wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru Open in urlscan Pro
81.177.135.150 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tinyurl.com/xdnbcu96
Effective URL:
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Submission: On April 01 via manual (April 1st 2021, 10:59:18 am UTC) from CL

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 5 countries across 6 domains to perform 11 HTTP transactions. The main IP is 81.177.135.150, located in Russian Federation and belongs to RTCOMM-AS, RU. The main domain is wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru.

This is the only time wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:10:... 2606:4700:10::6814:8a41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
2 4	81.177.135.150 81.177.135.150	8342 (RTCOMM-AS) (RTCOMM-AS)
6	93.190.87.72 93.190.87.72	200163 (NO-ITERAN...) (NO-ITERANETWORKS)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	201.131.38.227 201.131.38.227	263688 (INTESIS C...) (INTESIS CHILE S.A)
11	5

1 2606:4700:10::6814:8a41 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tinyurl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdf21-fonasa.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 81.177.135.150 (Russian Federation) 2 redirects

ASN8342 (RTCOMM-AS, RU)
PTR: srv189-sp-st.jino.ru

wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 93.190.87.72 (Oslo, Norway)

ASN200163 (NO-ITERANETWORKS, NO)

acs4.3dsecure.no	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 201.131.38.227 (Chile)

ASN263688 (INTESIS CHILE S.A, CL)
PTR: fonasaweb.intesis.cl

www.fonasa.cl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	3dsecure.no acs4.3dsecure.no	21 KB
4	myjino.ru 2 redirects wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru	4 KB
1	fonasa.cl www.fonasa.cl	18 KB
1	wikimedia.org upload.wikimedia.org	166 KB
1	blogspot.com cdf21-fonasa.blogspot.com	15 KB
1	tinyurl.com 1 redirects tinyurl.com	841 B
11	6

	Domain	Requested by
6	acs4.3dsecure.no	wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru acs4.3dsecure.no
4	wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru	2 redirects cdf21-fonasa.blogspot.com wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
1	www.fonasa.cl	wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
1	upload.wikimedia.org	wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
1	cdf21-fonasa.blogspot.com
1	tinyurl.com	1 redirects
11	6

This site contains no links.

Subject Issuer	Validity	Valid
misc-sni.blogspot.com GTS CA 1O1	`2021-03-11` - `2021-06-03`	3 months	crt.sh
acs.3dsecure.no GlobalSign GCC R3 DV TLS CA 2020	`2021-01-25` - `2022-02-26`	a year	crt.sh
*.wikipedia.org DigiCert SHA2 High Assurance Server CA	`2020-11-09` - `2021-11-16`	a year	crt.sh
www.fonasa.cl GlobalSign Extended Validation CA - SHA256 - G3	`2020-09-15` - `2021-10-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Frame ID: E67850CC3065AA57B90DA3679FF2F4D9
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://tinyurl.com/xdnbcu96 HTTP 301
https://cdf21-fonasa.blogspot.com/ Page URL
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/ HTTP 302
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0 HTTP 301
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/ Page URL

Detected technologies

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

OpenGSE (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /GSE/i

Page Statistics

11
Requests

82 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

5
Countries

223 kB
Transfer

281 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tinyurl.com/xdnbcu96 HTTP 301
https://cdf21-fonasa.blogspot.com/ Page URL
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/ HTTP 302
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0 HTTP 301
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://tinyurl.com/xdnbcu96 HTTP 301
https://cdf21-fonasa.blogspot.com/

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
cdf21-fonasa.blogspot.com/
Redirect Chain

https://tinyurl.com/xdnbcu96
https://cdf21-fonasa.blogspot.com/

70 KB
15 KB

214ms
194ms

Document
text/html

2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdf21-fonasa.blogspot.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: cdf21-fonasa.blogspot.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
expires: Thu, 01 Apr 2021 10:59:01 GMT
date: Thu, 01 Apr 2021 10:59:01 GMT
cache-control: private, max-age=0
last-modified: Thu, 01 Apr 2021 03:53:04 GMT
etag: W/"ebf646eadfe7ceb1c7897678bc553adfbe63029f7035aca5b179bb91559fd2f1"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 15200
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

