u848324ops.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::12 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://urlz.fr/dJCs
Effective URL:
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf...
Submission Tags: phishing malicious Search All
Submission: On September 14 via api (September 14th 2020, 8:57:25 pm UTC) from US

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a00:b700::12, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u848324ops.ha004.t.justns.ru.

This is the only time u848324ops.ha004.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3038::681f:bb2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 12	2a00:b700::12 2a00:b700::12	51659 (ASBAXET) (ASBAXET)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
8	2

1 2606:4700:3038::681f:bb2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

urlz.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:b700::12 (Russian Federation) 5 redirects

ASN51659 (ASBAXET, RU)

u848324ops.ha004.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	justns.ru 5 redirects u848324ops.ha004.t.justns.ru	55 KB
1	jquery.com code.jquery.com	30 KB
1	urlz.fr 1 redirects urlz.fr	360 B
8	3

	Domain	Requested by
12	u848324ops.ha004.t.justns.ru	5 redirects u848324ops.ha004.t.justns.ru
1	code.jquery.com	u848324ops.ha004.t.justns.ru
1	urlz.fr	1 redirects
8	3

This site contains no links.

Subject Issuer	Validity	Valid
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c
Frame ID: B17EA20E41BE567675153B8365B65DF1
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://urlz.fr/dJCs HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/ HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8 HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/ HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Page URL
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b... Page URL

