streetservants.com Open in urlscan Pro
192.185.119.94  Malicious Activity! Public Scan

Submitted URL: https://clck.ru/NP8Qm
Effective URL: http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Submission: On June 01 via automatic, source phishtank

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 4 HTTP transactions. The main IP is 192.185.119.94, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is streetservants.com.
This is the only time streetservants.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Standard Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 2a02:6b8::221 13238 (YANDEX)
1 1 2a02:6b8::232 13238 (YANDEX)
1 192.185.119.94 46606 (UNIFIEDLA...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2 2a00:1450:400... 15169 (GOOGLE)
2 4 2a00:1450:400... 15169 (GOOGLE)
4 4
Apex Domain
Subdomains
Transfer
6 google.com
google.com
www.google.com
1 KB
1 googleapis.com
ajax.googleapis.com
30 KB
1 streetservants.com
streetservants.com
1 MB
1 yandex.net
sba.yandex.net
324 B
1 clck.ru
clck.ru
399 B
4 5
Domain Requested by
4 www.google.com 2 redirects streetservants.com
2 google.com 2 redirects
1 ajax.googleapis.com streetservants.com
1 streetservants.com
1 sba.yandex.net 1 redirects
1 clck.ru 1 redirects
4 6

This site contains no links.

Subject Issuer Validity Valid
www.google.com
GTS CA 1O1
2020-05-05 -
2020-07-28
3 months crt.sh

This page contains 3 frames:

Primary Page: http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Frame ID: 94300B9C4B69DCEAAE4A48D2FA60971E
Requests: 13 HTTP requests in this frame

Frame: https://www.google.com/?gws_rd=ssl
Frame ID: 730505F483E4E1BE86222CD0686640C2
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/?gws_rd=ssl
Frame ID: 950DEB84D906BCAFA7B7258DCB3F96A7
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://clck.ru/NP8Qm HTTP 302
    https://sba.yandex.net/redirect?url=http%3A%2F%2Fstreetservants.com%2Fwp-snapshots%2FPayment%2520Co... HTTP 302
    http://streetservants.com/wp-snapshots/Payment%20Confirmation.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

50 %
HTTPS

83 %
IPv6

5
Domains

6
Subdomains

4
IPs

3
Countries

1273 kB
Transfer

3003 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://clck.ru/NP8Qm HTTP 302
    https://sba.yandex.net/redirect?url=http%3A%2F%2Fstreetservants.com%2Fwp-snapshots%2FPayment%2520Confirmation.html&client=clck&sign=baa96ac9dde26f6c27df78dfd4c13519 HTTP 302
    http://streetservants.com/wp-snapshots/Payment%20Confirmation.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • http://google.com/ HTTP 301
  • http://www.google.com/ HTTP 302
  • https://www.google.com/?gws_rd=ssl
Request Chain 12
  • http://google.com/ HTTP 301
  • http://www.google.com/ HTTP 302
  • https://www.google.com/?gws_rd=ssl

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Payment%20Confirmation.html
streetservants.com/wp-snapshots/
Redirect Chain
  • https://clck.ru/NP8Qm
  • https://sba.yandex.net/redirect?url=http%3A%2F%2Fstreetservants.com%2Fwp-snapshots%2FPayment%2520Confirmation.html&client=clck&sign=baa96ac9dde26f6c27df78dfd4c13519
  • http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
2 MB
1 MB
Document
General
Full URL
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Protocol
HTTP/1.1
Server
192.185.119.94 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
192-185-119-94.unifiedlayer.com
Software
Apache /
Resource Hash
b3e4e739b69654c19e64794b7e25c5a21bd0dddbf256e4d1ffceb6ccf70c7dc4

Request headers

Host
streetservants.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 01 Jun 2020 08:01:27 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Last-Modified
Mon, 11 May 2020 08:01:09 GMT
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Keep-Alive
timeout=5, max=75
Transfer-Encoding
chunked
Content-Type
text/html

Redirect headers

Content-Length
339
Content-Type
text/html; charset=utf-8
Date
Mon, 01 Jun 2020 08:01:27 GMT
Location
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Strict-Transport-Security
max-age=3600; includeSubDomains
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/
84 KB
30 KB
Script
General
Full URL
http://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: streetservants.com
URL: http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Protocol
HTTP/1.1
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sun, 17 May 2020 05:10:46 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 03 Mar 2020 19:15:00 GMT
Server
sffe
Age
1306241
Vary
Accept-Encoding
Content-Type
text/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges
bytes
Timing-Allow-Origin
*
Content-Length
30028
X-XSS-Protection
0
Expires
Mon, 17 May 2021 05:10:46 GMT
truncated
/
133 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ed469ac2b6a768d4abac629c5e8789575895428c980fbfe12e5697c365070ca

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
815 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bc7db2f4321427cf9432cc54aa9279a5489c8d704a07a0fcdfcc71d8081ab3af

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
118 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ce8b27c1a3b584fb2a885f37e6ea6311a17bb5024707072ffa8a88ff5dad90e

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
647 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4332865cac365fc9ff02ef855a2776c9b55be980e24de4a10df7264aac86af52

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
84 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8422e770120191902cee354770a45b2978e50d2d4fbc9f9b5f985a18b23e8916

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
12 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/gif
truncated
/
85 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92268fdc9a3d052dbcb1ce93ccf6d682df0f70957fe22b82a84adcb7e31b24fc

