agentservicevocauxinfo.justns.ru

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2a00:b700:5:100::10d, located in Russian Federation and belongs to ASBAXET, RU. The main domain is agentservicevocauxinfo.justns.ru.
TLS certificate: Issued by R3 on August 5th 2022. Valid for: 3 months.

This is the only time agentservicevocauxinfo.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3120::c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7	2a00:b700:5:1... 2a00:b700:5:100::10d	51659 (ASBAXET) (ASBAXET)
5	1

1 2a06:98c1:3120::c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

3c5.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:b700:5:100::10d (Russian Federation) 2 redirects

ASN51659 (ASBAXET, RU)

agentservicevocauxinfo.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	justns.ru 2 redirects agentservicevocauxinfo.justns.ru	37 KB
1	3c5.com 1 redirects 3c5.com	716 B
5	2

	Domain	Requested by
7	agentservicevocauxinfo.justns.ru	2 redirects agentservicevocauxinfo.justns.ru
1	3c5.com	1 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
agentservicevocauxinfo.justns.ru R3	`2022-08-05` - `2022-11-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9
Frame ID: DADAD246C89EE6789D9444AFD3579C18
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Orange

Page URL History Show full URLs

https://3c5.com/6PCZA HTTP 301
https://agentservicevocauxinfo.justns.ru/ HTTP 302
https://agentservicevocauxinfo.justns.ru/pro/unlock.php HTTP 302
https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

37 kB
Transfer

39 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://3c5.com/6PCZA HTTP 301
https://agentservicevocauxinfo.justns.ru/ HTTP 302
https://agentservicevocauxinfo.justns.ru/pro/unlock.php HTTP 302
https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request default.php Show response agentservicevocauxinfo.justns.ru/ Redirect Chain https://3c5.com/6PCZA https://agentservicevocauxinfo.justns.ru/ https://agentservicevocauxinfo.justns.ru/pro/unlock.php https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9	2 KB 1 KB	1903ms 1902ms	Document text/html	2a00:b700:5:100::10d ASBAXET
General Check archive.org Show headers Download Go to Full URL https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:b700:5:100::10d , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `2603ab5deb98081c0d59002ff4762b54994974dedfb283eb7a2d6f0dd3202ecb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-length 920 content-type text/html; charset=UTF-8 date Thu, 11 Aug 2022 15:33:35 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding,User-Agent Redirect headers cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Thu, 11 Aug 2022 15:33:33 GMT location ../default.php?id=2001:41d0:8:d154::9 server LiteSpeed vary User-Agent
GET H2	200	Style.css agentservicevocauxinfo.justns.ru/Style/	2 KB 865 B	63ms 62ms	Stylesheet text/css	2a00:b700:5:100::10d ASBAXET
General Check archive.org Show headers Download Go to Full URL https://agentservicevocauxinfo.justns.ru/Style/Style.css Requested by Host: agentservicevocauxinfo.justns.ru URL: https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:b700:5:100::10d , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `c1f322f7836b43f2e1e9fbb4259912b610d0b8a6e39a65ecf9b3c30f4eaccc3a` Request headers accept-language fr-FR,fr;q=0.9 Referer https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Thu, 11 Aug 2022 15:33:35 GMT content-encoding br last-modified Mon, 01 Nov 2021 10:49:30 GMT server LiteSpeed etag "72b-617fc63a-d1c4934dbab86d69;br" vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 729 expires Thu, 18 Aug 2022 15:33:35 GMT
GET H2	200	052.png agentservicevocauxinfo.justns.ru/IMG/	11 KB 11 KB	63ms 63ms	Image image/png	2a00:b700:5:100::10d ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL https://agentservicevocauxinfo.justns.ru/IMG/052.png Requested by Host: agentservicevocauxinfo.justns.ru URL: https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:b700:5:100::10d , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `8659e986bb9593a8bb9df077c820d315a87278b5ee61001371728a2b0b951ca3` Request headers accept-language fr-FR,fr;q=0.9 Referer https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Thu, 11 Aug 2022 15:33:35 GMT last-modified Mon, 01 Nov 2021 10:49:30 GMT server LiteSpeed etag "2a3e-617fc63a-181ec729126ee934;;;" vary User-Agent content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 10814 expires Thu, 18 Aug 2022 15:33:35 GMT
GET H2	200	Capture00.PNG agentservicevocauxinfo.justns.ru/IMG/	10 KB 10 KB	108ms 107ms	Image image/png	2a00:b700:5:100::10d ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL https://agentservicevocauxinfo.justns.ru/IMG/Capture00.PNG Requested by Host: agentservicevocauxinfo.justns.ru URL: https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:b700:5:100::10d , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `04e92d10c2b03cc6dfef99f8fad4c7e765bc3a4f683ff16a7e76ed01bcbbcea5` Request headers accept-language fr-FR,fr;q=0.9 Referer https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Thu, 11 Aug 2022 15:33:35 GMT last-modified Mon, 01 Nov 2021 10:49:30 GMT server LiteSpeed etag "2917-617fc63a-a4a445f76efe4102;;;" vary User-Agent content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 10519 expires Thu, 18 Aug 2022 15:33:35 GMT
GET H2	200	1.PNG agentservicevocauxinfo.justns.ru/IMG/	14 KB 14 KB	108ms 108ms	Image image/png	2a00:b700:5:100::10d ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL https://agentservicevocauxinfo.justns.ru/IMG/1.PNG Requested by Host: agentservicevocauxinfo.justns.ru URL: https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:b700:5:100::10d , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `42d336c15b6deafbc95abb4c1c34d802a5817f8e1201c0aac87295b55ed2053c` Request headers accept-language fr-FR,fr;q=0.9 Referer https://agentservicevocauxinfo.justns.ru/default.php?id=2001:41d0:8:d154::9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers date Thu, 11 Aug 2022 15:33:35 GMT last-modified Mon, 13 Jun 2022 12:13:18 GMT server LiteSpeed etag "3691-62a729de-a199f5306fe13133;;;" vary User-Agent content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 13969 expires Thu, 18 Aug 2022 15:33:35 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
3c5.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 70ld1jdgrvmk9vp2qjgkpnp8jp
3c5.com/	1970-01-20 05:10:33	Name: short_6PCZA Value: 1
agentservicevocauxinfo.justns.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2408f9425cce3f0e4d49f56d03555ab8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3c5.com
agentservicevocauxinfo.justns.ru
2a00:b700:5:100::10d
2a06:98c1:3120::c
04e92d10c2b03cc6dfef99f8fad4c7e765bc3a4f683ff16a7e76ed01bcbbcea5
2603ab5deb98081c0d59002ff4762b54994974dedfb283eb7a2d6f0dd3202ecb
42d336c15b6deafbc95abb4c1c34d802a5817f8e1201c0aac87295b55ed2053c
8659e986bb9593a8bb9df077c820d315a87278b5ee61001371728a2b0b951ca3
c1f322f7836b43f2e1e9fbb4259912b610d0b8a6e39a65ecf9b3c30f4eaccc3a

agentservicevocauxinfo.justns.ru Open in urlscan Pro 2a00:b700:5:100::10d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

37 kBTransfer

39 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

3 Cookies

Indicators

agentservicevocauxinfo.justns.ru Open in urlscan Pro
2a00:b700:5:100::10d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

37 kB
Transfer

39 kB
Size

3
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!