urlscan.io logo urlscan.io
SecurityTrails logo

agrodom-group.ru Open in urlscan Pro
31.31.196.77  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Submission: On April 01 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 31.31.196.77, located in Russian Federation and belongs to AS-REG, RU. The main domain is agrodom-group.ru.
TLS certificate: Issued by GlobalSign Domain Validation CA - SHA... on February 5th 2019. Valid for: a year.
This is the only time agrodom-group.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PostFinance (Banking)

Domain & IP information

IP Address AS Autonomous System
8 31.31.196.77 197695 (AS-REG)
1 194.126.144.121 34960 (NETCETERA...)
9 2
Apex Domain
Subdomains		 Transfer
8 agrodom-group.ru
agrodom-group.ru
33 KB
1 postfinance.ch
3dsec.postfinance.ch
2 KB
9 2
Domain Requested by
8 agrodom-group.ru agrodom-group.ru
1 3dsec.postfinance.ch agrodom-group.ru
9 2

This site contains no links.

Subject Issuer Validity Valid
www.agrodom-group.ru
GlobalSign Domain Validation CA - SHA256 - G2		 2019-02-05 -
2020-02-06		 a year crt.sh
3dsec.postfinance.ch
SwissSign EV Gold CA 2014 - G22		 2017-12-20 -
2019-12-20		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Frame ID: 46384F64482E1FF9EAEE3EBC9AC46432
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

36 kB
Transfer

116 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		47 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx / PHP/5.6.36
Resource Hash
36336cc86ee3e8d8f6a8221978cad74eaea3232d0772172d6b3ead5a14784814
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff

Request headers

:method
GET
:authority
agrodom-group.ru
:scheme
https
:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
server
nginx
date
Mon, 01 Apr 2019 06:36:44 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
x-powered-by
PHP/5.6.36
x-content-type-options
nosniff
strict-transport-security
max-age=31536000;
content-encoding
gzip
ubs_styles.css
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		49 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ubs_styles.css
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx /
Resource Hash
0fce4e4dfc91ee6582dd99012d6f12b65387afc838249818d2c947c21ee9047b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ubs_styles.css
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
content-encoding
gzip
last-modified
Sun, 31 Mar 2019 11:21:33 GMT
server
nginx
etag
W/"5ca0a2bd-c30d"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
max-age=604800
strict-transport-security
max-age=31536000;
expires
Mon, 08 Apr 2019 06:36:45 GMT
x-out.js
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/x-out.js
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx /
Resource Hash
63c51c4519a5544b8568054e5a18b474a6d3e54dea106a9e31a30327c5e10148
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/x-out.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
content-encoding
gzip
last-modified
Sun, 31 Mar 2019 11:21:33 GMT
server
nginx
etag
W/"5ca0a2bd-eed"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
strict-transport-security
max-age=31536000;
expires
Mon, 08 Apr 2019 06:36:45 GMT
pwdbase.js
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/pwdbase.js
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx /
Resource Hash
c70e0f42e0ec23f645a005664a2a66453703ac4da0b2b3b2b7c8bb6976bba6f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/pwdbase.js
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
content-encoding
gzip
last-modified
Sun, 31 Mar 2019 11:21:33 GMT
server
nginx
etag
W/"5ca0a2bd-14de"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
max-age=604800
strict-transport-security
max-age=31536000;
expires
Mon, 08 Apr 2019 06:36:45 GMT
spacer_clear.gif
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		43 B
246 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/spacer_clear.gif
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/spacer_clear.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
last-modified
Sun, 31 Mar 2019 11:21:33 GMT
server
nginx
etag
"5ca0a2bd-2b"
strict-transport-security
max-age=31536000;
content-type
image/gif
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
43
expires
Mon, 08 Apr 2019 06:36:45 GMT
img_pf_logo_en.jpg
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/img_pf_logo_en.jpg
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx /
Resource Hash
7a2e51c437a5979274f967605336a7c23acffcd6c4990ea41a1d9915978969f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/img_pf_logo_en.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
last-modified
Sun, 31 Mar 2019 11:21:33 GMT
server
nginx
etag
"5ca0a2bd-1540"
strict-transport-security
max-age=31536000;
content-type
image/jpeg
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
5440
expires
Mon, 08 Apr 2019 06:36:45 GMT
visa-logo.gif
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/visa-logo.gif
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx /
Resource Hash
857186c4491b75fe67d8d302a66d4064b20f12ee15285f9717b71f5a5717dbb5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/visa-logo.gif
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
last-modified
Sun, 31 Mar 2019 11:21:33 GMT
server
nginx
etag
"5ca0a2bd-f63"
strict-transport-security
max-age=31536000;
content-type
image/gif
status
200
cache-control
max-age=604800
accept-ranges
bytes
content-length
3939
expires
Mon, 08 Apr 2019 06:36:45 GMT
info_mouseover.gif
3dsec.postfinance.ch/acspage/de_DE_base_postfinance/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://3dsec.postfinance.ch/acspage/de_DE_base_postfinance/images/info_mouseover.gif
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
194.126.144.121 Glattfelden, Switzerland, ASN34960 (NETCETERA-AG-AS, CH),
Reverse DNS
3dsec.postfinance.ch
Software
Apache /
Resource Hash
fd86b378b051670c5b8f43d3f539a30588c16b7413fb6b963a5819cefcbc1932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Mon, 01 Apr 2019 06:36:45 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 18 Mar 2019 10:53:41 GMT
Server
Apache
ETag
"6d5-5845c339ef43b"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=10, max=500
Content-Length
1749
X-XSS-Protection
1; mode=block
img_pf_logo_en.jpg
agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/images/ 		360 B
360 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/images/img_pf_logo_en.jpg
Requested by
Host: agrodom-group.ru
URL: https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
31.31.196.77 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
server214.hosting.reg.ru
Software
nginx / PHP/5.6.36
Resource Hash
5bbc6822e1ed71dae86bc31c2eb3279c12541e11e55d36050665cfaf4436ea6f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

