www.hamegam.com Open in urlscan Pro
85.9.66.227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Submission: On February 28 via automatic, source openphish (February 28th 2023, 1:12:02 pm UTC) — Scanned from DE

Summary HTTP 16 Redirects Links 6 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 85.9.66.227, located in Iran, Islamic Republic Of and belongs to IR-THR-PTE, IR. The main domain is www.hamegam.com.

This is the only time www.hamegam.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alaska USA Federal Credit Union (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	85.9.66.227 85.9.66.227	49100 (IR-THR-PTE) (IR-THR-PTE)
13	107.162.174.66 107.162.174.66	55002 (DEFENSE-NET) (DEFENSE-NET)
1	107.162.171.161 107.162.171.161	55002 (DEFENSE-NET) (DEFENSE-NET)
16	3

2 85.9.66.227 (Iran, Islamic Republic Of)

ASN49100 (IR-THR-PTE, IR)

www.hamegam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 107.162.174.66 (United States)

ASN55002 (DEFENSE-NET, US)

login.alaskausa.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.162.171.161 (United States)

ASN55002 (DEFENSE-NET, US)

www.alaskausa.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	alaskausa.org login.alaskausa.org — Cisco Umbrella Rank: 319048 www.alaskausa.org — Cisco Umbrella Rank: 273910	74 KB
2	hamegam.com www.hamegam.com	12 KB
16	2

	Domain	Requested by
13	login.alaskausa.org	www.hamegam.com login.alaskausa.org
2	www.hamegam.com	login.alaskausa.org
1	www.alaskausa.org	www.hamegam.com
16	3

This site contains links to these domains. Also see Links.

Domain
www.alaskausa.org
login.alaskausa.org

Subject Issuer	Validity	Valid
login.alaskausa.org DigiCert TLS RSA SHA256 2020 CA1	`2022-05-11` - `2023-06-11`	a year	crt.sh
alaskausa.org DigiCert TLS RSA SHA256 2020 CA1	`2022-08-02` - `2023-09-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Frame ID: E0FF32BA9E3EAE44832009562309ACAA
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Forgot Password

Page Statistics

16
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

86 kB
Transfer

131 kB
Size

0
Cookies

6 Outgoing links

These are links going to different origins than the main page.

URL: https://www.alaskausa.org/

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/ultrabranch/guide.asp?s=loginX
Title: Online Account Access Troubleshooting

Search URL Search Domain Scan URL

URL: https://login.alaskausa.org/efs/ultrabranch/ForgotPAC
Title: Which email should I use?

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/ultrabranch/guide.asp?s=msc
Title: Forgot User ID?

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/ultrabranch/guide.asp
Title: Other issues?

Search URL Search Domain Scan URL

URL: https://www.alaskausa.org/service/contact.asp
Title: More contact information

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/ 12 KB
12 KB 978ms
152ms Document
text/html 85.9.66.227
IR-THR-PTE

General

Check archive.org

Show headers Download Go to

Full URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Protocol: HTTP/1.1
Server: 85.9.66.227 , Iran, Islamic Republic Of, ASN49100 (IR-THR-PTE, IR),
Reverse DNS
Software: Apache /
Resource Hash: 4112c2fd9057fba7dc479efb72556940f4f8536d750bf21303851cc31631b2ea

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Upgrade, Keep-Alive
Content-Length: 12152
Content-Type: text/html
Date: Tue, 28 Feb 2023 13:11:47 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Tue, 27 Dec 2022 08:02:07 GMT
Server: Apache
Upgrade: h2,h2c

GET
H/1.1 200
OK alaska-common.js Show response
login.alaskausa.org/ 21 KB
8 KB 1067ms
139ms Script
application/javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.alaskausa.org/alaska-common.js?matcher
Requested by: Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: 0afe5db7762a298d8c109f811bc905d560d4a701f870db4c80868ddfaf4bb75a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Feb 2023 13:11:48 GMT
Content-Encoding: gzip
Via: 1.1 google, 1.1 dca1-bit16014
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: prod
Cache-Control: no-cache, no-store, must-revalidate
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Expires: 0

GET
H/1.1 200
OK alaska-common.js Show response
login.alaskausa.org/ 21 KB
8 KB 1074ms
143ms Script
application/javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.alaskausa.org/alaska-common.js?cache
Requested by: Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: 0afe5db7762a298d8c109f811bc905d560d4a701f870db4c80868ddfaf4bb75a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

X-Ion-Hop: prod
Date: Tue, 28 Feb 2023 13:11:48 GMT
Cache-Control: public, max-age=3600, immutable
Content-Encoding: gzip
Via: 1.1 google, 1.1 dca1-bit16014
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Type: application/javascript; charset=UTF-8

