urlscan.io logo urlscan.io
SecurityTrails logo

u962785a32.ha005.t.justns.ru Open in urlscan Pro
185.22.155.72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.checkovhwebsrv.com/
Effective URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Submission Tags: 6892681
Submission: On December 16 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 185.22.155.72, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u962785a32.ha005.t.justns.ru.
This is the only time u962785a32.ha005.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OVH (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2a00:1450:400... 15169 (GOOGLE)
9 185.22.155.72 51659 (ASBAXET)
9 1
Apex Domain
Subdomains		 Transfer
9 justns.ru
u962785a32.ha005.t.justns.ru
45 KB
1 checkovhwebsrv.com
www.checkovhwebsrv.com
327 B
9 2
Domain Requested by
9 u962785a32.ha005.t.justns.ru u962785a32.ha005.t.justns.ru
1 www.checkovhwebsrv.com 1 redirects
9 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Frame ID: B72BC9680340087BAEAF98E1B7E313E1
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://www.checkovhwebsrv.com/ HTTP 301
    http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellemen... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

9
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

45 kB
Transfer

58 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.checkovhwebsrv.com/ HTTP 301
    http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Redirect Chain
  • http://www.checkovhwebsrv.com/
  • http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
9 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
2d9d3622f80fe138c59fc0730225b03cbb558995585aa7f314d027bbd3e4bca5

Request headers

Host
u962785a32.ha005.t.justns.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
2231
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Date
Wed, 16 Dec 2020 15:00:26 GMT
Server
LiteSpeed

Redirect headers

Location
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Date
Wed, 16 Dec 2020 15:00:25 GMT
Content-Type
text/html; charset=UTF-8
Server
ghs
Content-Length
317
X-XSS-Protection
0
X-Frame-Options
SAMEORIGIN
share.css
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/share.css
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
bf37191c7bdaa02a918f3fa966e759b281ee0ee22493cea95e169574af143925

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Dec 2020 23:13:22 GMT
Server
LiteSpeed
Etag
"11c7-5fd94312-182227fe024a5332;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1621
Expires
Wed, 23 Dec 2020 15:00:26 GMT
mediabox.css
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/mediabox.css
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
0b2ef4f5ef58468bda5984946e3320a0095280d19c5de019b3b48c2522a7de2c

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Dec 2020 23:13:19 GMT
Server
LiteSpeed
Etag
"16fb-5fd9430f-a0a0fbe1dd0b44af;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2067
Expires
Wed, 23 Dec 2020 15:00:26 GMT
osp.js
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/osp.js
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
1b5cce25d5b88052cc3b382c4169df3ca5cd514733f8fceb6c459d07a02116a3

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Content-Encoding
gzip
Last-Modified
Tue, 15 Dec 2020 23:13:19 GMT
Server
LiteSpeed
Etag
"dfa-5fd9430f-d135f897c1c0e8fb;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1042
Expires
Wed, 23 Dec 2020 15:00:26 GMT
logo.png
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/logo.png
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
deedc1faecf1f585890bb43e5d2cabe5fb9f9365609a68931f7387bc11ba8cac

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Last-Modified
Tue, 15 Dec 2020 23:13:16 GMT
Server
LiteSpeed
Etag
"1284-5fd9430c-3349003396b4bf09;;;"
Vary
User-Agent
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4740
Expires
Wed, 23 Dec 2020 15:00:26 GMT
CB.gif
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/CB.gif
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
bd5cb34d06ea58c1f7d9af7e7095db28f481eb40c5a6900abefb79886614c23a

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Last-Modified
Tue, 15 Dec 2020 23:13:12 GMT
Server
LiteSpeed
Etag
"618-5fd94308-64fe990204fd52b3;;;"
Vary
User-Agent
Content-Type
image/gif
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1560
Expires
Wed, 23 Dec 2020 15:00:26 GMT
VISA.png
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/VISA.png
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
65d212e6fdad69835e39d2ffd7bd334c1a7f5c04fd1c58e78cab4b0a82207407

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Last-Modified
Tue, 15 Dec 2020 23:13:26 GMT
Server
LiteSpeed
Etag
"ae2-5fd94316-b00f77703cbac94f;;;"
Vary
User-Agent
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2786
Expires
Wed, 23 Dec 2020 15:00:26 GMT
MASTERCARD.png
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/MASTERCARD.png
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
e543dc00a143cd3fd077da005c3fa2e8564aad9f712e45e826959f29f36bb383

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Last-Modified
Tue, 15 Dec 2020 23:13:18 GMT
Server
LiteSpeed
Etag
"1229-5fd9430e-87a4fd967354e8ad;;;"
Vary
User-Agent
Content-Type
image/png
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4649
Expires
Wed, 23 Dec 2020 15:00:26 GMT
cvv.jpg
u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/files/cvv.jpg
Requested by
Host: u962785a32.ha005.t.justns.ru
URL: http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
Protocol
HTTP/1.1
Server
185.22.155.72 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
a458b1def189d665001ace859e247304bca3ffb370452894d68fb2f5907eefa5

Request headers

Referer
http://u962785a32.ha005.t.justns.ru/activatiobwebenligne1HGFOIUYTRQSDQSDXCVBNFGFSDFGHDXF/ovhdomainerenouvellementip2020/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 16 Dec 2020 15:00:26 GMT
Last-Modified
Tue, 15 Dec 2020 23:13:12 GMT
Server
LiteSpeed
Etag
"5767-5fd94308-d54f112b31cad9e7;;;"
Vary
User-Agent
Content-Type
image/jpeg
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
22375
Expires
Wed, 23 Dec 2020 15:00:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OVH (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| validateLuhnCode function| onCardNumberChange function| isCardHolderValid function| onCardHolderChange function| real_cardNumberChange function| checkFormSubmit

0 Cookies