:path
/imgss/rien/facture/disponible/0a512b4dfb6924f/login/images/img_pf_logo_en.jpg
pragma
no-cache
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
agrodom-group.ru
referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ubs_styles.css
:scheme
https
:method
GET
Referer
https://agrodom-group.ru/imgss/rien/facture/disponible/0a512b4dfb6924f/login/ubs_styles.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 01 Apr 2019 06:36:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
nginx
x-powered-by
PHP/5.6.36
x-frame-options
SAMEORIGIN
content-language
ru
status
404
cache-control
no-cache, must-revalidate
content-type
text/html; charset=utf-8
vary
Accept-Encoding
expires
Sun, 19 Nov 1978 05:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PostFinance (Banking)

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask boolean| CAPTURE_XOUT boolean| TRAP_RIGHT_CLICK number| KEY_F5 number| KEY_LEFT number| KEY_HOME number| KEY_R number| BTN_RIGHT boolean| isNS boolean| isIE boolean| isNS4 string| formTags function| gatherFormData function| onUnloadHandler function| OnClickHandler function| onDocClick function| onDocKeyDown function| ChipCardInAuthList function| ChipCardSelected function| CanFallBack function| AuthSelectExists function| SecurityWindow function| HelpWindow function| IsNetscapeOnSolaris function| OnCancelHandler function| OnCancelHandler2 function| OnSubmitHandler function| letterNumber function| SetSubmit function| ResetSubmit function| ClearPin function| OnFPWDHandler boolean| refreshing boolean| navigating boolean| closing string| tocName boolean| IsCancelButton string| optinLang function| OnPageInit function| ForceCancel function| OpenWindow function| tandcWindow function| infoU function| onBeforeUnloadHandler function| onFocusHandler function| OnLocaleChange object| loadError function| objError function| validateNotEmpty function| trimAll function| OnUserInput function| OnSubmitHandler1 function| setEngDisplay function| setFrenchDisplay function| setGermanDisplay function| setItalianDisplay function| setLocale function| processKey

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff