ca-ovh.tk - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 1 HTTP transactions. The main IP is 194.147.85.172, located in Russian Federation and belongs to ASBAXETN, RU. The main domain is ca-ovh.tk.
TLS certificate: Issued by R3 on May 9th 2022. Valid for: 3 months.

This is the only time ca-ovh.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OVH (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	93.89.235.46 93.89.235.46	51557 (TR-ISIMTE...) (TR-ISIMTESCIL-20201202)
2 3	194.147.85.172 194.147.85.172	49392 (ASBAXETN) (ASBAXETN)
1	2

1 93.89.235.46 (Turkey) 1 redirects

ASN51557 (TR-ISIMTESCIL-20201202, TR)
PTR: mail.avrasyamed.com.tr

www.medione.com.tr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 194.147.85.172 (Russian Federation) 2 redirects

ASN49392 (ASBAXETN, RU)

ca-ovh.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ca-ovh.tk 2 redirects ca-ovh.tk	322 KB
1	medione.com.tr 1 redirects www.medione.com.tr	256 B
1	2

	Domain	Requested by
3	ca-ovh.tk	2 redirects
1	www.medione.com.tr	1 redirects
1	2

This site contains links to these domains. Also see Links.

Domain
www.ovh.com

Subject Issuer	Validity	Valid
www.ca-ovh.tk R3	`2022-05-09` - `2022-08-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ca-ovh.tk/PANEL/API/
Frame ID: 343C8D32D2F7E6C00B3833D24D73D959
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Control panel - OVH

Page URL History Show full URLs

https://www.medione.com.tr/OVLA/ HTTP 301
https://ca-ovh.tk/PANEL/?only=ca HTTP 302
https://ca-ovh.tk/PANEL/API HTTP 301
https://ca-ovh.tk/PANEL/API/ Page URL

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

623 kB
Transfer

744 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ovh.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.medione.com.tr/OVLA/ HTTP 301
https://ca-ovh.tk/PANEL/?only=ca HTTP 302
https://ca-ovh.tk/PANEL/API HTTP 301
https://ca-ovh.tk/PANEL/API/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response ca-ovh.tk/PANEL/API/ Redirect Chain https://www.medione.com.tr/OVLA/ https://ca-ovh.tk/PANEL/?only=ca https://ca-ovh.tk/PANEL/API https://ca-ovh.tk/PANEL/API/	433 KB 321 KB	1049ms 1049ms	Document text/html	194.147.85.172 ASBAXETN
General Check archive.org Show headers Download Go to Full URL https://ca-ovh.tk/PANEL/API/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 194.147.85.172 , Russian Federation, ASN49392 (ASBAXETN, RU), Reverse DNS Software Apache/2.4.53 (Unix) OpenSSL/1.0.2k-fips / PHP/5.6.37 Resource Hash `eaa903e9d3a48d51e1449488c7fe231792cca1b6ee058706965bf36c4a35d152` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 accept-language en-CA,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Thu, 19 May 2022 23:34:08 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=98 Pragma no-cache Server Apache/2.4.53 (Unix) OpenSSL/1.0.2k-fips Transfer-Encoding chunked Vary Accept-Encoding,User-Agent X-Powered-By PHP/5.6.37 Redirect headers Connection Keep-Alive Content-Length 236 Content-Type text/html; charset=iso-8859-1 Date Thu, 19 May 2022 23:34:08 GMT Keep-Alive timeout=5, max=99 Location https://ca-ovh.tk/PANEL/API/ Server Apache/2.4.53 (Unix) OpenSSL/1.0.2k-fips
GET DATA	200 OK	truncated /	101 KB 101 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e82bcc30d51744b2de28618535323dd57bc929de0e5bf68df82477cbac7dfcb8` Request headers Referer Origin https://ca-ovh.tk accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	100 KB 100 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c4eadfb32b2464715bb6c4878893cdbf3dfae0bd5fef4eeb63680bf3111d967b` Request headers Referer Origin https://ca-ovh.tk accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	10 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1150eaae722be87d3b4f968c4994a3257b001986ec3c5509527da25b5a236441` Request headers accept-language en-CA,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	101 KB 101 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9a0b54f282e008455908284f30f8ffb89805fcfe4842ab6ef193bc0e74d621b4` Request headers Referer Origin https://ca-ovh.tk accept-language en-CA,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OVH (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ca-ovh.tk/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9uiai3c8imru0nqrb1pu00isn1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ca-ovh.tk
www.medione.com.tr
194.147.85.172
93.89.235.46
1150eaae722be87d3b4f968c4994a3257b001986ec3c5509527da25b5a236441
9a0b54f282e008455908284f30f8ffb89805fcfe4842ab6ef193bc0e74d621b4
c4eadfb32b2464715bb6c4878893cdbf3dfae0bd5fef4eeb63680bf3111d967b
e82bcc30d51744b2de28618535323dd57bc929de0e5bf68df82477cbac7dfcb8
eaa903e9d3a48d51e1449488c7fe231792cca1b6ee058706965bf36c4a35d152

ca-ovh.tk Open in urlscan Pro 194.147.85.172 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

623 kBTransfer

744 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

ca-ovh.tk Open in urlscan Pro
194.147.85.172 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

623 kB
Transfer

744 kB
Size

1
Cookies

1 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!