GET
H/1.1 200
OK alaska-common.js Show response
login.alaskausa.org/ 952 B
1 KB 141ms
141ms Script
application/javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://login.alaskausa.org/alaska-common.js?async
Requested by: Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: 28ce4483f7340c3c18eef0fcf08aa19ca1cfb53402a242367c6b590421017595

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Feb 2023 13:11:49 GMT
Content-Encoding: gzip
Via: 1.1 google, 1.1 dca1-bit13018
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: prod
Cache-Control: no-cache, no-store, must-revalidate
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Expires: 0

GET
H/1.1 200
OK ub-main.css
login.alaskausa.org/efs/efs/jsp/inc/css/ 21 KB
8 KB 1569ms
641ms Stylesheet
text/css 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-main.css?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

8fa8e715548a8766cb3cebb3ab325d56263ae0c58afdd6964af42c20bddef830

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 12:46:46 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:30:46 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100

GET
H/1.1 200
OK ub-login-new.css
login.alaskausa.org/efs/efs/jsp/inc/css/ 8 KB
4 KB 1361ms
434ms Stylesheet
text/css 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

110d05d5cdb82977d18e04fd15b60ea781df07cc6d2fccce3e836bd86463b926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:49 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit16014
Last-Modified: Tue, 28 Feb 2023 01:30:46 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100

GET
H/1.1 200
OK common_functions.js Show response
login.alaskausa.org/efs/efs/jslibrary/ 8 KB
3 KB 1353ms
423ms Script
application/x-javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jslibrary/common_functions.js?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

0a5bb7450bce69fd47e82eb792d6fe0460cbc433ac194e45f3917b801ac89cfe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:52 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:27:00 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 2449

GET
H/1.1 200
OK open_window.js Show response
login.alaskausa.org/efs/efs/jslibrary/ 5 KB
3 KB 1681ms
750ms Script
application/x-javascript 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jslibrary/open_window.js?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

6951260bdde918664e5015241cb5985ef5cd11928f1f46c5b9e8bdd407554121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:49 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:27:00 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=100
Content-Length: 1852

GET
H/1.1 200
OK akusafcu_logo.png
login.alaskausa.org/efs/efs/grafx/akusa/ 16 KB
17 KB 304ms
303ms Image
image/png 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/akusafcu_logo.png

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

a3941d5f3a221368776c19f01fef5fdcff8825460e416580fc809dbdd83972cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:49 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:30:44 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=99
Content-Length: 16729

GET
H/1.1 200
OK logo-ehl-tri.gif
login.alaskausa.org/efs/efs/grafx/akusa/ 2 KB
3 KB 210ms
210ms Image
image/gif 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/logo-ehl-tri.gif?

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

e9d50b964802b2bb60004481eb67394bd994ba4c6f8a67e3ded7574ef58fcfc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:49 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit16014
Last-Modified: Tue, 28 Feb 2023 01:26:58 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Type: image/gif
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=99
Content-Length: 2358

GET
H/1.1 200
OK logo-ncua.gif
login.alaskausa.org/efs/efs/grafx/akusa/ 4 KB
5 KB 191ms
190ms Image
image/gif 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/logo-ncua.gif?

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

dcfdce79105743aeda2d194642ba6c291664dd193002cf0e761762896af7ac08

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:53 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:30:44 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Type: image/gif
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=99
Content-Length: 4343

GET
H/1.1 200
OK ub-print.css
login.alaskausa.org/efs/efs/jsp/inc/css/ 3 KB
3 KB 616ms
312ms Stylesheet
text/css 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-print.css?akusa_rev=d3d6a6bf

Requested by

Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

ae0a9f620731be24cc8c6fc0f2cc46e789f276f497e96ad92734bd7facd2f9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:50 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:30:46 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/css
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=98

GET
H/1.1 200
OK header_bg.png
login.alaskausa.org/efs/efs/grafx/akusa/ 8 KB
9 KB 386ms
195ms Image
image/png 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/efs/grafx/akusa/header_bg.png?

