sanstur.com
Open in
urlscan Pro
87.98.158.134
Malicious Activity!
Public Scan
URL:
https://sanstur.com/redirector/index.htm
Submission: On August 22 via manual from US
Submission: On August 22 via manual from US
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 87.98.158.134, located in
France and
belongs to OVH, FR.
The main domain is sanstur.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 25th 2017. Valid for: 3 months.
This is the only time sanstur.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 25th 2017. Valid for: 3 months.
This is the only time sanstur.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Dropbox (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 87.98.158.134 87.98.158.134 | 16276 (OVH) (OVH) | |
| 11 | 185.17.150.69 185.17.150.69 | 20860 (IOMART-AS) (IOMART-AS) | |
| 13 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
friesianhorses-ni.co.uk
friesianhorses-ni.co.uk Failed |
186 KB |
| 1 |
sanstur.com
sanstur.com |
108 B |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | friesianhorses-ni.co.uk |
friesianhorses-ni.co.uk
|
| 1 | sanstur.com | |
| 13 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sanstur.com cPanel, Inc. Certification Authority |
2017-07-25 - 2017-10-23 |
3 months | crt.sh |
| friesianhorses-ni.co.uk cPanel, Inc. Certification Authority |
2017-07-01 - 2017-09-29 |
3 months | crt.sh |
This page contains 2 frames:
Frame:
https://friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/
Frame ID: 32184.1
Requests: 2 HTTP requests in this frame
Frame:
https://friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/
Frame ID: 32195.1
Requests: 11 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.htm
sanstur.com/redirector/ |
108 B 108 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/ Frame 3219 |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
box.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
officelogo.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
googlelogo.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
outlooklogo.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aollogo.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
919 B 919 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
yahoologo.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mcafee.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ssl_verisign.png
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
background2.jpg
friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/img/ Frame 3219 |
89 KB 89 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- friesianhorses-ni.co.uk
- URL
- https://friesianhorses-ni.co.uk/Krossspoledrops/straighdropbox/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Dropbox (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
friesianhorses-ni.co.uk
sanstur.com
friesianhorses-ni.co.uk
185.17.150.69
87.98.158.134
010da445e8c3df9019ed05532d7caaa0879eaef62761289bca71f93782fe9d56
19dcc4f189dbc6b7d5c7745b26a153c5f38b263bea0dca4fd9f68791d77caefa
2395c87371c7e908039fefad260a34e0e1644ad59027a1b0114b703ecd76a239
33238c21542c066bbe4aa7a5d666c10c66879f9ccbb81cb49ca34e33ee90f245
33cf2383e9a88578a6e92a30db80f030773d28055b6e7008a849ac7f8c8acb0a
47d4e3ecf486cf9e611f4efd0ee3fb1353bad7b78e49310168ba5e5102b1de33
5536cdcf45ed63ad03a3214f532bfd01364f8f016b31c019959080e753aeed36
91c946d1b9686c860199a89c324cac53b3966add96b0afbc534d2ea986bb69a6
c8486b71c1631892c5bfcd31de43025b48527e4e3e780dfa15c8e99d2d5b93a5
cc4a710690ff6b9bcb025f350831af3016ec07556e40d64eafd661b13a4db93f
f6efc365812ace5e6f271c0887b06eedf897ba540e5dae8fb19a731847ec5312
f99e012b38ae8c2a77a57f6dd6ec8c8620e8d6d34b2b052b56cf5d7af5a5dbed