urlscan.io logo urlscan.io
SecurityTrails logo

bitmicro.com Open in urlscan Pro
107.180.51.102  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php
Effective URL: https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb15797907286...
Submission: On January 23 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 8 HTTP transactions. The main IP is 107.180.51.102, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is bitmicro.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on November 21st 2019. Valid for: a year.
This is the only time bitmicro.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 198.50.243.123 16276 (OVH)
1 151.101.14.110 54113 (FASTLY)
1 162.247.242.21 23467 (NEWRELIC-...)
2 7 107.180.51.102 26496 (AS-26496-...)
8 4
Apex Domain
Subdomains		 Transfer
7 bitmicro.com
bitmicro.com
332 KB
1 nr-data.net
bam.nr-data.net
275 B
1 newrelic.com
js-agent.newrelic.com
10 KB
1 sabcomdubai.com
www.sabcomdubai.com
20 KB
8 4
Domain Requested by
7 bitmicro.com 2 redirects bitmicro.com
1 bam.nr-data.net js-agent.newrelic.com
1 js-agent.newrelic.com www.sabcomdubai.com
1 www.sabcomdubai.com
8 4

This site contains no links.

Subject Issuer Validity Valid
sabcomdubai.com
cPanel, Inc. Certification Authority		 2020-01-15 -
2020-04-14		 3 months crt.sh
f4.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2019-04-10 -
2020-03-21		 a year crt.sh
*.nr-data.net
GeoTrust RSA CA 2018		 2018-01-11 -
2020-03-17		 2 years crt.sh
bitmicro.com
Go Daddy Secure Certificate Authority - G2		 2019-11-21 -
2021-01-21		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
Frame ID: EE6D42783F41AF639A33AB8A5F76CB91
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php Page URL
  2. https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d HTTP 301
    https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/ HTTP 302
    https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.p... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

363 kB
Transfer

442 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php Page URL
  2. https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d HTTP 301
    https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/ HTTP 302
    https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
settings.php
www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/ 		20 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
198.50.243.123 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
Software
Apache /
Resource Hash
59ccddfd1c6a3cb8447f1b7267a41e419de5b54d28b34942c7c42c56a18751f1

Request headers

Host
www.sabcomdubai.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

Date
Thu, 23 Jan 2020 14:45:27 GMT
Server
Apache
Keep-Alive
timeout=3, max=10
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
nr-1158.min.js
js-agent.newrelic.com/ 		26 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-1158.min.js
Requested by
Host: www.sabcomdubai.com
URL: https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
005414ad9d93e4cb677b5e4f87112b0ff6d3731b414bc425bfa1bb94c99a081a

Request headers

Referer
https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 23 Jan 2020 14:45:27 GMT
content-encoding
gzip
x-amz-request-id
ACCAA6FC9CC752FB
x-cache
HIT
status
200
content-length
10068
x-amz-id-2
qb8oRyQPV5RWDkM/YaSpwqe1Tk7N9qddW/sEyzaPUyo5r36anYuFHO7Y/HryGZAiK36w5kQo38I=
x-served-by
cache-fra19152-FRA
last-modified
Wed, 18 Dec 2019 00:24:13 GMT
server
AmazonS3
x-timer
S1579790728.549100,VS0,VE0
etag
"0be8452b990e805f60431dce9e0279b2"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
6453
2a65b546f4
bam.nr-data.net/1/ 		57 B
275 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/2a65b546f4?a=35052016&v=1158.afc605b&to=YFcENRMAWkECVE1RClkdMxMITkNCTlRWVhFSXBJOEQ1BVQpZShcWXkYDDhMIU1sNGklZC1JeFU4SBEBGClleS0pDQgpOEgRARgpZXktLR1oW&rst=3796&ref=https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php&be=3768&fe=3771&dc=3770&af=err,xhr,stn,ins&perf=%7B%22timing%22:%7B%22of%22:1579790723761,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:276,%22c%22:276,%22s%22:3254,%22ce%22:3501,%22rq%22:3501,%22rp%22:3648,%22rpe%22:3766,%22dl%22:3650,%22di%22:3771,%22ds%22:3771,%22de%22:3771,%22dc%22:3771,%22l%22:3771,%22le%22:3772%7D,%22navigation%22:%7B%7D%7D&at=TBAHQ1saSU8%3D&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1158.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.247.242.21 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
bam-9.nr-data.net
Software
/
Resource Hash

