relocationmauritius.mu Open in urlscan Pro
149.56.22.105 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://matras-centr.com.ua/404.html
Effective URL:
http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer
Submission: On December 14 via manual (December 14th 2018, 10:11:09 am UTC) from BE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 15 HTTP transactions. The main IP is 149.56.22.105, located in Montréal, Canada and belongs to OVH, FR. The main domain is relocationmauritius.mu.

This is the only time relocationmauritius.mu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	91.219.29.38 91.219.29.38	3254 (LUCKYNET ...) (LUCKYNET Lucky Net Ltd)
14	149.56.22.105 149.56.22.105	16276 (OVH) (OVH)
15	2

1 91.219.29.38 (Ukraine)

ASN3254 (LUCKYNET Lucky Net Ltd, UA)
PTR: 38.29.219.91.colo.ukrservers.com

matras-centr.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 149.56.22.105 (Montréal, Canada)

ASN16276 (OVH, FR)
PTR: atlantis.nemesyscloud.com

relocationmauritius.mu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	relocationmauritius.mu relocationmauritius.mu	441 KB
1	matras-centr.com.ua matras-centr.com.ua	499 B
15	2

	Domain	Requested by
14	relocationmauritius.mu	relocationmauritius.mu
1	matras-centr.com.ua
15	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer
Frame ID: 7D8A77DA9B71FA2234BD5DA1E820044E
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://matras-centr.com.ua/404.html Page URL
http://relocationmauritius.mu/up/ Page URL
http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /.*Varnish/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

15
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

442 kB
Transfer

438 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://matras-centr.com.ua/404.html Page URL
http://relocationmauritius.mu/up/ Page URL
http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	404.html Show response matras-centr.com.ua/	97 B 499 B	404ms 40ms	Document text/html	91.219.29.38 LUCKYNET Lucky Ne...
General Check archive.org Show headers Download Go to Full URL http://matras-centr.com.ua/404.html Protocol HTTP/1.1 Server 91.219.29.38 , Ukraine, ASN3254 (LUCKYNET Lucky Net Ltd, UA), Reverse DNS 38.29.219.91.colo.ukrservers.com Software nginx / Resource Hash `fed9cf7a95dbe6d7d8746dd26cdb399e689bac6727f1e3508738690737355800` Request headers Host matras-centr.com.ua Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx Date Fri, 14 Dec 2018 10:04:57 GMT Content-Type text/html; charset=UTF-8 Content-Length 112 Connection keep-alive X-Accel-Version 0.01 Last-Modified Fri, 14 Dec 2018 00:19:32 GMT ETag "61-57cf0629ced00-gzip" Vary Accept-Encoding,User-Agent Content-Encoding gzip X-Varnish 272090395 Age 0 Via 1.1 varnish-v4 Accept-Ranges bytes
GET H/1.1	200 OK	Cookie set / relocationmauritius.mu/up/	120 B 548 B	660ms 419ms	Document text/html	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/ Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / PHP/5.6.39 Resource Hash Request headers Host relocationmauritius.mu Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://matras-centr.com.ua/404.html Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://matras-centr.com.ua/404.html Response headers Date Fri, 14 Dec 2018 10:10:55 GMT Server Apache X-Powered-By PHP/5.6.39 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1; path=/ Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	Primary Request / Show response relocationmauritius.mu/up/	3 KB 4 KB	157ms 154ms	Document text/html	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / PHP/5.6.39 Resource Hash `b1bb5e546007262d014aa952c4fd2ac4d55069ae6b1b22611dee7e3774186d24` Request headers Host relocationmauritius.mu Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://relocationmauritius.mu/up/ Accept-Encoding gzip, deflate Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://relocationmauritius.mu/up/ Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Server Apache X-Powered-By PHP/5.6.39 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bootstrap.min.css relocationmauritius.mu/up/files/css/	107 KB 107 KB	98ms 97ms	Stylesheet text/css	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/files/css/bootstrap.min.css Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 109518
GET H/1.1	200 OK	style-login-mobile.css relocationmauritius.mu/up/files/css/	4 KB 4 KB	308ms 96ms	Stylesheet text/css	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/files/css/style-login-mobile.css Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `a5b17d9d95a7c093d674d34d0abf48a80ad5f7f9ee818ee8b5a45e2968ea7be3` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3827
GET H/1.1	200 OK	script-login-mobile.js Show response relocationmauritius.mu/up/files/js/	1 KB 2 KB	310ms 99ms	Script application/javascript	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/files/js/script-login-mobile.js Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `937fb4c3dc6feca2024487c9cd485a68b8f69e76ee0368844b19ce76f796e05f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1418
GET H/1.1	200 OK	style-login-desktop.css relocationmauritius.mu/up/files/css/	3 KB 3 KB	307ms 98ms	Stylesheet text/css	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/files/css/style-login-desktop.css Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `f6b55fb6cfe7f97a84db05fed36258d98c1f9433e058e58bc7c0b8a08c305bba` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3107
GET H/1.1	200 OK	script-login-desktop.js Show response relocationmauritius.mu/up/files/js/	1 KB 1 KB	308ms 99ms	Script application/javascript	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Full URL http://relocationmauritius.mu/up/files/js/script-login-desktop.js Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `d01b097243c02a0f09b81749fce374fa046c9a69f2aa01d33f76e4073ef4099a` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 1250
GET H/1.1	200 OK	login-desktop.png relocationmauritius.mu/up/files/img/	246 KB 246 KB	305ms 96ms	Image image/png	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/login-desktop.png Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `57fe235f09d41a2d419f99aeb9769038a1beb87dadeacfe5a2bc66ef13c234c7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Cookie PHPSESSID=sgs71efl8e6vhllo3php0ch5g1 Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 251932
GET H/1.1	200 OK	navbar-repeat-login.png relocationmauritius.mu/up/files/img/	186 B 427 B	122ms 100ms	Image image/png	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/navbar-repeat-login.png Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `8f7c95480071b0186f9fea15c8887c2c6baf756fcbabc0c058e2893e5b77f4fa` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/files/css/style-login-desktop.css Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/files/css/style-login-desktop.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 186
GET H/1.1	200 OK	navbar.png relocationmauritius.mu/up/files/img/	20 KB 20 KB	121ms 99ms	Image image/png	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/navbar.png Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `9d031ab45532cbbc836814405707597d04c0830d59c713fc26176c4e48e6a5cc` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/files/css/style-login-desktop.css Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/files/css/style-login-desktop.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 20218
GET H/1.1	200 OK	sub-navbar.png relocationmauritius.mu/up/files/img/	24 KB 25 KB	118ms 96ms	Image image/png	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/sub-navbar.png Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `9d8aba966591d27568b475f5f1eefbc65a76d3a4e7ad584529f3972da6a65127` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/files/css/style-login-desktop.css Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/files/css/style-login-desktop.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 25064
GET H/1.1	200 OK	btn.png relocationmauritius.mu/up/files/img/	711 B 952 B	120ms 98ms	Image image/png	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/btn.png Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `20561e3f883ab183123a6ef5a08a66fd701c6553766be53950034e487731b3fb` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/files/css/style-login-desktop.css Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/files/css/style-login-desktop.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 711
GET H/1.1	200 OK	33.gif relocationmauritius.mu/up/files/img/	5 KB 5 KB	118ms 97ms	Image image/gif	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/33.gif Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `c10e373c687fe9283e819df73c9761d9282ec609020b954b6065a3c73faa20ac` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/files/css/style-login-desktop.css Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/files/css/style-login-desktop.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 4773
GET H/1.1	200 OK	footer-login-desktop.png relocationmauritius.mu/up/files/img/	22 KB 22 KB	184ms 95ms	Image image/png	149.56.22.105 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://relocationmauritius.mu/up/files/img/footer-login-desktop.png Requested by Host: relocationmauritius.mu URL: http://relocationmauritius.mu/up/?ID=login&Key=036de2d4c2a9dd559c29b2ae33309d2e&login&path=/signin/?referrer Protocol HTTP/1.1 Server 149.56.22.105 Montréal, Canada, ASN16276 (OVH, FR), Reverse DNS atlantis.nemesyscloud.com Software Apache / Resource Hash `7e1147abc76fad5053bc757b3680d5407d988d3309bde99d8f0eab65963c6ef6` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host relocationmauritius.mu User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://relocationmauritius.mu/up/files/css/style-login-desktop.css Connection keep-alive Cache-Control no-cache Referer http://relocationmauritius.mu/up/files/css/style-login-desktop.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 14 Dec 2018 10:10:57 GMT Last-Modified Fri, 14 Dec 2018 03:40:02 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 22545

