ddutkl.spb.ru Open in urlscan Pro
195.208.1.103 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ddutkl.spb.ru/Nz
Effective URL:
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en
Submission: On May 31 via manual (May 31st 2018, 12:06:45 pm UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 195.208.1.103, located in Russian Federation and belongs to ASN-RUCENTER-HOSTING, RU. The main domain is ddutkl.spb.ru.

This is the only time ddutkl.spb.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
4 14	195.208.1.103 195.208.1.103		25535 (ASN-RUCEN...) (ASN-RUCENTER-HOSTING)
1	2.18.232.136 2.18.232.136		16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
11	2

14 195.208.1.103 (Russian Federation) 4 redirects

ASN25535 (ASN-RUCENTER-HOSTING, RU)
PTR: std-carp3-http.nic.ru

ddutkl.spb.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.136 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-136.deploy.static.akamaitechnologies.com

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	spb.ru 4 redirects ddutkl.spb.ru	189 KB
1	nflxext.com assets.nflxext.com	85 KB
11	2

	Domain	Requested by
14	ddutkl.spb.ru	4 redirects ddutkl.spb.ru
1	assets.nflxext.com	ddutkl.spb.ru
11	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en
Frame ID: F536387BB4C5934040291ED286F0D58D
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ddutkl.spb.ru/Nz HTTP 301
http://ddutkl.spb.ru/Nz/ HTTP 302
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082 HTTP 301
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/ HTTP 302
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

