urlscan.io logo urlscan.io
SecurityTrails logo

lenafish.ru Open in urlscan Pro
2a03:4900:0:6037:80:78:250:176  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://lenafish.ru/wp-media/xls/
Effective URL: http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8...
Submission: On April 02 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 13 HTTP transactions. The main IP is 2a03:4900:0:6037:80:78:250:176, located in Russian Federation and belongs to AGAVA3, RU. The main domain is lenafish.ru.
This is the only time lenafish.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Excel / PDF download (Online)

Domain & IP information

IP Address AS Autonomous System
1 11 2a03:4900:0:6... 43146 (AGAVA3)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
13 5
11    2a03:4900:0:6037:80:78:250:176 (Russian Federation)

ASN43146 (AGAVA3, RU)
lenafish.ru
1    2a00:1450:4001:825::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com
2    2a00:1450:4001:81e::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a00:1450:400c:c08::9b (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
stats.g.doubleclick.net
1    2a00:1450:4001:816::2004 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com
1    2a00:1450:4001:814::2003 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google.de
Apex Domain
Subdomains		 Transfer
11 lenafish.ru
lenafish.ru
202 KB
2 google-analytics.com
www.google-analytics.com
17 KB
1 google.de
www.google.de
109 B
1 google.com
www.google.com
183 B
1 doubleclick.net
stats.g.doubleclick.net
165 B
1 googleapis.com
fonts.googleapis.com
989 B
13 6
Domain Requested by
11 lenafish.ru 1 redirects lenafish.ru
2 www.google-analytics.com 1 redirects lenafish.ru
1 www.google.de lenafish.ru
1 www.google.com 1 redirects
1 stats.g.doubleclick.net 1 redirects
1 fonts.googleapis.com lenafish.ru
13 6

This site contains no links.

Subject Issuer Validity Valid
*.google-analytics.com
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh
www.google.de
Google Internet Authority G3		 2019-03-01 -
2019-05-24		 3 months crt.sh

This page contains 2 frames:

Primary Page: http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Frame ID: FF93DD11B1B51B3EE4EDC8A20FD9FF69
Requests: 4 HTTP requests in this frame

Frame: http://lenafish.ru/wp-media/xls/files/login.php?email=
Frame ID: EBBD997CAB1DDD7739FAF332C61727FC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://lenafish.ru/wp-media/xls/ HTTP 302
    http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d145888927... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

13
Requests

15 %
HTTPS

100 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

219 kB
Transfer

411 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://lenafish.ru/wp-media/xls/ HTTP 302
    http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • http://www.google-analytics.com/ga.js HTTP 307
  • https://www.google-analytics.com/ga.js
Request Chain 12
  • http://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=138119181&utmhn=lenafish.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=520x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1079203945&utmr=0&utmp=%2Fwp-media%2Fxls%2Ffiles%2Flogin.php%3Femail%3D&utmht=1554208362951&utmac=UA-43981329-1&utmcc=__utma%3D170630845.197213370.1554208363.1554208363.1554208363.1%3B%2B__utmz%3D170630845.1554208363.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1324740375&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
  • https://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=138119181&utmhn=lenafish.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=520x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1079203945&utmr=0&utmp=%2Fwp-media%2Fxls%2Ffiles%2Flogin.php%3Femail%3D&utmht=1554208362951&utmac=UA-43981329-1&utmcc=__utma%3D170630845.197213370.1554208363.1554208363.1554208363.1%3B%2B__utmz%3D170630845.1554208363.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1324740375&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181 HTTP 302
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181 HTTP 302
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181&slf_rd=1&random=2899694156

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request owecle29pi4mllemg7x6ibux.php
lenafish.ru/wp-media/xls/
Redirect Chain
  • http://lenafish.ru/wp-media/xls/
  • http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb...
19 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 / PHP/5.3.28
Resource Hash
56b361774ecb1acc55f8268c104af7dabffd5c8f3cc62fb0f51d5a30be7dd38a

Request headers

Host
lenafish.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server
nginx/1.14.0
Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.3.28
Content-Encoding
gzip

Redirect headers

Server
nginx/1.14.0
Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Type
text/html
Content-Length
0
Connection
keep-alive
X-Powered-By
PHP/5.3.28
Location
owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
hack-run.png
lenafish.ru/wp-media/xls/files/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://lenafish.ru/wp-media/xls/files/hack-run.png
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
6903fa3a18aa5c61b38ad74e21a448658c1a6958c26621b01589de6d8cedf907

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
"47c2107-612b-585832562df80"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
24875
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5

Request headers

Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/png
login.php
lenafish.ru/wp-media/xls/files/ Frame EBBD 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login.php?email=
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 / PHP/5.3.28
Resource Hash
f8e804c21ae38872c59068dc5c1e26f0f0a0e739089d128e58cd80252f4570cd

Request headers

Host
lenafish.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=

Response headers

Server
nginx/1.14.0
Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/5.3.28
Content-Encoding
gzip
pobg.gif
lenafish.ru/wp-media/xls/ 		86 KB
86 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://lenafish.ru/wp-media/xls/pobg.gif
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
ba5552671ab21fcd700ae03b27040ffac6779c96f5482e32489b70ea5186f850

