equipe-supportonline.jelastic.regruhosting.ru
Open in
urlscan Pro
151.248.124.6
Malicious Activity!
Public Scan
URL:
http://equipe-supportonline.jelastic.regruhosting.ru/?xc=c626fc35f170fa9db7657052e
Submission: On November 11 via automatic, source openphish — Scanned from DE
Submission: On November 11 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 2 HTTP transactions.
The main IP is 151.248.124.6, located in
Russian Federation and
belongs to AS-REG, RU.
The main domain is equipe-supportonline.jelastic.regruhosting.ru.
This is the only time equipe-supportonline.jelastic.regruhosting.ru was scanned on urlscan.io!
This is the only time equipe-supportonline.jelastic.regruhosting.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Universo Online (UOL) (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 151.248.124.6 151.248.124.6 | 197695 (AS-REG) (AS-REG) | |
| 2 | 2 |
2
151.248.124.6
(Russian Federation)
ASN197695 (AS-REG, RU)
PTR: mx.jelastic.regruhosting.ru
ASN197695 (AS-REG, RU)
PTR: mx.jelastic.regruhosting.ru
| equipe-supportonline.jelastic.regruhosting.ru |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
regruhosting.ru
equipe-supportonline.jelastic.regruhosting.ru |
375 KB |
| 2 | 1 |
| Domain | Requested by | |
|---|---|---|
| 2 | equipe-supportonline.jelastic.regruhosting.ru |
equipe-supportonline.jelastic.regruhosting.ru
|
| 2 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| email.uol.com.br |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://equipe-supportonline.jelastic.regruhosting.ru/?xc=c626fc35f170fa9db7657052e
Frame ID: E8351019C85F12E04F464224BA5B8EA3
Requests: 9 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: http://email.uol.com.br/bem-vindo?utm_source=Mail-login&utm_medium=link-assineja&utm_campaign=link-mail-login-assine-uolmail
Title: ASSINE JÁ
Title: ASSINE JÁ
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
equipe-supportonline.jelastic.regruhosting.ru/ |
993 KB 188 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
915 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
43 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
equipe-supportonline.jelastic.regruhosting.ru/ |
993 KB 188 KB |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
22 KB 22 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
26 KB 26 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Universo Online (UOL) (Banking)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 function| tudipage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
32 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 1; mode=block; |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
equipe-supportonline.jelastic.regruhosting.ru
151.248.124.6
08107f8fcfab99c13bbcb5684f5e9759784c7d41bda3d3ad5b845a114e95eb78
5690eeba785d13a14fcfc29dc1d7f7c63145b1498d2dce19a50b21bead46252e
84ec47e975583d8e4b9940c573f360105a4701293503ebb3b79bbd1af2815857
b75d97768deedde2829838149f82856789465d957771f78e54644a876626d262
c63635ffe1ea1c4731169ccfa13c0499174c7634d264beb4fca4809b7e75c0ee
cc61ffc97c92ee5ab1a84a7a747f958d274c29cbfb3f6fbac88f21760fef3ce0
ce28772f4e4915bbfd03b3b7d423bab6a633f58abd31ffeaf44cd9835067a570
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
f23aeed1f447c600db47325e6c29cafb3849d6162e822eefbed964b4d7d18399