date: Thu, 01 Apr 2021 10:59:00 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d8ccde3cc3ba474472d55fbcf07fcb5e51617274740; expires=Sat, 01-May-21 10:59:00 GMT; path=/; domain=.tinyurl.com; HttpOnly; SameSite=Lax TCSR-2563c821118647e523624ce60eb7917a=eyJpdiI6IitRSzhRc2pwQkgyb3dpelZRVExcL3pRPT0iLCJ2YWx1ZSI6InFjazdQVUpkc3BJV3JqUFI2RlB3Z3Y2bXdEKzA4elVvY05Nb0tDaVBnY1BTMEZ6ejdFQnJnb2dFVUgzRis4ZVkiLCJtYWMiOiI0MGM3MTdkNTE4MWYwMjNmYjFhMzdjNTliY2JhYjM3Y2Q2Y2E2NWRlZWM4ZGIzMTBjN2YzNTU3NGExY2RmMDZiIn0%3D; expires=Thu, 01-Apr-2021 11:04:00 GMT; Max-Age=300; path=/; domain=.tinyurl.com; httponly; samesite=lax
x-powered-by: PHP/7.3.27
location: https://cdf21-fonasa.blogspot.com/
cache-control: max-age=0, public, s-max-age=900, stale-if-error: 86400
referrer-policy: unsafe-url
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: DYNAMIC
cf-request-id: 092eaf36c20000536958b11000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 63914e3798115369-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1

200
OK

Primary Request / Show response
wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Redirect Chain

http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0
http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/

7 KB
2 KB

70ms
70ms

Document
text/html

81.177.135.150
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Requested by: Host: cdf21-fonasa.blogspot.com
URL: https://cdf21-fonasa.blogspot.com/
Protocol: HTTP/1.1
Server: 81.177.135.150 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv189-sp-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 6924f984227d6db49372720bb50839b858bd0c691bd57f7785e19ac01f7523d4

Request headers

Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cdf21-fonasa.blogspot.com/

Response headers

Date: Thu, 01 Apr 2021 10:59:01 GMT
Content-Type: text/html
Content-Length: 2248
Connection: keep-alive
Server: Jino.ru/mod_pizza
Last-Modified: Thu, 01 Apr 2021 10:59:01 GMT
ETag: W/"8d30c86-1a97-5bee71e757c03"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

Redirect headers

Date: Thu, 01 Apr 2021 10:59:01 GMT
Content-Type: text/html
Content-Length: 253
Connection: keep-alive
Server: Jino.ru/mod_pizza
Location: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Vary: Accept-Encoding
Content-Encoding: gzip

GET
H2 200 screen.css
acs4.3dsecure.no/mdpayacs/content/040/ 3 KB
3 KB 501ms
50ms Stylesheet
text/css 93.190.87.72
NO-ITERANETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://acs4.3dsecure.no/mdpayacs/content/040/screen.css

Requested by

Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.190.87.72 Oslo, Norway, ASN200163 (NO-ITERANETWORKS, NO),

Reverse DNS

Software

nginx /

Resource Hash

4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Apr 2021 10:59:01 GMT
last-modified: Wed, 05 Jun 2019 15:51:39 GMT
server: nginx
etag: "5cf7e50b-c14"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
accept-ranges: bytes
content-length: 3092

GET
H2 200 gh-buttons.css
acs4.3dsecure.no/mdpayacs/content/040/dk/ 13 KB
13 KB 513ms
62ms Stylesheet
text/css 93.190.87.72
NO-ITERANETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css

Requested by

Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.190.87.72 Oslo, Norway, ASN200163 (NO-ITERANETWORKS, NO),

Reverse DNS

Software

nginx /

Resource Hash

686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Apr 2021 10:59:01 GMT
last-modified: Tue, 13 Oct 2015 12:20:10 GMT
server: nginx
etag: "561cf6fa-3290"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/css
accept-ranges: bytes
content-length: 12944

GET
H2 200 commons.js Show response
acs4.3dsecure.no/mdpayacs/content/ 1 KB
1 KB 513ms
63ms Script
application/javascript 93.190.87.72
NO-ITERANETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://acs4.3dsecure.no/mdpayacs/content/commons.js

Requested by

Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.190.87.72 Oslo, Norway, ASN200163 (NO-ITERANETWORKS, NO),

Reverse DNS

Software

nginx /

Resource Hash

2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Apr 2021 10:59:01 GMT
last-modified: Thu, 04 Oct 2018 00:56:30 GMT
server: nginx
etag: W/"1202-1538614590000"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript
accept-ranges: bytes
content-length: 1202

GET
H2 404 jquery-1.9.1.min.js
acs4.3dsecure.no/mdpayacs/content/040/js/ 0
0 513ms
63ms Script
text/html 93.190.87.72
NO-ITERANETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js
Requested by: Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 93.190.87.72 Oslo, Norway, ASN200163 (NO-ITERANETWORKS, NO),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK date_time.js Show response
wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/Autentisering_files/ 823 B
663 B 70ms
69ms Script
application/javascript 81.177.135.150
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/Autentisering_files/date_time.js
Requested by: Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Protocol: HTTP/1.1
Server: 81.177.135.150 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv189-sp-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Apr 2021 10:59:01 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Apr 2021 10:59:01 GMT
Server: Jino.ru/mod_pizza
ETag: W/"8d30c85-337-5bee71e757c03"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 345