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/owecle29pi4mllemg7x6ibux.php?159b011554208362ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81ea61f8f7d14588892705e5bb520d1e81&email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
"47c2113-1561e-585832562df80"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
87582
ga_003.js
lenafish.ru/wp-media/xls/files/login_data/ Frame EBBD 		42 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login_data/ga_003.js
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
4e2ed635abf0b2dcbac3ea04d16ccf58bb2195364d65b76190f03da0f43255c5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
W/"47c210d-a84a-585832562df80"
Transfer-Encoding
chunked
Content-Type
application/javascript
Connection
keep-alive
ga_002.js
lenafish.ru/wp-media/xls/files/login_data/ Frame EBBD 		42 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login_data/ga_002.js
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
4e2ed635abf0b2dcbac3ea04d16ccf58bb2195364d65b76190f03da0f43255c5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
W/"47c210c-a84a-585832562df80"
Transfer-Encoding
chunked
Content-Type
application/javascript
Connection
keep-alive
ga.js
lenafish.ru/wp-media/xls/files/login_data/ Frame EBBD 		42 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login_data/ga.js
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
4e2ed635abf0b2dcbac3ea04d16ccf58bb2195364d65b76190f03da0f43255c5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
W/"47c210b-a84a-585832562df80"
Transfer-Encoding
chunked
Content-Type
application/javascript
Connection
keep-alive
jquery.js
lenafish.ru/wp-media/xls/files/login_data/ Frame EBBD 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login_data/jquery.js
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
W/"47c210e-1787d-585832562df80"
Transfer-Encoding
chunked
Content-Type
application/javascript
Connection
keep-alive
jquery_popup.css
lenafish.ru/wp-media/xls/files/login_data/ Frame EBBD 		2 KB
1018 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login_data/jquery_popup.css
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
b1dbe2cdf1aff375b2420bd518650d07a6614455528e2f9400c99a74e4b57dc0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
W/"47c210f-8b7-585832562df80"
Transfer-Encoding
chunked
Content-Type
text/css
Connection
keep-alive
jquery_popup.js
lenafish.ru/wp-media/xls/files/login_data/ Frame EBBD 		2 KB
844 B 		Script
General
Check archive.org
Download Go to
Full URL
http://lenafish.ru/wp-media/xls/files/login_data/jquery_popup.js
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a03:4900:0:6037:80:78:250:176 , Russian Federation, ASN43146 (AGAVA3, RU),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
cc9fcc5704f38ab13ae1e696fd45ace331092435101ab4a0f186aabca19bd230

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
lenafish.ru
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
Connection
keep-alive
Cache-Control
no-cache
Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 02:46:38 GMT
Server
nginx/1.14.0
ETag
W/"47c2110-70f-585832562df80"
Transfer-Encoding
chunked
Content-Type
application/javascript
Connection
keep-alive
css
fonts.googleapis.com/ Frame EBBD 		2 KB
989 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://fonts.googleapis.com/css?family=Fauna+One|Muli
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
HTTP/1.1
Server
2a00:1450:4001:825::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
3c1a8886273c116919d68f0aa1e72a90f4bcc9da531bb1d048486f86d529ca03
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 02 Apr 2019 12:32:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Apr 2019 12:32:42 GMT
Server
ESF
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding
chunked
Timing-Allow-Origin
*
Link
<http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection
1; mode=block
Expires
Tue, 02 Apr 2019 12:32:42 GMT
ga.js
www.google-analytics.com/ Frame EBBD
Redirect Chain
  • http://www.google-analytics.com/ga.js
  • https://www.google-analytics.com/ga.js
45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/ga.js
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:81e::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Jan 2019 20:01:45 GMT
server
Golfe2
age
4029
date
Tue, 02 Apr 2019 11:25:33 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
17168
expires
Tue, 02 Apr 2019 13:25:33 GMT

Redirect headers

Location
https://www.google-analytics.com/ga.js
Non-Authoritative-Reason
HSTS
ga-audiences
www.google.de/ads/ Frame EBBD
Redirect Chain
  • http://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=138119181&utmhn=lenafish.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=520x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1079203945&...
  • https://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=138119181&utmhn=lenafish.ru&utmcs=UTF-8&utmsr=1600x1200&utmvp=520x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1079203945...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181
  • https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181
  • https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181&slf_rd=1&random=2899694156
42 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181&slf_rd=1&random=2899694156
Requested by
Host: lenafish.ru
URL: http://lenafish.ru/wp-media/xls/files/login.php?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:814::2003 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Apr 2019 12:32:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 02 Apr 2019 12:32:43 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=197213370.1554208363&jid=1324740375&_v=5.6.7&z=138119181&slf_rd=1&random=2899694156
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,44,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
truncated
/ Frame EBBD 		622 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
82f04c5d953b2ccb07f301b00299566e9a6efcc00a654259cd44ca71bb4db7fb

Request headers

Referer
http://lenafish.ru/wp-media/xls/files/login.php?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Excel / PDF download (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| validateForm number| myVar function| myFunction function| showPage

5 Cookies

Domain/Path Name / Value
.lenafish.ru/ Name: __utmb
Value: 170630845.1.10.1554208363
.lenafish.ru/ Name: __utmt
Value: 1
.lenafish.ru/ Name: __utmc
Value: 170630845
.lenafish.ru/ Name: __utmz
Value: 170630845.1554208363.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.lenafish.ru/ Name: __utma
Value: 170630845.197213370.1554208363.1554208363.1554208363.1