Request headers

Referer
https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type
text/javascript;charset=ISO-8859-1
Content-Length
57
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Primary Request u0fx5h5obzeg0gdzzh389sx4.php
bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/
Redirect Chain
  • https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d
  • https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/
  • https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8c...
3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.180.51.102 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-107-180-51-102.ip.secureserver.net
Software
Apache / PHP/7.2.26
Resource Hash
22fe8def2cf7fb60f2eccd6d793507ef5fa694b25543929be05129cb4df26967

Request headers

:method
GET
:authority
bitmicro.com
:scheme
https
:path
/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://www.sabcomdubai.com/wp-content/plugins/siteorigin-panels/settings/tpl/settings.php

Response headers

status
200
date
Thu, 23 Jan 2020 14:45:28 GMT
server
Apache
x-powered-by
PHP/7.2.26
vary
Accept-Encoding,User-Agent
content-encoding
gzip
content-length
1093
content-type
text/html; charset=UTF-8

Redirect headers

status
302
date
Thu, 23 Jan 2020 14:45:27 GMT
server
Apache
x-powered-by
PHP/7.2.26
location
u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
vary
User-Agent
content-length
0
content-type
text/html; charset=UTF-8
style.css
bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/style.css
Requested by
Host: bitmicro.com
URL: https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.180.51.102 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-107-180-51-102.ip.secureserver.net
Software
Apache /
Resource Hash
f3a3435dd1e14ea7ec192be880befce0c60c18a1dd6161f3a66cb82e9b358002

Request headers

Referer
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 23 Jan 2020 14:45:28 GMT
content-encoding
gzip
last-modified
Sat, 15 Dec 2018 13:09:32 GMT
server
Apache
etag
"4f40663-1778-57d0f42305b00-gzip"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
accept-ranges
bytes
content-length
1718
jquery.js
bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/js/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/js/jquery.js
Requested by
Host: bitmicro.com
URL: https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.180.51.102 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-107-180-51-102.ip.secureserver.net
Software
Apache /
Resource Hash
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

Referer
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 23 Jan 2020 14:45:28 GMT
content-encoding
gzip
last-modified
Sat, 15 Dec 2018 13:09:32 GMT
server
Apache
etag
"4f4065d-1762e-57d0f42305b00-gzip"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
accept-ranges
bytes
content-length
33234
ms-logo-v2.jpg
bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/images/ms-logo-v2.jpg
Requested by
Host: bitmicro.com
URL: https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.180.51.102 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-107-180-51-102.ip.secureserver.net
Software
Apache /
Resource Hash
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164

Request headers

Referer
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/u0fx5h5obzeg0gdzzh389sx4.php?iG3FDb157979072861e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c9361e8295b9ca3e0e8cd051bafc4790c93&AP___=&error=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 23 Jan 2020 14:45:28 GMT
last-modified
Sat, 15 Dec 2018 13:09:32 GMT
server
Apache
etag
"4f40652-aed-57d0f42305b00"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
2797
0.jpg
bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/images/ 		291 KB
293 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/images/0.jpg
Requested by
Host: bitmicro.com
URL: https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/js/jquery.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.180.51.102 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-107-180-51-102.ip.secureserver.net
Software
Apache /
Resource Hash
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Referer
https://bitmicro.com/wp-admin/network/privacy/plugin-install/g5hfie73d/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 23 Jan 2020 14:45:28 GMT
last-modified
Sat, 15 Dec 2018 13:09:32 GMT
server
Apache
etag
"4f40647-48c79-57d0f42305b00"
content-type
image/jpeg
status
200
accept-ranges
bytes
content-length
298105

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| isValidEmailAddress

0 Cookies