knitwear.com.np - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 198.1.112.132, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is knitwear.com.np.

This is the only time knitwear.com.np was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	198.1.112.132 198.1.112.132	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
3	151.101.112.193 151.101.112.193	54113 (FASTLY) (FASTLY - Fastly)
5	2

3 198.1.112.132 (Provo, United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: mx-01.intellisoftnepal.com

knitwear.com.np	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	imgur.com i.imgur.com	111 KB
3	knitwear.com.np 1 redirects knitwear.com.np	2 KB
5	2

	Domain	Requested by
3	i.imgur.com	knitwear.com.np
3	knitwear.com.np	1 redirects knitwear.com.np
5	2

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2018-12-14` - `2020-02-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://knitwear.com.np/proudfooot/
Frame ID: 75D1F1CDBDD278F6FF4A97CFFEEE5F70
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://knitwear.com.np/proudfooot HTTP 301
http://knitwear.com.np/proudfooot/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

113 kB
Transfer

111 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://knitwear.com.np/proudfooot HTTP 301
http://knitwear.com.np/proudfooot/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response knitwear.com.np/proudfooot/ Redirect Chain http://knitwear.com.np/proudfooot http://knitwear.com.np/proudfooot/	561 B 867 B	367ms 183ms	Document text/html	198.1.112.132 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://knitwear.com.np/proudfooot/ Protocol HTTP/1.1 Server 198.1.112.132 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS mx-01.intellisoftnepal.com Software Apache / Resource Hash `b91d54b76304476019764214ffd16221162e7f39fd1b3c25caf7947f8db79842` Request headers Host knitwear.com.np Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 30 Jun 2019 11:04:21 GMT Server Apache Last-Modified Mon, 03 Jun 2019 09:02:44 GMT ETag "58088d-231-58a67a095f500" Accept-Ranges bytes Content-Length 561 Cache-Control max-age=90 Expires Sun, 30 Jun 2019 11:05:51 GMT Connection close Content-Type text/html Redirect headers Date Sun, 30 Jun 2019 11:04:20 GMT Server Apache Location http://knitwear.com.np/proudfooot/ Cache-Control max-age=90 Expires Sun, 30 Jun 2019 11:05:50 GMT Content-Length 242 Connection close Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	style.css knitwear.com.np/proudfooot/	677 B 983 B	6602ms 186ms	Stylesheet text/css	198.1.112.132 Unified Layer
General Check archive.org Show headers Download Go to Full URL http://knitwear.com.np/proudfooot/style.css Requested by Host: knitwear.com.np URL: http://knitwear.com.np/proudfooot/ Protocol HTTP/1.1 Security , , Server 198.1.112.132 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS mx-01.intellisoftnepal.com Software Apache / Resource Hash `60661b4f8441d744ea793455ae5baeeda34d5cabd8c1864f02de5a5f139f9ea4` Request headers Referer http://knitwear.com.np/proudfooot/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Sun, 30 Jun 2019 11:04:27 GMT Last-Modified Wed, 03 Apr 2019 19:35:08 GMT Server Apache ETag "580895-2a5-585a559e79300" Content-Type text/css Cache-Control max-age=900 Connection close Accept-Ranges bytes Content-Length 677 Expires Sun, 30 Jun 2019 11:19:27 GMT
GET H2	200	VpfM93Y.png i.imgur.com/	14 KB 14 KB	375ms 43ms	Image image/png	151.101.112.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/VpfM93Y.png Requested by Host: knitwear.com.np URL: http://knitwear.com.np/proudfooot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `30df4de8f1573a19b93cb1d5146aedd60deff92d4b5b4be009534a5aafd5e3bf` Request headers Referer http://knitwear.com.np/proudfooot/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 30 Jun 2019 11:04:21 GMT age 2182050 x-cache HIT, HIT status 200 content-length 14320 x-served-by cache-bwi5145-BWI, cache-hhn4048-HHN last-modified Wed, 03 Apr 2019 20:31:37 GMT server cat factory 1.0 x-timer S1561892662.525365,VS0,VE1 etag "5a4a2cf4f55f5f892b0cb7cb79eb793d" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	x0yYaq1.png i.imgur.com/	12 KB 12 KB	354ms 22ms	Image image/png	151.101.112.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/x0yYaq1.png Requested by Host: knitwear.com.np URL: http://knitwear.com.np/proudfooot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `edb579d891ac318b3a542750f7fbcd1e65f2df528119d7d64f14f05a4d29c642` Request headers Referer http://knitwear.com.np/proudfooot/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 30 Jun 2019 11:04:21 GMT age 2191582 x-cache HIT, HIT status 200 content-length 12478 x-served-by cache-bwi5129-BWI, cache-hhn4048-HHN last-modified Mon, 03 Jun 2019 08:44:53 GMT server cat factory 1.0 x-timer S1561892662.525370,VS0,VE1 etag "dbb91359ea4dc42c15b7b638e1be8964" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	xRk8fh8.png i.imgur.com/	84 KB 84 KB	23ms 22ms	Image image/png	151.101.112.193 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/xRk8fh8.png Requested by Host: knitwear.com.np URL: http://knitwear.com.np/proudfooot/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cat factory 1.0 / Resource Hash `9d98dea3aa3d3da6bac42e4815b2b71a9020a5755edc6544248818a19523f940` Request headers Referer http://knitwear.com.np/proudfooot/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 30 Jun 2019 11:04:27 GMT age 2188540 x-cache HIT, HIT status 200 content-length 85939 x-served-by cache-bwi5128-BWI, cache-hhn4048-HHN last-modified Wed, 03 Apr 2019 18:33:03 GMT server cat factory 1.0 x-timer S1561892668.797299,VS0,VE1 etag "daa4542791336e3229c7485ed853e844" access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
knitwear.com.np
151.101.112.193
198.1.112.132
30df4de8f1573a19b93cb1d5146aedd60deff92d4b5b4be009534a5aafd5e3bf
60661b4f8441d744ea793455ae5baeeda34d5cabd8c1864f02de5a5f139f9ea4
9d98dea3aa3d3da6bac42e4815b2b71a9020a5755edc6544248818a19523f940
b91d54b76304476019764214ffd16221162e7f39fd1b3c25caf7947f8db79842
edb579d891ac318b3a542750f7fbcd1e65f2df528119d7d64f14f05a4d29c642

knitwear.com.np Open in urlscan Pro 198.1.112.132 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

113 kBTransfer

111 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

knitwear.com.np Open in urlscan Pro
198.1.112.132 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

113 kB
Transfer

111 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!