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

8
Requests

13 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

83 kB
Transfer

246 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://urlz.fr/dJCs HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/ HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8 HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/ HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Page URL
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://urlz.fr/dJCs HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/ HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8 HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/ HTTP 302
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en HTTP 301
http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Cookie set / Show response u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Redirect Chain https://urlz.fr/dJCs http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/ http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8 http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/ http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/	130 B 512 B	44ms 43ms	Document text/html	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `639bfdd9a4a1897ddf3dfbb18a516f77b8ce26c66f14ad56a70c385dd876c527` Request headers Host u848324ops.ha004.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive Set-Cookie PHPSESSID=3b6fd4fe25e3f6f93e9a04fe26e033a1; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Content-Type text/html; charset=UTF-8 Content-Length 120 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Redirect headers Connection Keep-Alive Content-Type text/html Content-Length 706 Date Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Location http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Vary User-Agent
GET H/1.1	200 OK	Primary Request season.php Show response u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/	17 KB 13 KB	133ms 133ms	Document text/html	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `ab84d16b4d1fd09c4fb3dc9826145939359934266791df7cd414b03e40addd3a` Request headers Host u848324ops.ha004.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Accept-Encoding gzip, deflate Accept-Language en-US Cookie PHPSESSID=3b6fd4fe25e3f6f93e9a04fe26e033a1 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/ Response headers Connection Keep-Alive Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Content-Type text/html; charset=UTF-8 Content-Length 13148 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed
GET H/1.1	200 OK	khawarezmialgo.js Show response u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/js/	9 KB 3 KB	44ms 43ms	Script application/javascript	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/js/khawarezmialgo.js Requested by Host: u848324ops.ha004.t.justns.ru URL: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `e3f56bc0fba0c1492f8f37752fcee5df64e5b6a6c48913b830458833bfb5f5f1` Request headers Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 14 Sep 2020 20:57:09 GMT Content-Encoding gzip Last-Modified Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Etag "251d-5f5fd925-305fd9cca64dad69;gz" Vary Accept-Encoding,User-Agent Content-Type application/javascript Cache-Control public, max-age=604800 Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Expires Mon, 21 Sep 2020 20:57:09 GMT
GET H/1.1	200 OK	contextualLogin.css u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/System/	71 KB 15 KB	43ms 42ms	Stylesheet text/css	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/System/contextualLogin.css Requested by Host: u848324ops.ha004.t.justns.ru URL: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `619a9edccdb77987405af5228e657a079db2a1a3f38d318fa1ae99509c1979f3` Request headers Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 14 Sep 2020 20:57:09 GMT Content-Encoding gzip Last-Modified Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Etag "11c6e-5f5fd925-7c3174b49052f819;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Expires Mon, 21 Sep 2020 20:57:09 GMT
GET H2	200	jquery-3.2.1.min.js Show response code.jquery.com/	85 KB 30 KB	25ms 11ms	Script application/javascript	2001:4de0:ac19::1:b:3a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.min.js Requested by Host: u848324ops.ha004.t.justns.ru URL: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 14 Sep 2020 20:57:09 GMT content-encoding gzip last-modified Mon, 20 Mar 2017 19:01:15 GMT server nginx status 200 etag W/"58d026fb-15283" vary Accept-Encoding x-hw 1600117029.dop203.fr8.t,1600117029.cds208.fr8.hc,1600117029.cds133.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30125
GET H/1.1	200 OK	login.js Show response u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/js/	4 KB 1 KB	85ms 43ms	Script application/javascript	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/js/login.js Requested by Host: u848324ops.ha004.t.justns.ru URL: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `8f35b1256625f54cfd10335977bc5084e99bf196baf786f85d2387abbf6716f4` Request headers Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 14 Sep 2020 20:57:09 GMT Content-Encoding gzip Last-Modified Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Etag "10ba-5f5fd925-aee122d9215559cf;gz" Vary Accept-Encoding,User-Agent Content-Type application/javascript Cache-Control public, max-age=604800 Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Expires Mon, 21 Sep 2020 20:57:09 GMT
GET H/1.1	200 OK	plugins.js Show response u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/js/	55 KB 18 KB	83ms 41ms	Script application/javascript	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/js/plugins.js Requested by Host: u848324ops.ha004.t.justns.ru URL: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `656b81fc8ce755e7cdacde6bcb9e9c2af44902025e0c10cd1ac897ca3945dacb` Request headers Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/season.php?country.x=a2bcc9d15bbbf759cf83e60b4cf81b3ca2bcc9d15bbbf759cf83e60b4cf81b3c User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 14 Sep 2020 20:57:09 GMT Content-Encoding gzip Last-Modified Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Etag "da02-5f5fd925-54a6b51142ca2670;gz" Vary Accept-Encoding,User-Agent Content-Type application/javascript Cache-Control public, max-age=604800 Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Expires Mon, 21 Sep 2020 20:57:09 GMT
GET H/1.1	200 OK	cfpp.svg u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/css/shared/	5 KB 2 KB	42ms 41ms	Image image/svg+xml	2a00:b700::12 ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/css/shared/cfpp.svg Requested by Host: u848324ops.ha004.t.justns.ru URL: http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/System/contextualLogin.css Protocol HTTP/1.1 Server 2a00:b700::12 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `17d949ef8f2a0abe7289d7af4bb7d55fb2e25873adb8567e15ec1133d9388a08` Request headers Referer http://u848324ops.ha004.t.justns.ru/merci/ppl%20fr/4106e8/en/System/contextualLogin.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Mon, 14 Sep 2020 20:57:10 GMT Content-Encoding gzip Last-Modified Mon, 14 Sep 2020 20:57:09 GMT Server LiteSpeed Etag "131a-5f5fd925-9aec021f71543fd;gz" Vary Accept-Encoding,User-Agent Content-Type image/svg+xml Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 2007 Expires Mon, 21 Sep 2020 20:57:10 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			u848324ops.ha004.t.justns.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3b6fd4fe25e3f6f93e9a04fe26e033a1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
u848324ops.ha004.t.justns.ru
urlz.fr
2001:4de0:ac19::1:b:3a
2606:4700:3038::681f:bb2
2a00:b700::12
17d949ef8f2a0abe7289d7af4bb7d55fb2e25873adb8567e15ec1133d9388a08
619a9edccdb77987405af5228e657a079db2a1a3f38d318fa1ae99509c1979f3
639bfdd9a4a1897ddf3dfbb18a516f77b8ce26c66f14ad56a70c385dd876c527
656b81fc8ce755e7cdacde6bcb9e9c2af44902025e0c10cd1ac897ca3945dacb
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8f35b1256625f54cfd10335977bc5084e99bf196baf786f85d2387abbf6716f4
ab84d16b4d1fd09c4fb3dc9826145939359934266791df7cd414b03e40addd3a
e3f56bc0fba0c1492f8f37752fcee5df64e5b6a6c48913b830458833bfb5f5f1

u848324ops.ha004.t.justns.ru Open in urlscan Pro 2a00:b700::12 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

13 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

83 kBTransfer

246 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

1 Cookies

Indicators

u848324ops.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::12 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

13 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

83 kB
Transfer

246 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!