11
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

272 kB
Transfer

543 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ddutkl.spb.ru/Nz HTTP 301
http://ddutkl.spb.ru/Nz/ HTTP 302
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082 HTTP 301
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/ HTTP 302
http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request signin.php Show response ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/ Redirect Chain http://ddutkl.spb.ru/Nz http://ddutkl.spb.ru/Nz/ http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082 http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/ http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en	4 KB 2 KB	93ms 93ms	Document text/html	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / PHP/5.3.29 Resource Hash `68d06428eca2775e2c971cb7f777381f99296991734f03ed06770a12b8d5af7e` Request headers Host ddutkl.spb.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 X-DevTools-Emulate-Network-Conditions-Client-Id F536387BB4C5934040291ED286F0D58D Response headers Server nginx/1.10.1 Date Thu, 31 May 2018 12:06:33 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding X-Powered-By PHP/5.3.29 Content-Encoding gzip Redirect headers Server nginx/1.10.1 Date Thu, 31 May 2018 12:06:33 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive X-Powered-By PHP/5.3.29 Set-Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache location signin.php?country=DE-Germany&lang=en
GET H/1.1	200 OK	bootstrap.min.css ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	147 KB 20 KB	95ms 95ms	Stylesheet text/css	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/bootstrap.min.css Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/css,/;q=0.1 Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag W/"24dd4-56d7f4c5221da" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=1209600 Transfer-Encoding chunked Connection keep-alive Expires Thu, 14 Jun 2018 12:06:33 GMT
GET H/1.1	200 OK	font-awesome.min.css ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	30 KB 7 KB	236ms 190ms	Stylesheet text/css	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/font-awesome.min.css Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `7d3ed5e7e4c4aafe8c1f5d004e7eee33b5887117d2125848352a2cda86dd7ed0` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/css,/;q=0.1 Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag W/"78e2-56d7f4c52317a" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=1209600 Transfer-Encoding chunked Connection keep-alive Expires Thu, 14 Jun 2018 12:06:33 GMT
GET H/1.1	200 OK	master.css ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	11 KB 3 KB	357ms 308ms	Stylesheet text/css	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/master.css Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `86a09886b58f70a5ae1e84c22882cdd5bec7c84af1aeb75ac55c5bcde8773201` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept text/css,/;q=0.1 Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag W/"2c59-56d7f4c52411a" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=1209600 Transfer-Encoding chunked Connection keep-alive Expires Thu, 14 Jun 2018 12:06:33 GMT
GET H/1.1	200 OK	jquery-3.1.1.slim.min.js Show response ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	95 KB 34 KB	363ms 314ms	Script application/javascript	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/jquery-3.1.1.slim.min.js Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `28cb3cf3a0253d7f0aecf2f52159dfc6cb9bca679a5011ff19cb30b9c52cbcfa` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept / Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag W/"17b57-56d7f4c52317a" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=1209600 Transfer-Encoding chunked Connection keep-alive Expires Thu, 14 Jun 2018 12:06:33 GMT
GET H/1.1	200 OK	tether.min.js Show response ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	24 KB 8 KB	237ms 187ms	Script application/javascript	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/tether.min.js Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept / Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag W/"619d-56d7f4c5250ba" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=1209600 Transfer-Encoding chunked Connection keep-alive Expires Thu, 14 Jun 2018 12:06:33 GMT
GET H/1.1	200 OK	bootstrap.min.js Show response ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	46 KB 12 KB	479ms 427ms	Script application/javascript	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/bootstrap.min.js Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept / Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag W/"b63d-56d7f4c5221da" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=1209600 Transfer-Encoding chunked Connection keep-alive Expires Thu, 14 Jun 2018 12:06:33 GMT
GET H/1.1	200 OK	footerlogin.png ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	6 KB 6 KB	148ms 148ms	Image image/png	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Show image Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/footerlogin.png Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `361be9f4111800b0968c8cfbd8923626670e9a186f593b9b5d3e32bb446d1602` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers Date Thu, 31 May 2018 12:06:33 GMT Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag "181c-56d7f4c52317a" Content-Type image/png Cache-Control max-age=1209600 Connection keep-alive Accept-Ranges bytes Content-Length 6172 Expires Thu, 14 Jun 2018 12:06:33 GMT
GET S	200	login-the-crown_2-1500x1000.jpg assets.nflxext.com/ffe/siteui/acquisition/login/	84 KB 85 KB	26ms 6ms	Image image/jpeg	2.18.232.136 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol SPDY Server 2.18.232.136 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-232-136.deploy.static.akamaitechnologies.com Software Apache / Resource Hash `baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04` Request headers Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/master.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Response headers date Thu, 31 May 2018 12:06:33 GMT last-modified Mon, 24 Oct 2016 20:49:51 GMT server Apache content-md5 5GY/BZWwL7HDlH/B8V64Eg== content-type image/jpeg status 200 cache-control public, max-age=59212407 accept-ranges bytes content-length 86226 expires Wed, 15 Apr 2020 20:00:00 GMT
GET H/1.1	404 Not Found	Cookie set fontawesome-webfont.woff2 ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	0 0	866ms 866ms	Font text/html	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / PHP/5.3.29 Resource Hash Request headers Pragma no-cache Origin http://ddutkl.spb.ru Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept / Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/font-awesome.min.css Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/font-awesome.min.css Origin http://ddutkl.spb.ru Response headers Date Thu, 31 May 2018 12:06:34 GMT Content-Encoding gzip Last-Modified Thu, 31 May 2018 12:06:33 +0000 Server nginx/1.10.1 X-Powered-By PHP/5.3.29 ETag W/"1527768393" Vary Accept-Encoding Connection keep-alive Content-Language ru X-Generator Drupal 7 (http://drupal.org) Cache-Control no-cache, must-revalidate, post-check=0, pre-check=0 Transfer-Encoding chunked Set-Cookie textsize=76; expires=Fri, 31-May-2019 12:06:34 GMT; path=/ SESSddccc6e529f168b7b586f4e6f410838f=m4eqOq8Vu7KrSSvxdRCp5ToWSL1GF01idppWyTt19VE; expires=Sat, 23-Jun-2018 15:39:54 GMT; path=/; domain=.ddutkl.spb.ru; HttpOnly Content-Type text/html; charset=utf-8 Expires Sun, 19 Nov 1978 05:00:00 GMT
GET H/1.1	200 OK	fontawesome-webfont.woff ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/	96 KB 96 KB	491ms 490ms	Font application/font-woff	195.208.1.103 ASN-RUCENTER-HOSTING
General Check archive.org Show headers Download Go to Full URL http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/fontawesome-webfont.woff?v=4.7.0 Requested by Host: ddutkl.spb.ru URL: http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/signin.php?country=DE-Germany&lang=en Protocol HTTP/1.1 Server 195.208.1.103 , Russian Federation, ASN25535 (ASN-RUCENTER-HOSTING, RU), Reverse DNS std-carp3-http.nic.ru Software nginx/1.10.1 / Resource Hash `ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07` Request headers Pragma no-cache Origin http://ddutkl.spb.ru Accept-Encoding gzip, deflate Host ddutkl.spb.ru User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Accept / Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/font-awesome.min.css Cookie PHPSESSID=aef64c579f0c6a78e9d2bb17505d164e; textsize=76; SESSddccc6e529f168b7b586f4e6f410838f=m4eqOq8Vu7KrSSvxdRCp5ToWSL1GF01idppWyTt19VE Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36 Referer http://ddutkl.spb.ru/Nz/2290a7385ed77cc5592dc2153229f082/assets/font-awesome.min.css Origin http://ddutkl.spb.ru Response headers Date Thu, 31 May 2018 12:06:35 GMT Last-Modified Thu, 31 May 2018 12:06:32 GMT Server nginx/1.10.1 ETag "17ee8-56d7f4c52317a" Content-Type application/font-woff Cache-Control max-age=1209600 Connection keep-alive Accept-Ranges bytes Content-Length 98024 Expires Thu, 14 Jun 2018 12:06:34 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| Tether object| jQuery11220052013353623381775

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ddutkl.spb.ru/	1970-01-18 16:56:08	Name: SESSddccc6e529f168b7b586f4e6f410838f Value: m4eqOq8Vu7KrSSvxdRCp5ToWSL1GF01idppWyTt19VE
			ddutkl.spb.ru/	1970-01-19 01:08:24	Name: textsize Value: 76
			ddutkl.spb.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: aef64c579f0c6a78e9d2bb17505d164e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
ddutkl.spb.ru
195.208.1.103
2.18.232.136
28cb3cf3a0253d7f0aecf2f52159dfc6cb9bca679a5011ff19cb30b9c52cbcfa
361be9f4111800b0968c8cfbd8923626670e9a186f593b9b5d3e32bb446d1602
68d06428eca2775e2c971cb7f777381f99296991734f03ed06770a12b8d5af7e
7d3ed5e7e4c4aafe8c1f5d004e7eee33b5887117d2125848352a2cda86dd7ed0
80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f
86a09886b58f70a5ae1e84c22882cdd5bec7c84af1aeb75ac55c5bcde8773201
aebf611c1438dc7ec748e9a6364c734066b34bf2a1c7e2fc6511ed784635b50e
ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
fa421b6ebbd2fb474d3a3866409ce6c1efd120b47ff256fffb8f8f50d556d3d9