urlscan.io logo urlscan.io
SecurityTrails logo

vodnal.ru Open in urlscan Pro
212.41.8.238  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://sendedelir.com/redir.php
Effective URL: https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Submission: On May 07 via manual from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 212.41.8.238, located in Krasnoyarsk, Russian Federation and belongs to RU-KTS-AS Internet Service Provider in the Krasnoyarsk Region, RU. The main domain is vodnal.ru.
TLS certificate: Issued by AlphaSSL CA - SHA256 - G2 on June 11th 2019. Valid for: a year.
This is the only time vodnal.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Alibaba (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2.57.89.2 47583 (AS-HOSTINGER)
4 212.41.8.238 6662 (RU-KTS-AS...)
4 1
Apex Domain
Subdomains		 Transfer
4 vodnal.ru
vodnal.ru
279 KB
1 sendedelir.com
sendedelir.com
302 B
4 2
Domain Requested by
4 vodnal.ru vodnal.ru
1 sendedelir.com 1 redirects
4 2

This site contains no links.

Subject Issuer Validity Valid
vodnal.ru
AlphaSSL CA - SHA256 - G2		 2019-06-11 -
2020-05-18		 a year crt.sh

This page contains 1 frames:

Primary Page: https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Frame ID: F82ABDE5A9C787EA662635B448853D9C
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://sendedelir.com/redir.php HTTP 302
    https://vodnal.ru/Aop/ALIYUNNEW2/?email= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

279 kB
Transfer

284 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://sendedelir.com/redir.php HTTP 302
    https://vodnal.ru/Aop/ALIYUNNEW2/?email= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
vodnal.ru/Aop/ALIYUNNEW2/
Redirect Chain
  • http://sendedelir.com/redir.php
  • https://vodnal.ru/Aop/ALIYUNNEW2/?email=
8 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.41.8.238 Krasnoyarsk, Russian Federation, ASN6662 (RU-KTS-AS Internet Service Provider in the Krasnoyarsk Region, RU),
Reverse DNS
intechosting2.ru
Software
nginx /
Resource Hash
0218ada76f2edbac8cea707d9732f4cd35298b57c92f5101248de01b0856676d

Request headers

:method
GET
:authority
vodnal.ru
:scheme
https
:path
/Aop/ALIYUNNEW2/?email=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
server
nginx
date
Thu, 07 May 2020 05:38:28 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
content-encoding
gzip
cache-control
max-age=0
expires
Thu, 07 May 2020 05:38:28 GMT

Redirect headers

Connection
Keep-Alive
X-Powered-By
PHP/7.3.16
Location
https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Content-Type
text/html; charset=UTF-8
Content-Length
0
Date
Thu, 07 May 2020 05:38:27 GMT
Server
LiteSpeed
Cache-Control
no-cache, no-store, must-revalidate, max-age=0
0.png
vodnal.ru/Aop/ALIYUNNEW2/images/ 		275 KB
275 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vodnal.ru/Aop/ALIYUNNEW2/images/0.png
Requested by
Host: vodnal.ru
URL: https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.41.8.238 Krasnoyarsk, Russian Federation, ASN6662 (RU-KTS-AS Internet Service Provider in the Krasnoyarsk Region, RU),
Reverse DNS
intechosting2.ru
Software
nginx /
Resource Hash
57018df3ff5917f0d6cb05cd0725e3e5c21c327fe04ba6587a75152a2aebe00c

Request headers

Referer
https://vodnal.ru/Aop/ALIYUNNEW2/?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 07 May 2020 05:38:28 GMT
last-modified
Mon, 04 Jun 2018 21:28:58 GMT
server
nginx
etag
"5b15af1a-44b63"
content-type
image/png
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
281443
expires
Sat, 06 Jun 2020 05:38:28 GMT
1.png
vodnal.ru/Aop/ALIYUNNEW2/images/ 		286 B
459 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vodnal.ru/Aop/ALIYUNNEW2/images/1.png
Requested by
Host: vodnal.ru
URL: https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.41.8.238 Krasnoyarsk, Russian Federation, ASN6662 (RU-KTS-AS Internet Service Provider in the Krasnoyarsk Region, RU),
Reverse DNS
intechosting2.ru
Software
nginx /
Resource Hash
3a863240b0fec6290b3dcb33c07734b5eb2422f9d117b508b210d545f3574f20

Request headers

Referer
https://vodnal.ru/Aop/ALIYUNNEW2/?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 07 May 2020 05:38:28 GMT
last-modified
Mon, 04 Jun 2018 21:31:32 GMT
server
nginx
etag
"5b15afb4-11e"
content-type
image/png
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
286
expires
Sat, 06 Jun 2020 05:38:28 GMT
2.png
vodnal.ru/Aop/ALIYUNNEW2/images/ 		911 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vodnal.ru/Aop/ALIYUNNEW2/images/2.png
Requested by
Host: vodnal.ru
URL: https://vodnal.ru/Aop/ALIYUNNEW2/?email=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.41.8.238 Krasnoyarsk, Russian Federation, ASN6662 (RU-KTS-AS Internet Service Provider in the Krasnoyarsk Region, RU),
Reverse DNS
intechosting2.ru
Software
nginx /
Resource Hash
383c5285b8f0c6781a149dd1dc80099c2af3cbd124a292a1b155f2248b8862b8

Request headers

Referer
https://vodnal.ru/Aop/ALIYUNNEW2/?email=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Thu, 07 May 2020 05:38:28 GMT
last-modified
Mon, 04 Jun 2018 21:22:36 GMT
server
nginx
etag
"5b15ad9c-38f"
content-type
image/png
status
200
cache-control
max-age=2592000
accept-ranges
bytes
content-length
911
expires
Sat, 06 Jun 2020 05:38:28 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Alibaba (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| unhideBody

0 Cookies