srv195231.hoster-test.ru Open in urlscan Pro
31.28.24.131 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.horizon-verify.stone-d.net/
Effective URL:
http://srv195231.hoster-test.ru/firsthorizon/
Submission: On July 22 via automatic, source certstream-suspicious (July 22nd 2023, 2:51:02 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 31.28.24.131, located in St Petersburg, Russian Federation and belongs to CITYTELECOM-AS Filanco LTD, RU. The main domain is srv195231.hoster-test.ru.

This is the only time srv195231.hoster-test.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: First Horizon Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	103.53.192.105 103.53.192.105	55669 (MCS-AS-ID...) (MCS-AS-ID PT. Maxindo Content Solution)
1 10	31.28.24.131 31.28.24.131	29076 (CITYTELEC...) (CITYTELECOM-AS Filanco LTD)
9	1

1 103.53.192.105 (Indonesia) 1 redirects

ASN55669 (MCS-AS-ID PT. Maxindo Content Solution, ID)
PTR: satria.maxserver.co.id

www.horizon-verify.stone-d.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 31.28.24.131 (St Petersburg, Russian Federation) 1 redirects

ASN29076 (CITYTELECOM-AS Filanco LTD, RU)
PTR: c06w.hoster.ru

srv195231.hoster-test.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	hoster-test.ru 1 redirects srv195231.hoster-test.ru	225 KB
1	stone-d.net 1 redirects www.horizon-verify.stone-d.net	265 B
9	2

	Domain	Requested by
10	srv195231.hoster-test.ru	1 redirects srv195231.hoster-test.ru
1	www.horizon-verify.stone-d.net	1 redirects
9	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://srv195231.hoster-test.ru/firsthorizon/
Frame ID: 0D8DBD7C88C9CCC92EB46B1F9FE64575
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

First Horizon - Log In

Page URL History Show full URLs

https://www.horizon-verify.stone-d.net/ HTTP 301
http://srv195231.hoster-test.ru/firsthorizon HTTP 301
http://srv195231.hoster-test.ru/firsthorizon/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

225 kB
Transfer

222 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.horizon-verify.stone-d.net/ HTTP 301
http://srv195231.hoster-test.ru/firsthorizon HTTP 301
http://srv195231.hoster-test.ru/firsthorizon/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response srv195231.hoster-test.ru/firsthorizon/ Redirect Chain https://www.horizon-verify.stone-d.net/ http://srv195231.hoster-test.ru/firsthorizon http://srv195231.hoster-test.ru/firsthorizon/	9 KB 9 KB	350ms 349ms	Document text/html	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Full URL http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / PHP/8.1.11 Resource Hash `3ba34e1568acbcad4b9bbee0969b35cb7e5988ef4a2d6b3a74d74cc32a6f351b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Type text/html; charset=UTF-8 Date Sat, 22 Jul 2023 14:50:56 GMT Server Apache/2.2.15 (CentOS) Transfer-Encoding chunked X-Cache MISS from t0.hoster.ru X-Cache-Lookup MISS from t0.hoster.ru:6666 X-Powered-By PHP/8.1.11 Redirect headers Connection keep-alive Content-Length 343 Content-Type text/html; charset=iso-8859-1 Date Sat, 22 Jul 2023 14:50:56 GMT Location http://srv195231.hoster-test.ru/firsthorizon/ Server Apache/2.2.15 (CentOS) X-Cache MISS from t0.hoster.ru X-Cache-Lookup MISS from t0.hoster.ru:6666
GET H/1.1	200 OK	bootstrapSsostyles.css srv195231.hoster-test.ru/firsthorizon/assets/css/	21 KB 22 KB	50ms 49ms	Stylesheet text/css	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/css/bootstrapSsostyles.css Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `22bc90bb7e3234c5f832154d60cf64c31c56a01c54f77146e35c89252c478c4a` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup HIT from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:37 GMT Server Apache/2.2.15 (CentOS) ETag "3d223e2-55f8-60112d06b20b7" X-Cache MISS from t0.hoster.ru Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 22008
GET H/1.1	200 OK	bootstrap-min.css srv195231.hoster-test.ru/firsthorizon/assets/css/	152 KB 153 KB	80ms 48ms	Stylesheet text/css	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/css/bootstrap-min.css Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `9617eab19218e1395aa1232a89cfc7f826aead766974abf00eb5c358ec6f91fe` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup MISS from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:38 GMT Server Apache/2.2.15 (CentOS) ETag "3d223e3-260c2-60112d07411bf" X-Cache MISS from t0.hoster.ru Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 155842
GET H/1.1	200 OK	jquery-ui.min.css srv195231.hoster-test.ru/firsthorizon/assets/css/	30 KB 30 KB	96ms 49ms	Stylesheet text/css	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/css/jquery-ui.min.css Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `9351b3db8e87cc189323e2aa8881ad18fadb6a4d517a1dbb20652bb60875c6a1` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup HIT from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:38 GMT Server Apache/2.2.15 (CentOS) ETag "3d223e4-780a-60112d079bed9" X-Cache MISS from t0.hoster.ru Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 30730
GET H/1.1	200 OK	firstHorizon.png srv195231.hoster-test.ru/firsthorizon/assets/img/	6 KB 6 KB	99ms 52ms	Image image/png	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Show image Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/img/firstHorizon.png Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `b09ad9c8aca2805b1b5188a82531f8b7b78aa11978d4a51e4328ea0031f6c159` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup HIT from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:49 GMT Server Apache/2.2.15 (CentOS) ETag "3d223f5-1839-60112d11dd9fe" X-Cache MISS from t0.hoster.ru Content-Type image/png Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Content-Length 6201 Expires Sun, 23 Jul 2023 14:50:57 GMT
GET H/1.1	200 OK	customer_care.png srv195231.hoster-test.ru/firsthorizon/assets/img/	628 B 1 KB	101ms 52ms	Image image/png	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Show image Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/img/customer_care.png Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `3a450d0385763cdcb2a2b659cd2b797b75f28ae6dc8511a53aa06ade705d8460` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup HIT from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:48 GMT Server Apache/2.2.15 (CentOS) ETag "3d223f3-274-60112d10f7a5b" X-Cache MISS from t0.hoster.ru Content-Type image/png Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Content-Length 628 Expires Sun, 23 Jul 2023 14:50:57 GMT
GET H/1.1	200 OK	equalhousinglender.png srv195231.hoster-test.ru/firsthorizon/assets/img/	681 B 1 KB	102ms 52ms	Image image/png	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Show image Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/img/equalhousinglender.png Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `497a8b2c60d25a444362f7172ba6c13e027594bb78d2ea2fd2e8138d5e46395e` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup HIT from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:48 GMT Server Apache/2.2.15 (CentOS) ETag "3d223f4-2a9-60112d111e770" X-Cache MISS from t0.hoster.ru Content-Type image/png Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Content-Length 681 Expires Sun, 23 Jul 2023 14:50:57 GMT
GET H/1.1	200 OK	memberfdic.png srv195231.hoster-test.ru/firsthorizon/assets/img/	2 KB 2 KB	49ms 49ms	Image image/png	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Show image Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/img/memberfdic.png Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/ Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `6679db44b122009f3917f43f877f42de85b18b9469ce46072a387e6764a32ac5` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup HIT from t0.hoster.ru:6666 Last-Modified Sat, 22 Jul 2023 12:49:49 GMT Server Apache/2.2.15 (CentOS) ETag "3d223f6-78e-60112d11ddde6" X-Cache MISS from t0.hoster.ru Content-Type image/png Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Content-Length 1934 Expires Sun, 23 Jul 2023 14:50:57 GMT
GET H/1.1	404 Not Found	warning.png srv195231.hoster-test.ru/firsthorizon/assets/css/	323 B 323 B	47ms 47ms	Image text/html	31.28.24.131 CITYTELECOM-AS Fi...
General Check archive.org Show headers Download Go to Show image Full URL http://srv195231.hoster-test.ru/firsthorizon/assets/css/warning.png Requested by Host: srv195231.hoster-test.ru URL: http://srv195231.hoster-test.ru/firsthorizon/assets/css/bootstrapSsostyles.css Protocol HTTP/1.1 Server 31.28.24.131 St Petersburg, Russian Federation, ASN29076 (CITYTELECOM-AS Filanco LTD, RU), Reverse DNS c06w.hoster.ru Software Apache/2.2.15 (CentOS) / Resource Hash `b25e5af8f3227fa3951651abdaf7ecf07f5310274d46a98104872988f4d7b2e1` Request headers accept-language de-DE,de;q=0.9 Referer http://srv195231.hoster-test.ru/firsthorizon/assets/css/bootstrapSsostyles.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers Date Sat, 22 Jul 2023 14:50:57 GMT X-Cache-Lookup MISS from t0.hoster.ru:6666 Server Apache/2.2.15 (CentOS) Connection keep-alive Content-Length 323 X-Cache MISS from t0.hoster.ru Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: First Horizon Bank (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://srv195231.hoster-test.ru/firsthorizon/assets/css/warning.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

srv195231.hoster-test.ru
www.horizon-verify.stone-d.net
103.53.192.105
31.28.24.131
22bc90bb7e3234c5f832154d60cf64c31c56a01c54f77146e35c89252c478c4a
3a450d0385763cdcb2a2b659cd2b797b75f28ae6dc8511a53aa06ade705d8460
3ba34e1568acbcad4b9bbee0969b35cb7e5988ef4a2d6b3a74d74cc32a6f351b
497a8b2c60d25a444362f7172ba6c13e027594bb78d2ea2fd2e8138d5e46395e
6679db44b122009f3917f43f877f42de85b18b9469ce46072a387e6764a32ac5
9351b3db8e87cc189323e2aa8881ad18fadb6a4d517a1dbb20652bb60875c6a1
9617eab19218e1395aa1232a89cfc7f826aead766974abf00eb5c358ec6f91fe
b09ad9c8aca2805b1b5188a82531f8b7b78aa11978d4a51e4328ea0031f6c159
b25e5af8f3227fa3951651abdaf7ecf07f5310274d46a98104872988f4d7b2e1

srv195231.hoster-test.ru Open in urlscan Pro 31.28.24.131 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

225 kBTransfer

222 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

srv195231.hoster-test.ru Open in urlscan Pro
31.28.24.131 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

225 kB
Transfer

222 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!