kinotavr.nichost.ru
Open in
urlscan Pro
194.85.91.70
Malicious Activity!
Public Scan
Submission: On June 27 via automatic, source openphish
Summary
This is the only time kinotavr.nichost.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 194.85.91.70 194.85.91.70 | 25535 (ASN-RUCEN...) (ASN-RUCENTER-HOSTING) | |
1 2 | 2.16.186.80 2.16.186.80 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 52.52.239.73 52.52.239.73 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2.20.188.180 2.20.188.180 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 2 | 35.157.215.255 35.157.215.255 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2.16.186.50 2.16.186.50 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
17 | 6 |
ASN25535 (ASN-RUCENTER-HOSTING, RU)
PTR: kinotavr.nichost.ru
kinotavr.nichost.ru |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-80.deploy.static.akamaitechnologies.com
b.scorecardresearch.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-52-239-73.us-west-1.compute.amazonaws.com
seg.sharethis.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-188-180.deploy.static.akamaitechnologies.com
w.sharethis.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-157-215-255.eu-central-1.compute.amazonaws.com
l.sharethis.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-50.deploy.static.akamaitechnologies.com
edge.sharethis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
nichost.ru
kinotavr.nichost.ru |
410 KB |
5 |
sharethis.com
1 redirects
seg.sharethis.com w.sharethis.com l.sharethis.com edge.sharethis.com |
5 KB |
2 |
scorecardresearch.com
1 redirects
b.scorecardresearch.com |
1 KB |
17 | 3 |
Domain | Requested by | |
---|---|---|
12 | kinotavr.nichost.ru |
kinotavr.nichost.ru
|
2 | l.sharethis.com | 1 redirects |
2 | b.scorecardresearch.com |
1 redirects
kinotavr.nichost.ru
|
1 | edge.sharethis.com |
kinotavr.nichost.ru
|
1 | w.sharethis.com |
kinotavr.nichost.ru
|
1 | seg.sharethis.com |
kinotavr.nichost.ru
|
17 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 4 frames:
Primary Page:
http://kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo!MailUpgrade.html
Frame ID: 75FD7A7F71376BC67F61F0D77E03D1C1
Requests: 13 HTTP requests in this frame
Frame:
http://kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/getSegment.htm
Frame ID: 0B565E213659114AB171C242DE77BCB5
Requests: 2 HTTP requests in this frame
Frame:
http://seg.sharethis.com/getSegment.php?purl=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo!MailUpgrade.html&jsref=&rnd=1530080837798
Frame ID: 2663BAA75B28ABD8F38EE157F464AA1A
Requests: 1 HTTP requests in this frame
Frame:
http://edge.sharethis.com/share4x/index.153077cd0748e8ed1ab600da3c912069.html
Frame ID: 08597BF249BF570006203AF81DD3F98E
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- http://b.scorecardresearch.com/b?c1=7&c2=8097938&rn=452142899&c7=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo%2521%2520Mail%2520Upgrade_files%2FgetSegment.htm&c3=8097938&c8=ShareThis%20Segmenter&c9=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo!MailUpgrade.html&cv=2.2&cs=js HTTP 302
- http://b.scorecardresearch.com/b2?c1=7&c2=8097938&rn=452142899&c7=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo%2521%2520Mail%2520Upgrade_files%2FgetSegment.htm&c3=8097938&c8=ShareThis%20Segmenter&c9=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo!MailUpgrade.html&cv=2.2&cs=js
- http://l.sharethis.com/pview?event=pview&source=share4x&publisher=null&hostname=kinotavr.nichost.ru&location=%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo!MailUpgrade.html&url=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo!MailUpgrade.html&sessionID=1530080837721.60244&fpc=91c867-1643fecc059-3a550bb5-1&ts1530080837798.0 HTTP 301
- http://l.sharethis.com/sc?cm=ZGAHd1szLkUAAAATSoarAw%3D%3D&uid=true&url=http%3A%2F%2Fkinotavr.nichost.ru%2Ftinymce%2Fjscripts%2Ftiny_mce%2FYahoomailupgrading%2FNEWYAHOO%2FYahoo%21MailUpgrade.html
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Yahoo!MailUpgrade.html
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/ |
12 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons.css
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
23 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mail-bg-v3.png
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
paper-hole_v2.png
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
169 KB 169 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jVal.css
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons_002.css
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
17 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
javascriptfunctions.js
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_002.js
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
89 KB 90 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jVal.js
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
8 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons.js
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
45 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yahoolog.png
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
getSegment.htm
kinotavr.nichost.ru/tinymce/jscripts/tiny_mce/Yahoomailupgrading/NEWYAHOO/Yahoo%21%20Mail%20Upgrade_files/ Frame 0B56 |
799 B 1000 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b2
b.scorecardresearch.com/ Frame 0B56 Redirect Chain
|
0 248 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
getSegment.php
seg.sharethis.com/ Frame 2663 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
buttons.css
w.sharethis.com/button/css/ |
22 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sc
l.sharethis.com/ Redirect Chain
|
51 B 51 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.153077cd0748e8ed1ab600da3c912069.html
edge.sharethis.com/share4x/ Frame 0859 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Yahoo (Online)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| startTime object| loadTime object| request number| random_pager function| validateLoginInput function| loginForm function| $ function| jQuery object| cookie boolean| stRecentServices object| betaBlacklist number| rNumFor5x number| testLimitFor5x object| stButtons function| Shareable object| stWidget function| odjs object| jsonp function| shareLog boolean| switchTo5x object| stLight boolean| st_showing function| plusoneCallback2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.nichost.ru/ | Name: __unam Value: 91c867-1643fecc059-3a550bb5-1 |
|
.nichost.ru/ | Name: __switchTo5x Value: 24 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
b.scorecardresearch.com
edge.sharethis.com
kinotavr.nichost.ru
l.sharethis.com
seg.sharethis.com
w.sharethis.com
194.85.91.70
2.16.186.50
2.16.186.80
2.20.188.180
35.157.215.255
52.52.239.73
063fa79fdfb74c97ec80902a50fc478b92a6ad681d94b8776b7c88fe817e5f70
604fb033b645f2b9ae386effd307651e1490676197669f8f595eef529e8fbd0b
822afa8620d12cc8fabc0de752af5e68845457e834b0fc75c3eb6562f0c97c18
9d54ecc6e31c5395d9d35de1ef75e4152c8f9787c511dea5590cea300dfbc07c
a4a09a2806c0bdffdffee03073f56732acba6a435473d227c8c57a9073c41ea8
a65ea805e6801a47485849e2c6668facb5c458ffcad3c60393cb28f63e28cbf9
b35745e800e632b0aa428e986b447dad09c176fad80e0f86c49835d31e12c685
d9ac0cabe482dcbca87e18c9a81e32a8005ee21cce55be9806821d52d857aef9
daa9a7565d6e53d5c8bb9c5117760da97bf488259401444aac11f71abbfa63a6
ddfcde6b3d91c22bf284f701b9d3320512cf8301ee43505abd058d042400e7f6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40949fef718c5b1f84aecec489db51618eee0746343a5745b84caef1f08abfd
ed862c231506f3ee5216049c8af5fc5a1a6c6b47006a92ec5f5e31efbcd57a90
f2b46b60179796b76b63b4d0d08364128a91ed5681cdb857775be64a7fd45134