GET
H2 200 Logo_de_Fonasa.jpg
upload.wikimedia.org/wikipedia/commons/0/08/ 165 KB
166 KB 58ms
23ms Image
image/jpeg 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/0/08/Logo_de_Fonasa.jpg

Requested by

Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

5c22adca5dcfad4a44206a21d9a577231ae8a50b2b4faa240bd1de9b3deb4050

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 31 Mar 2021 23:30:26 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 41316
x-cache-status: hit-local
x-cache: cp3063 hit, cp3065 miss
server-timing: cache;desc="hit-local", host;desc="cp3065"
content-length: 168948
x-client-ip: 2a01:4f8:121:131a::2
x-object-meta-sha1base36: b5co2mh8j82p1ag9ej4e2i3qd4vw4v1
last-modified: Thu, 01 May 2014 17:49:52 GMT
server: ATS/8.0.8
etag: 266f1baa6adb018a2123c92921b163e2
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/jpeg
access-control-allow-origin: *
x-timestamp: 1398966591.90262
accept-ranges: bytes
timing-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache

GET
H/1.1 200
OK gob-footer.svg
www.fonasa.cl/assets/fonasa2019/ 18 KB
18 KB 1260ms
234ms Image
image/svg+xml 201.131.38.227
INTESIS CHILE S.A

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.fonasa.cl/assets/fonasa2019/gob-footer.svg
Requested by: Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 201.131.38.227 , Chile, ASN263688 (INTESIS CHILE S.A, CL),
Reverse DNS: fonasaweb.intesis.cl
Software: default /
Resource Hash: dfdbe0402640377018d3924942fbf2380a7e2ef41399e6a20c230fcee4f2483a

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Apr 2021 10:59:03 GMT
Last-modified: Wed, 20 Nov 2019 14:51:32 GMT
Server: default
Accept-ranges: bytes
Etag: "469c-5dd552f4"
Content-length: 18076
Content-type: image/svg+xml

GET
H2 404 jquery-1.9.1.min.js
acs4.3dsecure.no/mdpayacs/content/040/js/ 0
0 73ms
72ms Script
text/html 93.190.87.72
NO-ITERANETWORKS

General

Check archive.org

Show headers Download Go to

Full URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js
Requested by: Host: wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
URL: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/info/as/coro/82d678a6951664bb8d791ffea39fd3a0/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 93.190.87.72 Oslo, Norway, ASN200163 (NO-ITERANETWORKS, NO),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 gh-icons.png
acs4.3dsecure.no/mdpayacs/content/040/dk/ 4 KB
4 KB 51ms
51ms Image
image/png 93.190.87.72
NO-ITERANETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-icons.png

Requested by

Host: acs4.3dsecure.no
URL: https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

93.190.87.72 Oslo, Norway, ASN200163 (NO-ITERANETWORKS, NO),

Reverse DNS

Software

nginx /

Resource Hash

018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Apr 2021 10:59:02 GMT
last-modified: Tue, 13 Oct 2015 12:20:10 GMT
server: nginx
etag: "561cf6fa-f6c"
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/png
accept-ranges: bytes
content-length: 3948

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs4.3dsecure.no
cdf21-fonasa.blogspot.com
tinyurl.com
upload.wikimedia.org
wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru
www.fonasa.cl
201.131.38.227
2606:4700:10::6814:8a41
2620:0:862:ed1a::2:b
2a00:1450:4001:812::2001
81.177.135.150
93.190.87.72
018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
5c22adca5dcfad4a44206a21d9a577231ae8a50b2b4faa240bd1de9b3deb4050
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
6924f984227d6db49372720bb50839b858bd0c691bd57f7785e19ac01f7523d4
c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb
dfdbe0402640377018d3924942fbf2380a7e2ef41399e6a20c230fcee4f2483a

wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru Open in urlscan Pro 81.177.135.150 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

82 %HTTPS

50 %IPv6

6 Domains

6 Subdomains

5 IPs

5 Countries

223 kBTransfer

281 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

wp1.webmaster-amazon.ndzjp.spectrum.myjino.ru Open in urlscan Pro
81.177.135.150 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

82 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

5
Countries

223 kB
Transfer

281 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!