1	cdn.guidingtech.com	3dbeliever.com
5	4

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://3dbeliever.com/dob/secure_pdf.html
Frame ID: 361E7FF646E8DF2FDC211CA3090F27EB
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

15 kB
Transfer

17 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg HTTP 301
https://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg HTTP 301
https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg

Request Chain 1

http://www.demandware.com/uploads/home/icon-lock-circle.svg HTTP 307
https://www.demandware.com/uploads/home/icon-lock-circle.svg

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request secure_pdf.html Show response
3dbeliever.com/dob/ 5 KB
2 KB 286ms
147ms Document
text/html 192.185.98.7
CyrusOne LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://3dbeliever.com/dob/secure_pdf.html
Protocol: HTTP/1.1
Server: 192.185.98.7 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS: 192-185-98-7.unifiedlayer.com
Software: nginx/1.14.0 /
Resource Hash: ae7e859662458827414a0563cd143d2b2ea920d36678da732d7c84bdbb0b1364

Request headers

Host: 3dbeliever.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 361E7FF646E8DF2FDC211CA3090F27EB

Response headers

Server: nginx/1.14.0
Date: Wed, 06 Jun 2018 11:11:00 GMT
Content-Type: text/html
Content-Length: 2190
Connection: keep-alive
Vary: Accept-Encoding,User-Agent
Last-Modified: Tue, 22 May 2018 04:59:22 GMT
Accept-Ranges: bytes
Content-Encoding: gzip
Referrer-Policy
Access-Control-Allow-Origin: *

GET
S

200

logo-adobe-pdf.jpg
cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/
Redirect Chain

http://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg
https://www.guidingtech.com/assets/postimages/2014/02/logo-adobe-pdf.jpg
https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg

11 KB
11 KB

47ms
13ms

Image
image/jpeg

104.27.139.141
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg
Requested by: Host: 3dbeliever.com
URL: http://3dbeliever.com/dob/Secure_Mail_PDF.html
Protocol: SPDY
Server: 104.27.139.141 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85e1682716795b2048d4f397901cf6612d63a713e7ef0e8a98f3192bef88721f

Request headers

Referer: http://3dbeliever.com/dob/secure_pdf.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Wed, 06 Jun 2018 11:11:01 GMT
cf-cache-status: HIT
last-modified: Fri, 13 Oct 2017 13:37:09 GMT
server: cloudflare
etag: "59e0c185-2c38"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 426a6f90cb856463-FRA
content-length: 11320
expires: Fri, 06 Jul 2018 11:11:01 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Jun 2018 11:11:01 GMT
x-content-type-options: nosniff
server: nginx
status: 301
x-frame-options: SAMEORIGIN
x-cache: STALE
content-type: text/html; charset=UTF-8
location: https://cdn.guidingtech.com/media/assets/WordPress-Import/2014/02/logo-adobe-pdf.jpg
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1

200
OK

icon-lock-circle.svg
www.demandware.com/uploads/home/
Redirect Chain

http://www.demandware.com/uploads/home/icon-lock-circle.svg
https://www.demandware.com/uploads/home/icon-lock-circle.svg

1 KB
1 KB

490ms
127ms

Image
image/svg+xml

192.240.180.202
NEXCESS.NET L.L.C.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.demandware.com/uploads/home/icon-lock-circle.svg

Requested by

Host: 3dbeliever.com
URL: http://3dbeliever.com/dob/Secure_Mail_PDF.html

Protocol

HTTP/1.1

Server

192.240.180.202 Southfield, United States, ASN36444 (NEXCESS-NET - NEXCESS.NET L.L.C., US),

Reverse DNS

eep5-07.nexcess.net

Software

Apache /

Resource Hash

d14a69ff94cf499915e4cc348951a76f41748010c8eab0876b03c8ba77179b87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://3dbeliever.com/dob/secure_pdf.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 11:11:01 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 03 Mar 2015 22:56:14 GMT
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: image/svg+xml
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 717
Expires: Fri, 06 Jul 2018 11:11:01 GMT

Redirect headers

Location: https://www.demandware.com/uploads/home/icon-lock-circle.svg
Non-Authoritative-Reason: HSTS

GET
H/1.1 404
Not Found jquery-1.4.4.min.js
3dbeliever.com/dob/Scripts/ 0
0 2049ms
2048ms Script
text/html 192.185.98.7
CyrusOne LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://3dbeliever.com/dob/Scripts/jquery-1.4.4.min.js
Requested by: Host: 3dbeliever.com
URL: http://3dbeliever.com/dob/secure_pdf.html
Protocol: HTTP/1.1
Server: 192.185.98.7 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS: 192-185-98-7.unifiedlayer.com
Software: nginx/1.14.0 /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 3dbeliever.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://3dbeliever.com/dob/secure_pdf.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://3dbeliever.com/dob/secure_pdf.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 11:11:02 GMT
Content-Encoding: gzip
Referrer-Policy
Server: nginx/1.14.0
Vary: User-Agent,Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: keep-alive
Link: <http://3dbeliever.com/wp-json/>; rel="https://api.w.org/"
Content-Length: 17615
Expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 404
Not Found jquery.h5validate.js
3dbeliever.com/dob/Scripts/ 0
0 2123ms
1989ms Script
text/html 192.185.98.7
CyrusOne LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://3dbeliever.com/dob/Scripts/jquery.h5validate.js
Requested by: Host: 3dbeliever.com
URL: http://3dbeliever.com/dob/secure_pdf.html
Protocol: HTTP/1.1
Server: 192.185.98.7 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS: 192-185-98-7.unifiedlayer.com
Software: nginx/1.14.0 /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 3dbeliever.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: http://3dbeliever.com/dob/secure_pdf.html
Connection: keep-alive
Cache-Control: no-cache
Referer: http://3dbeliever.com/dob/secure_pdf.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Wed, 06 Jun 2018 11:11:02 GMT
Content-Encoding: gzip
Referrer-Policy
Server: nginx/1.14.0
Vary: User-Agent,Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: keep-alive
Link: <http://3dbeliever.com/wp-json/>; rel="https://api.w.org/"
Content-Length: 17616
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| popitup

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3dbeliever.com
cdn.guidingtech.com
www.demandware.com
www.guidingtech.com
104.27.139.141
172.104.14.217
192.185.98.7
192.240.180.202
85e1682716795b2048d4f397901cf6612d63a713e7ef0e8a98f3192bef88721f
ae7e859662458827414a0563cd143d2b2ea920d36678da732d7c84bdbb0b1364
d14a69ff94cf499915e4cc348951a76f41748010c8eab0876b03c8ba77179b87

3dbeliever.com Open in urlscan Pro 192.185.98.7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

3 Domains

4 Subdomains

3 IPs

1 Countries

15 kBTransfer

17 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

3dbeliever.com Open in urlscan Pro
192.185.98.7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

15 kB
Transfer

17 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!