eyky4.ru.com
Open in
urlscan Pro
185.221.216.111
Malicious Activity!
Public Scan
Submitted URL: http://is.gd/spedizionesicura_carte.com
Effective URL: https://eyky4.ru.com/
Submission: On September 21 via manual from IT — Scanned from IT
Effective URL: https://eyky4.ru.com/
Submission: On September 21 via manual from IT — Scanned from IT
Summary
This website contacted 2 IPs
in 2 countries
across 3 domains to perform 17 HTTP transactions.
The main IP is 185.221.216.111, located in
Chicago, United States and
belongs to HOST4GEEKS-LLC, US.
The main domain is eyky4.ru.com.
TLS certificate: Issued by R3 on September 20th 2023. Valid for: 3 months.
This is the only time eyky4.ru.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on September 20th 2023. Valid for: 3 months.
This is the only time eyky4.ru.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Volksbank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 104.25.233.53 104.25.233.53 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 1 | 172.67.83.132 172.67.83.132 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 10 | 185.221.216.111 185.221.216.111 | 393960 (HOST4GEEK...) (HOST4GEEKS-LLC) | |
| 17 | 2 |
10
185.221.216.111
(Chicago, United States)
ASN393960 (HOST4GEEKS-LLC, US)
PTR: ironprize.net
ASN393960 (HOST4GEEKS-LLC, US)
PTR: ironprize.net
| eyky4.ru.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
ru.com
eyky4.ru.com |
153 KB |
| 2 |
is.gd
2 redirects
is.gd — Cisco Umbrella Rank: 85930 |
445 B |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 17 | 3 |
| Domain | Requested by | |
|---|---|---|
| 10 | eyky4.ru.com |
eyky4.ru.com
|
| 2 | is.gd | 2 redirects |
| 0 | ifibfemgeogfhoebkmokieepdoobkbpo Failed |
eyky4.ru.com
|
| 17 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| eyky4.ru.com R3 |
2023-09-20 - 2023-12-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://eyky4.ru.com/
Frame ID: C9379A35A358CB6DCF36316C8F92966B
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://is.gd/spedizionesicura_carte.com
HTTP 301
https://is.gd/spedizionesicura_carte.com HTTP 301
https://eyky4.ru.com/ Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://is.gd/spedizionesicura_carte.com
HTTP 301
https://is.gd/spedizionesicura_carte.com HTTP 301
https://eyky4.ru.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
eyky4.ru.com/ Redirect Chain
|
11 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
hunter.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/turnstile/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
hunter.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/arkoselabs/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
hunter.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/recaptcha/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
hunter.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/keycaptcha/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
hunter.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/hcaptcha/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
communication_helpers.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
core_helpers.js
ifibfemgeogfhoebkmokieepdoobkbpo/content/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
direct-banking.css
eyky4.ru.com/jsp/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.12.4.min.js
eyky4.ru.com/jsp/ |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.timers.js
eyky4.ru.com/jsp/ |
3 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.url.min.js
eyky4.ru.com/jsp/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.i18n.properties.js
eyky4.ru.com/jsp/ |
20 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
utils.js
eyky4.ru.com/jsp/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-volksbank-2019.png
eyky4.ru.com/jsp/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
direct-banking-2019.png
eyky4.ru.com/jsp/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
60sec-ccw-inf.gif
eyky4.ru.com/jsp/ |
9 KB 9 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/turnstile/hunter.js
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/arkoselabs/hunter.js
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/recaptcha/hunter.js
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/keycaptcha/hunter.js
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/captcha/hcaptcha/hunter.js
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/communication_helpers.js
- Domain
- ifibfemgeogfhoebkmokieepdoobkbpo
- URL
- chrome-extension://ifibfemgeogfhoebkmokieepdoobkbpo/content/core_helpers.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Volksbank (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery object| jQuery1124098446802809844411 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| eyky4.ru.com/ | Name: COOKIE_KEY Value: 169531095568 |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
eyky4.ru.com
ifibfemgeogfhoebkmokieepdoobkbpo
is.gd
ifibfemgeogfhoebkmokieepdoobkbpo
104.25.233.53
172.67.83.132
185.221.216.111
2e4c3f1e4a548d3162b59c6b73c66bbaa7453fee26d4228724f05d6a64b189e5
412cf6849e73c0558c004672752051609555bd96a38f0c11120c68f994e8b67c
59b9447876b2df552b018b9110614d56003ae975386bac07643a7a478e65f2b3
62caefacbd8e09f7892d07251a53bf847d5eb6440303bd65733b430ef846b2eb
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
86e5b1adf53642a8d2ae63cdab3163ddb01f5b681395624dc29d6a423a0e70a4
873eca06bd6125c459141a8455c5a375d30ea992dc58965cde6e111a9f9b01a3
f9daaa0d5f8be240569fbeb10ec316f23908a1d0753a4abc10fc09a035cbd9fe