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

matras-centr.com.ua
relocationmauritius.mu
149.56.22.105
91.219.29.38
20561e3f883ab183123a6ef5a08a66fd701c6553766be53950034e487731b3fb
57fe235f09d41a2d419f99aeb9769038a1beb87dadeacfe5a2bc66ef13c234c7
7e1147abc76fad5053bc757b3680d5407d988d3309bde99d8f0eab65963c6ef6
8f7c95480071b0186f9fea15c8887c2c6baf756fcbabc0c058e2893e5b77f4fa
937fb4c3dc6feca2024487c9cd485a68b8f69e76ee0368844b19ce76f796e05f
9d031ab45532cbbc836814405707597d04c0830d59c713fc26176c4e48e6a5cc
9d8aba966591d27568b475f5f1eefbc65a76d3a4e7ad584529f3972da6a65127
a5b17d9d95a7c093d674d34d0abf48a80ad5f7f9ee818ee8b5a45e2968ea7be3
b1bb5e546007262d014aa952c4fd2ac4d55069ae6b1b22611dee7e3774186d24
b5fd723750763ebb731f9221e413e7d64d58d5192dc040e42292ed3dcccca732
c10e373c687fe9283e819df73c9761d9282ec609020b954b6065a3c73faa20ac
d01b097243c02a0f09b81749fce374fa046c9a69f2aa01d33f76e4073ef4099a
f6b55fb6cfe7f97a84db05fed36258d98c1f9433e058e58bc7c0b8a08c305bba
fed9cf7a95dbe6d7d8746dd26cdb399e689bac6727f1e3508738690737355800

relocationmauritius.mu Open in urlscan Pro 149.56.22.105 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

442 kBTransfer

438 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

relocationmauritius.mu Open in urlscan Pro
149.56.22.105 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

442 kB
Transfer

438 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!