f0569227.xsph.ru Open in urlscan Pro
2a0a:2b42:25:e6b0:: Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Submission: On August 11 via automatic, source openphish (August 11th 2021, 2:13:01 am UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2a0a:2b42:25:e6b0::, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is f0569227.xsph.ru.

This is the only time f0569227.xsph.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address		AS Autonomous System
6	2a0a:2b42:25:... 2a0a:2b42:25:e6b0::		35278 (SPRINTHOST) (SPRINTHOST)
2	2606:4700::68... 2606:4700::6812:acf		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b		20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a04:4e42:3::485 2a04:4e42:3::485		54113 (FASTLY) (FASTLY)
10	4

6 2a0a:2b42:25:e6b0:: (Russian Federation)

ASN35278 (SPRINTHOST, RU)

f0569227.xsph.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	xsph.ru f0569227.xsph.ru	3 MB
2	bootstrapcdn.com stackpath.bootstrapcdn.com	41 KB
1	jsdelivr.net cdn.jsdelivr.net	8 KB
1	jquery.com code.jquery.com	24 KB
10	4

	Domain	Requested by
6	f0569227.xsph.ru	f0569227.xsph.ru
2	stackpath.bootstrapcdn.com	f0569227.xsph.ru
1	cdn.jsdelivr.net	f0569227.xsph.ru
1	code.jquery.com	f0569227.xsph.ru
10	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Frame ID: 08BB37B0AD3FB982263AE20A116BFABC
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

40 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

2827 kB
Transfer

3064 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/ 9 KB
3 KB 174ms
141ms Document
text/html 2a0a:2b42:25:e6b0::
SPRINTHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: HTTP/1.1
Server: 2a0a:2b42:25:e6b0:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: openresty /
Resource Hash: 64b4218d348251d7d1ad663d73fba55ba6c4f40889de5f7d6eb56121603e09c5

Request headers

Host: f0569227.xsph.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Server: openresty
Date: Wed, 11 Aug 2021 02:12:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ 156 KB
24 KB 16ms
13ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css

Requested by

Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: http://f0569227.xsph.ru
Referer: http://f0569227.xsph.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 11 Aug 2021 02:12:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601
age: 15124
cdn-cachedat: 08/03/2021 15:16:56
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:09 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 2dfe1cd7d322ad9e7d3022370112602e
cf-ray: 67cdf0c3ae3d43b8-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H/1.1 200
OK p11.png
f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/ 100 KB
100 KB 33ms
33ms Image
image/png 2a0a:2b42:25:e6b0::
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/p11.png
Requested by: Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: HTTP/1.1
Server: 2a0a:2b42:25:e6b0:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: openresty /
Resource Hash: 7c4ee816e44f918103b472b9f25f8d6cca02ee7deda0df72b24b358790a760c8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: f0569227.xsph.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 11 Aug 2021 02:12:42 GMT
Last-Modified: Mon, 09 Aug 2021 13:49:10 GMT
Server: openresty
ETag: "61113256-18f12"
Content-Type: image/png
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 102162
Expires: Wed, 18 Aug 2021 02:12:42 GMT

GET
H/1.1 200
OK m11.png
f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/ 37 KB
37 KB 66ms
33ms Image
image/png 2a0a:2b42:25:e6b0::
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/m11.png
Requested by: Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: HTTP/1.1
Server: 2a0a:2b42:25:e6b0:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: openresty /
Resource Hash: 08ac96cbcdec9ec14e257b53d9bfae5ff8d6e233a9bed2d0beab49082b267f97

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: f0569227.xsph.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 11 Aug 2021 02:12:42 GMT
Last-Modified: Mon, 09 Aug 2021 13:49:10 GMT
Server: openresty
ETag: "61113256-92c8"
Content-Type: image/png
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37576
Expires: Wed, 18 Aug 2021 02:12:42 GMT

GET
H/1.1 200
OK p2_2.png
f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/ 45 KB
45 KB 67ms
34ms Image
image/png 2a0a:2b42:25:e6b0::
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/p2_2.png
Requested by: Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: HTTP/1.1
Server: 2a0a:2b42:25:e6b0:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: openresty /
Resource Hash: 8138be10ba8f34b704e48bf0291317e7de8c0892fd00ee1ef1a1696b1ea5ccab