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
123 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
90877757aeb6c3b8ee264d8a6f24c21b1cbfad2cb4bb2e9b6a439f90b4a56767

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f8c98548fb3a5835c37ffb7cc2a85e5f28862c85e881e045e618cb369c56c97b

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
129 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
62b0e172787c23a5d95b618b3da78faa3590d359d056196d701e54fc2912ee37

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/jpeg
/
www.google.com/ Frame 7305
Redirect Chain
  • http://google.com/?
  • http://www.google.com/
  • https://www.google.com/?gws_rd=ssl
0
0
Document
General
Full URL
https://www.google.com/?gws_rd=ssl
Requested by
Host: streetservants.com
URL: http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/?gws_rd=ssl
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html

Response headers

status
200
date
Mon, 01 Jun 2020 08:01:28 GMT
expires
-1
cache-control
private, max-age=0
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=31536000
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding
br
server
gws
content-length
64833
x-xss-protection
0
x-frame-options
SAMEORIGIN
set-cookie
1P_JAR=2020-06-01-08; expires=Wed, 01-Jul-2020 08:01:28 GMT; path=/; domain=.google.com; Secure; SameSite=none NID=204=sNMK7llxIz6_g4ipB2Vgn6yInA5t034EnKDZTkMBcCzQz2BG9WJpQLiY_fAJkafS5bHa3styjOAbXjay14qsVkw2srwZqcxCU_ZF4ovU024I7eKZy1s_uLOVYsYbQMzDUHEc-iGASoCh8c4E1DMjJkXMFq41v42evUQz_j6T2cU; expires=Tue, 01-Dec-2020 08:01:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none CONSENT=WP.287610; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.com
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

Location
https://www.google.com/?gws_rd=ssl
Cache-Control
private
Content-Type
text/html; charset=UTF-8
Date
Mon, 01 Jun 2020 08:01:28 GMT
Server
gws
Content-Length
231
X-XSS-Protection
0
X-Frame-Options
SAMEORIGIN
Set-Cookie
1P_JAR=2020-06-01-08; expires=Wed, 01-Jul-2020 08:01:28 GMT; path=/; domain=.google.com; Secure; SameSite=none
/
www.google.com/ Frame 950D
Redirect Chain
  • http://google.com/?
  • http://www.google.com/
  • https://www.google.com/?gws_rd=ssl
0
0
Document
General
Full URL
https://www.google.com/?gws_rd=ssl
Requested by
Host: streetservants.com
URL: http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/?gws_rd=ssl
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html

Response headers

status
200
date
Mon, 01 Jun 2020 08:01:28 GMT
expires
-1
cache-control
private, max-age=0
content-type
text/html; charset=UTF-8
strict-transport-security
max-age=31536000
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding
br
server
gws
content-length
64830
x-xss-protection
0
x-frame-options
SAMEORIGIN
set-cookie
1P_JAR=2020-06-01-08; expires=Wed, 01-Jul-2020 08:01:28 GMT; path=/; domain=.google.com; Secure; SameSite=none NID=204=W4Is6sqWehmqnoeno2s3cULaoOXpZIEPw2Bbum_VQb29Gjki3WyLAK-4v0BGvks00dfJkFVRaMydR9gXMPrk7OXiEny5I4EP_cTqETwN9iw1Z50vvjiy6L5rXyCO2WNBjKmbc7PHWtgGeXcksX1hdZgtX7fbLadiOtCFczGvRf0; expires=Tue, 01-Dec-2020 08:01:28 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none CONSENT=WP.287610; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.com
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

Location
https://www.google.com/?gws_rd=ssl
Cache-Control
private
Content-Type
text/html; charset=UTF-8
Date
Mon, 01 Jun 2020 08:01:28 GMT
Server
gws
Content-Length
231
X-XSS-Protection
0
X-Frame-Options
SAMEORIGIN
Set-Cookie
1P_JAR=2020-06-01-08; expires=Wed, 01-Jul-2020 08:01:28 GMT; path=/; domain=.google.com; Secure; SameSite=none
truncated
/
314 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dd39d839b8f701e426c559dcae87eb66827fb8a72a3fb0bc47d679e580945cc3

Request headers

Referer
http://streetservants.com/wp-snapshots/Payment%20Confirmation.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Standard Bank (Banking)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate string| day string| month string| ampm number| ampmhour number| myweekday number| year object| mydate number| myday number| mymonth number| weekday number| myyear number| myhours number| mytime string| myminutes function| myFunction function| myFunctionn function| myFunctionnn function| myFunctionnnn function| myFunctionnnnn function| myFunctionnnnnn function| myFunctionnnnnnn function| myFunctionnnnnnnn function| myFunctionnnnnnnnn function| myFunctionnnnnnnnnn function| redirect function| $ function| jQuery

3 Cookies

Domain/Path Name / Value
.google.com/ Name: NID
Value: 204=sNMK7llxIz6_g4ipB2Vgn6yInA5t034EnKDZTkMBcCzQz2BG9WJpQLiY_fAJkafS5bHa3styjOAbXjay14qsVkw2srwZqcxCU_ZF4ovU024I7eKZy1s_uLOVYsYbQMzDUHEc-iGASoCh8c4E1DMjJkXMFq41v42evUQz_j6T2cU
.google.com/ Name: CONSENT
Value: WP.287610
.google.com/ Name: 1P_JAR
Value: 2020-06-01-08