u6276137gi.ha003.t.justns.ru Open in urlscan Pro
2a00:b700::2f Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://u6276437gm.ha003.t.justns.ru/presire.php
Effective URL:
http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU
Submission: On February 28 via manual (February 28th 2020, 4:33:22 pm UTC) from FR

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 20 HTTP transactions. The main IP is 2a00:b700::2f, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u6276137gi.ha003.t.justns.ru.

This is the only time u6276137gi.ha003.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2a00:b700::1c 2a00:b700::1c	51659 (ASBAXET) (ASBAXET)
1	2a00:b700::28 2a00:b700::28	51659 (ASBAXET) (ASBAXET)
2 20	2a00:b700::2f 2a00:b700::2f	51659 (ASBAXET) (ASBAXET)
20	3

1 2a00:b700::1c (Russian Federation)

ASN51659 (ASBAXET, RU)

u6276437gm.ha003.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:b700::28 (Russian Federation)

ASN51659 (ASBAXET, RU)

u6276237gk.ha003.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:b700::2f (Russian Federation) 2 redirects

ASN51659 (ASBAXET, RU)

u6276137gi.ha003.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	justns.ru 2 redirects u6276437gm.ha003.t.justns.ru u6276237gk.ha003.t.justns.ru u6276137gi.ha003.t.justns.ru	122 KB
20	1

	Domain	Requested by
20	u6276137gi.ha003.t.justns.ru	2 redirects u6276137gi.ha003.t.justns.ru
1	u6276237gk.ha003.t.justns.ru
1	u6276437gm.ha003.t.justns.ru
20	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU
Frame ID: 47399E3C9C616EE79591E952C66D2FF8
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://u6276437gm.ha003.t.justns.ru/presire.php Page URL
http://u6276237gk.ha003.t.justns.ru/presu.php Page URL
http://u6276137gi.ha003.t.justns.ru/preso HTTP 301
http://u6276137gi.ha003.t.justns.ru/preso/ HTTP 302
http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928B... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

20
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

3
Subdomains

3
IPs

1
Countries

122 kB
Transfer

248 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://u6276437gm.ha003.t.justns.ru/presire.php Page URL
http://u6276237gk.ha003.t.justns.ru/presu.php Page URL
http://u6276137gi.ha003.t.justns.ru/preso HTTP 301
http://u6276137gi.ha003.t.justns.ru/preso/ HTTP 302
http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	presire.php Show response u6276437gm.ha003.t.justns.ru/	85 B 315 B	331ms 42ms	Document text/html	2a00:b700::1c ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276437gm.ha003.t.justns.ru/presire.php Protocol HTTP/1.1 Server 2a00:b700::1c , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `7c9aa1ca8b867655c1ce72e873fd2be858765caa9f7a4abfd3c97394ba43ef46` Request headers Host u6276437gm.ha003.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 98 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Fri, 28 Feb 2020 16:33:04 GMT Server LiteSpeed
GET H/1.1	200 OK	presu.php Show response u6276237gk.ha003.t.justns.ru/	86 B 322 B	242ms 44ms	Document text/html	2a00:b700::28 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276237gk.ha003.t.justns.ru/presu.php Protocol HTTP/1.1 Server 2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `f498f4f01b846b7e126b843e44513bd9451af76ace7f4f33d374b740bfcb3bbe` Request headers Host u6276237gk.ha003.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://u6276437gm.ha003.t.justns.ru/presire.php Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://u6276437gm.ha003.t.justns.ru/presire.php Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 104 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Fri, 28 Feb 2020 16:33:05 GMT Server LiteSpeed
GET H/1.1	200 OK	Primary Request ssl.php Show response u6276137gi.ha003.t.justns.ru/preso/ Redirect Chain http://u6276137gi.ha003.t.justns.ru/preso http://u6276137gi.ha003.t.justns.ru/preso/ http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU	16 KB 5 KB	1048ms 1047ms	Document text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `6c5b4a6b21bd4b6cae49bde18902af1596e2575e0b1ef149454442f75c9a68ea` Request headers Host u6276137gi.ha003.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://u6276237gk.ha003.t.justns.ru/presu.php Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://u6276237gk.ha003.t.justns.ru/presu.php Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 4774 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Fri, 28 Feb 2020 16:33:06 GMT Server LiteSpeed Redirect headers Connection Keep-Alive Location ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Content-Type text/html; charset=UTF-8 Content-Length 0 Date Fri, 28 Feb 2020 16:33:05 GMT Server LiteSpeed Cache-Control no-cache, no-store, must-revalidate, max-age=0 Vary User-Agent
GET H/1.1	200 OK	antiquus.css u6276137gi.ha003.t.justns.ru/preso/img/	26 KB 4 KB	42ms 40ms	Stylesheet text/css	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/antiquus.css Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `a307d1f6262aaa120d2d8d18603e6b0eb9a7f58c2865d689a5a7c2d6b707fbbb` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Content-Encoding gzip Last-Modified Fri, 28 Feb 2020 02:21:55 GMT Server LiteSpeed Etag "66a1-5e587943-bfe9015b7d7df299;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 3739 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	styles.css u6276137gi.ha003.t.justns.ru/preso/img/	80 KB 15 KB	83ms 41ms	Stylesheet text/css	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/styles.css Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `f200b06c8442200a5a36b199ebdfe810115cdb8973df873db4370f6a68239d06` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Content-Encoding gzip Last-Modified Fri, 28 Feb 2020 02:22:05 GMT Server LiteSpeed Etag "13f4d-5e58794d-4ad32402add698b1;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 15362 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	styles-mod.css u6276137gi.ha003.t.justns.ru/preso/img/	14 KB 4 KB	83ms 40ms	Stylesheet text/css	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/styles-mod.css Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `01da4e861e3a45faf7f7cbb6de898ec71b2ad3f85488dca42924305b1d4107eb` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Content-Encoding gzip Last-Modified Fri, 28 Feb 2020 02:22:04 GMT Server LiteSpeed Etag "37e5-5e58794c-4ba2941e62e8f41f;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 3941 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	2.PNG u6276137gi.ha003.t.justns.ru/preso/img/	6 KB 7 KB	84ms 42ms	Image image/png	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/2.PNG Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `46a55e83380d38b850b158ab5a161ed8381be31a83b4ebdb70673d429a66984c` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Last-Modified Fri, 28 Feb 2020 02:21:52 GMT Server LiteSpeed Etag "199f-5e587940-bdcab25ab42756d;;;" Vary User-Agent Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 6559 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	4.PNG u6276137gi.ha003.t.justns.ru/preso/img/	62 KB 62 KB	84ms 42ms	Image image/png	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/4.PNG Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `2a9238404356dd38cde454db089022e19ba6c73641ee7e24a04e9f046e420cdd` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Last-Modified Fri, 28 Feb 2020 02:21:54 GMT Server LiteSpeed Etag "f83f-5e587942-3b27dca232cd1e2c;;;" Vary User-Agent Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 63551 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	1.PNG u6276137gi.ha003.t.justns.ru/preso/img/	5 KB 5 KB	84ms 42ms	Image image/png	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/1.PNG Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `dbfbcbafd2d82f705eb25d811a858ffe6affa7aced9d4c0e0fb826637c8c0e3d` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Last-Modified Fri, 28 Feb 2020 02:21:52 GMT Server LiteSpeed Etag "147d-5e587940-d82e07ae6e712b88;;;" Vary User-Agent Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 5245 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	point_transp.gif u6276137gi.ha003.t.justns.ru/preso/img/	87 B 437 B	41ms 40ms	Image image/gif	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/point_transp.gif Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `7a1a0dc539a9129f3ce1a26e7598a54217d8c8c0291f1a267976dcdad89bbe57` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Last-Modified Fri, 28 Feb 2020 02:22:03 GMT Server LiteSpeed Etag "57-5e58794b-5aa1577a342ececf;;;" Vary User-Agent Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 87 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	3.PNG u6276137gi.ha003.t.justns.ru/preso/img/	3 KB 3 KB	42ms 42ms	Image image/png	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/3.PNG Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `981fc6bc288f27176dfd0511a1ca0e867bf6f63e6e04c076afbb9fe4fdf180af` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:06 GMT Last-Modified Fri, 28 Feb 2020 02:21:53 GMT Server LiteSpeed Etag "c26-5e587941-5fb7bd7d8c648d78;;;" Vary User-Agent Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 3110 Expires Fri, 06 Mar 2020 16:33:06 GMT
GET H/1.1	200 OK	ssl.php u6276137gi.ha003.t.justns.ru/preso/	16 KB 5 KB	899ms 857ms	Stylesheet text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `6c5b4a6b21bd4b6cae49bde18902af1596e2575e0b1ef149454442f75c9a68ea` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 4774 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ssl.php Show response u6276137gi.ha003.t.justns.ru/preso/	16 KB 5 KB	42ms 41ms	Script text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `6c5b4a6b21bd4b6cae49bde18902af1596e2575e0b1ef149454442f75c9a68ea` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 4774 Vary Accept-Encoding,User-Agent Content-Type text/html; charset=UTF-8
GET H/1.1	404 Not Found	main_repeat.png u6276137gi.ha003.t.justns.ru/preso/img/	661 B 661 B	41ms 40ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/main_repeat.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `45f8cd8ef5a8a67ebc071bd5f4ea66c34a5398159f817eac036cf741f58a73cf` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 476 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	entete_light.png u6276137gi.ha003.t.justns.ru/preso/img/	662 B 662 B	42ms 42ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/entete_light.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `196e527f3fe15d2f0fd0ddf5f19a7b8d40ba24df7db0577c1160461edf2ebf75` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles-mod.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 477 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	main_haut.png u6276137gi.ha003.t.justns.ru/preso/img/	659 B 659 B	42ms 42ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/main_haut.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `c116be7913e4062ef8834dd6dbfd63b7d12912e18c3d9cddab2564327d4d92c4` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 474 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	bloc_arrond_bas.png u6276137gi.ha003.t.justns.ru/preso/img/	665 B 665 B	41ms 41ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/bloc_arrond_bas.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `9df9f23d332cbc09937089af9b73a8216387311cf72a2311e4d1c926a0993231` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 480 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	bloc_arrond_haut.png u6276137gi.ha003.t.justns.ru/preso/img/	666 B 666 B	41ms 40ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/bloc_arrond_haut.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `e96ec6919523bd31e6783786714e5f2af18352f1d036aa1e0cf92c72e54d3250` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 481 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	bg_form.png u6276137gi.ha003.t.justns.ru/preso/img/	657 B 657 B	42ms 41ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/bg_form.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `e4b5ec4571509dcdef7d473abd13bd416b33cab44f806537b3a79f2cdbdf79a4` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 472 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	thead.png u6276137gi.ha003.t.justns.ru/preso/img/	655 B 655 B	69ms 40ms	Image text/html	2a00:b700::2f ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u6276137gi.ha003.t.justns.ru/preso/img/thead.png Requested by Host: u6276137gi.ha003.t.justns.ru URL: http://u6276137gi.ha003.t.justns.ru/preso/ssl.php?PaReq=a8f4b2ef1e2374eb0fe37fc0249d1020&MD=782687DB6V279GDH928BUDI2OU Protocol HTTP/1.1 Server 2a00:b700::2f , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `a647c2cb2e9f03df1119aa87ac4af0f35789ee3f0c612c8c18b264b7a82dd98f` Request headers Referer http://u6276137gi.ha003.t.justns.ru/preso/img/styles-mod.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 28 Feb 2020 16:33:07 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 470 Vary Accept-Encoding,User-Agent Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

u6276137gi.ha003.t.justns.ru
u6276237gk.ha003.t.justns.ru
u6276437gm.ha003.t.justns.ru
2a00:b700::1c
2a00:b700::28
2a00:b700::2f
01da4e861e3a45faf7f7cbb6de898ec71b2ad3f85488dca42924305b1d4107eb
196e527f3fe15d2f0fd0ddf5f19a7b8d40ba24df7db0577c1160461edf2ebf75
2a9238404356dd38cde454db089022e19ba6c73641ee7e24a04e9f046e420cdd
45f8cd8ef5a8a67ebc071bd5f4ea66c34a5398159f817eac036cf741f58a73cf
46a55e83380d38b850b158ab5a161ed8381be31a83b4ebdb70673d429a66984c
6c5b4a6b21bd4b6cae49bde18902af1596e2575e0b1ef149454442f75c9a68ea
7a1a0dc539a9129f3ce1a26e7598a54217d8c8c0291f1a267976dcdad89bbe57
7c9aa1ca8b867655c1ce72e873fd2be858765caa9f7a4abfd3c97394ba43ef46
981fc6bc288f27176dfd0511a1ca0e867bf6f63e6e04c076afbb9fe4fdf180af
9df9f23d332cbc09937089af9b73a8216387311cf72a2311e4d1c926a0993231
a307d1f6262aaa120d2d8d18603e6b0eb9a7f58c2865d689a5a7c2d6b707fbbb
a647c2cb2e9f03df1119aa87ac4af0f35789ee3f0c612c8c18b264b7a82dd98f
c116be7913e4062ef8834dd6dbfd63b7d12912e18c3d9cddab2564327d4d92c4
dbfbcbafd2d82f705eb25d811a858ffe6affa7aced9d4c0e0fb826637c8c0e3d
e4b5ec4571509dcdef7d473abd13bd416b33cab44f806537b3a79f2cdbdf79a4
e96ec6919523bd31e6783786714e5f2af18352f1d036aa1e0cf92c72e54d3250
f200b06c8442200a5a36b199ebdfe810115cdb8973df873db4370f6a68239d06
f498f4f01b846b7e126b843e44513bd9451af76ace7f4f33d374b740bfcb3bbe

u6276137gi.ha003.t.justns.ru Open in urlscan Pro 2a00:b700::2f Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

0 %HTTPS

100 %IPv6

1 Domains

3 Subdomains

3 IPs

1 Countries

122 kBTransfer

248 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

47 JavaScript Global Variables

0 Cookies

Indicators

u6276137gi.ha003.t.justns.ru Open in urlscan Pro
2a00:b700::2f Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

3
Subdomains

3
IPs

1
Countries

122 kB
Transfer

248 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!