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: f0569227.xsph.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 11 Aug 2021 02:12:42 GMT
Last-Modified: Mon, 09 Aug 2021 13:49:10 GMT
Server: openresty
ETag: "61113256-b216"
Content-Type: image/png
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 45590
Expires: Wed, 18 Aug 2021 02:12:42 GMT

GET
H/1.1 200
OK p3.png
f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/ 71 KB
71 KB 65ms
32ms Image
image/png 2a0a:2b42:25:e6b0::
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/p3.png
Requested by: Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: HTTP/1.1
Server: 2a0a:2b42:25:e6b0:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: openresty /
Resource Hash: 8c8014b809bdfd98c022805c1b412488e84576b649c67094e1cd8f1a2d9ccc97

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: f0569227.xsph.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 11 Aug 2021 02:12:42 GMT
Last-Modified: Mon, 09 Aug 2021 13:49:10 GMT
Server: openresty
ETag: "61113256-11b3d"
Content-Type: image/png
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 72509
Expires: Wed, 18 Aug 2021 02:12:42 GMT

GET
H/1.1 200
OK m22.png
f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/ 2 MB
2 MB 65ms
33ms Image
image/png 2a0a:2b42:25:e6b0::
SPRINTHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/cap/m22.png
Requested by: Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: HTTP/1.1
Server: 2a0a:2b42:25:e6b0:: , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
Software: openresty /
Resource Hash: a46d0f72aa2bb07f59172949833e34521711c304cb902e200f059cbde189e16c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: f0569227.xsph.ru
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 11 Aug 2021 02:12:42 GMT
Last-Modified: Mon, 09 Aug 2021 13:49:10 GMT
Server: openresty
ETag: "61113256-270a9d"
Content-Type: image/png
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2558621
Expires: Wed, 18 Aug 2021 02:12:42 GMT

GET
H2 200 jquery-3.4.1.slim.min.js Show response
code.jquery.com/ 69 KB
24 KB 25ms
9ms Script
application/javascript 2001:4de0:ac18::1:a:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.slim.min.js
Requested by: Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f

Request headers

Origin: http://f0569227.xsph.ru
Referer: http://f0569227.xsph.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 11 Aug 2021 02:12:42 GMT
content-encoding: gzip
last-modified: Wed, 01 May 2019 21:14:27 GMT
server: nginx
etag: W/"5cca0c33-1157d"
vary: Accept-Encoding
x-hw: 1628647962.dop239.fr8.t,1628647962.cds276.fr8.hc,1628647962.cds260.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24328

GET
H2 200 popper.min.js Show response
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ 21 KB
8 KB 18ms
5ms Script
application/javascript 2a04:4e42:3::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js

Requested by

Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: http://f0569227.xsph.ru
Referer: http://f0569227.xsph.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 5446962
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 7510
etag: W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
x-served-by: cache-fra19123-FRA
date: Wed, 11 Aug 2021 02:12:42 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/ 59 KB
16 KB 13ms
12ms Script
application/javascript 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js

Requested by

Host: f0569227.xsph.ru
URL: http://f0569227.xsph.ru/a9dacdf434fb29331bf14e114409941b/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: http://f0569227.xsph.ru
Referer: http://f0569227.xsph.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 11 Aug 2021 02:12:42 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617
age: 15124
cdn-cachedat: 2021-08-02 20:41:18
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:09 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 5c2a8defb2a43ff912afbd532d75d5e0
cf-ray: 67cdf0c3ae3f43b8-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap function| clavier

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
f0569227.xsph.ru
stackpath.bootstrapcdn.com
2001:4de0:ac18::1:a:3b
2606:4700::6812:acf
2a04:4e42:3::485
2a0a:2b42:25:e6b0::
08ac96cbcdec9ec14e257b53d9bfae5ff8d6e233a9bed2d0beab49082b267f97
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
64b4218d348251d7d1ad663d73fba55ba6c4f40889de5f7d6eb56121603e09c5
7c4ee816e44f918103b472b9f25f8d6cca02ee7deda0df72b24b358790a760c8
8138be10ba8f34b704e48bf0291317e7de8c0892fd00ee1ef1a1696b1ea5ccab
8c8014b809bdfd98c022805c1b412488e84576b649c67094e1cd8f1a2d9ccc97
a46d0f72aa2bb07f59172949833e34521711c304cb902e200f059cbde189e16c
a5ab2a00a0439854f8787a0dda775dea5377ef4905886505c938941d6854ee4f
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060