Requested by

Host: login.alaskausa.org
URL: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

5cd6b433131a0f7972117a1de73410cd07059f385b4dceb1e99b1c9dd6351fb6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:53 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit13018
Last-Modified: Tue, 28 Feb 2023 01:30:44 GMT
X-Permitted-Cross-Domain-Policies: none
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=98
Content-Length: 8091

GET
H/1.1 404
Not Found pgMainEdge.png
www.alaskausa.org/css/nav/ 0
0 946ms
235ms Image
text/html 107.162.171.161
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.alaskausa.org/css/nav/pgMainEdge.png
Requested by: Host: www.hamegam.com
URL: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 107.162.171.161 , United States, ASN55002 (DEFENSE-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H/1.1 200
OK bullet-right.png
login.alaskausa.org/efs/images/ 154 B
1 KB 396ms
189ms Image
image/png 107.162.174.66
DEFENSE-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.alaskausa.org/efs/images/bullet-right.png

Requested by

Host: login.alaskausa.org
URL: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

107.162.174.66 , United States, ASN55002 (DEFENSE-NET, US),

Reverse DNS

Software

Resource Hash

70a46f91c5948576ac320802ed148ed967757b8391f9b3e958c2dcbe1f333d14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://login.alaskausa.org/efs/efs/jsp/inc/css/ub-login-new.css?akusa_rev=d3d6a6bf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:50 GMT
Strict-Transport-Security: max-age=31536000
Via: 1.1 dca1-bit16014
Last-Modified: Tue, 28 Feb 2023 01:27:02 GMT
X-Permitted-Cross-Domain-Policies: none
Vary: Accept-Encoding
Content-Type: text/plain
Content-Language: en-US
Connection: Keep-Alive
Keep-Alive: timeout=10, max=98
Content-Length: 154

GET
H/1.1 404
Not Found alaska-common.js
www.hamegam.com/ 0
0 3243ms
3243ms Script
text/html 85.9.66.227
IR-THR-PTE

General

Check archive.org

Show headers Download Go to

Full URL: http://www.hamegam.com/alaska-common.js?seed=AIC8G5iGAQAA7IrgigBtHFuxEFbq1RpjcBeF7J7sJXPjbAQqFcNQbEXAkDcI&OxHMJUSX2t--z=q
Requested by: Host: login.alaskausa.org
URL: https://login.alaskausa.org/alaska-common.js?async
Protocol: HTTP/1.1
Server: 85.9.66.227 , Iran, Islamic Republic Of, ASN49100 (IR-THR-PTE, IR),
Reverse DNS
Software: Apache / PHP/7.4.33
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.hamegam.com/Akus/e5b7732d8ad120e997eac0868b42aa53/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 28 Feb 2023 13:11:49 GMT
Server: Apache
X-Powered-By: PHP/7.4.33
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, must-revalidate, max-age=0
Connection: Keep-Alive
Link: <https://www.hamegam.com/wp-json/>; rel="https://api.w.org/"
Keep-Alive: timeout=5, max=99
Expires: Wed, 11 Jan 1984 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alaska USA Federal Credit Union (Banking)

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.alaskausa.org/css/nav/pgMainEdge.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://www.hamegam.com/alaska-common.js?seed=AIC8G5iGAQAA7IrgigBtHFuxEFbq1RpjcBeF7J7sJXPjbAQqFcNQbEXAkDcI&OxHMJUSX2t--z=q Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

login.alaskausa.org
www.alaskausa.org
www.hamegam.com
107.162.171.161
107.162.174.66
85.9.66.227
0a5bb7450bce69fd47e82eb792d6fe0460cbc433ac194e45f3917b801ac89cfe
0afe5db7762a298d8c109f811bc905d560d4a701f870db4c80868ddfaf4bb75a
110d05d5cdb82977d18e04fd15b60ea781df07cc6d2fccce3e836bd86463b926
28ce4483f7340c3c18eef0fcf08aa19ca1cfb53402a242367c6b590421017595
4112c2fd9057fba7dc479efb72556940f4f8536d750bf21303851cc31631b2ea
5cd6b433131a0f7972117a1de73410cd07059f385b4dceb1e99b1c9dd6351fb6
6951260bdde918664e5015241cb5985ef5cd11928f1f46c5b9e8bdd407554121
70a46f91c5948576ac320802ed148ed967757b8391f9b3e958c2dcbe1f333d14
8fa8e715548a8766cb3cebb3ab325d56263ae0c58afdd6964af42c20bddef830
a3941d5f3a221368776c19f01fef5fdcff8825460e416580fc809dbdd83972cc
ae0a9f620731be24cc8c6fc0f2cc46e789f276f497e96ad92734bd7facd2f9e8
dcfdce79105743aeda2d194642ba6c291664dd193002cf0e761762896af7ac08
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9d50b964802b2bb60004481eb67394bd994ba4c6f8a67e3ded7574ef58fcfc2

www.hamegam.com Open in urlscan Pro 85.9.66.227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

16 Requests

88 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

86 kBTransfer

131 kBSize

0 Cookies

6 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

24 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

www.hamegam.com Open in urlscan Pro
85.9.66.227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

86 kB
Transfer

131 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!