u687733lca.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::39 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php
Submission: On May 25 via automatic, source openphish (May 25th 2020, 1:01:23 pm UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 5 countries across 6 domains to perform 11 HTTP transactions. The main IP is 2a00:b700::39, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u687733lca.ha004.t.justns.ru.

This is the only time u687733lca.ha004.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	2a00:b700::39 2a00:b700::39	51659 (ASBAXET) (ASBAXET)
1	198.54.115.111 198.54.115.111	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	138.201.140.207 138.201.140.207	24940 (HETZNER-AS) (HETZNER-AS)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:2b	20446 (HIGHWINDS3) (HIGHWINDS3)
1 1	213.209.17.176 213.209.17.176	8660 (MATRIX-AS) (MATRIX-AS)
1 2	213.209.17.182 213.209.17.182	8660 (MATRIX-AS) (MATRIX-AS)
11	5

6 2a00:b700::39 (Russian Federation)

ASN51659 (ASBAXET, RU)

u687733lca.ha004.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.54.115.111 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server227-2.web-hosting.com

holacoin.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 138.201.140.207 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: ns386.altervista.org

romeoonweb.altervista.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:2b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.209.17.176 (Assago, Italy) 1 redirects

ASN8660 (MATRIX-AS, IT)

jnansbil.xoom.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 213.209.17.182 (Assago, Italy) 1 redirects

ASN8660 (MATRIX-AS, IT)

xoom.virgilio.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	justns.ru u687733lca.ha004.t.justns.ru	42 KB
2	virgilio.it 1 redirects xoom.virgilio.it	126 B
2	altervista.org romeoonweb.altervista.org
1	xoom.it 1 redirects jnansbil.xoom.it	242 B
1	jquery.com code.jquery.com	82 KB
1	holacoin.us holacoin.us
11	6

	Domain	Requested by
6	u687733lca.ha004.t.justns.ru	u687733lca.ha004.t.justns.ru
2	xoom.virgilio.it	1 redirects u687733lca.ha004.t.justns.ru
2	romeoonweb.altervista.org	u687733lca.ha004.t.justns.ru
1	jnansbil.xoom.it	1 redirects
1	code.jquery.com	u687733lca.ha004.t.justns.ru
1	holacoin.us	u687733lca.ha004.t.justns.ru
11	6

This site contains no links.

Subject Issuer	Validity	Valid
*.virgilio.it GlobalSign RSA OV SSL CA 2018	`2019-07-16` - `2020-09-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php
Frame ID: 28B9F7E1C839A98945F07C61152A12CA
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

11
Requests

9 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

5
IPs

5
Countries

124 kB
Transfer

321 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://jnansbil.xoom.it/js/jquery.js HTTP 302
http://xoom.virgilio.it/jump.html HTTP 302
https://xoom.virgilio.it/jump.html

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request phone.php Show response u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/	5 KB 2 KB	407ms 43ms	Document text/html	2a00:b700::39 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `eafdf76898b7b53951d04b329b91cf674a9595fee43d96011c1efdc273d85092` Request headers Host u687733lca.ha004.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 2205 Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Mon, 25 May 2020 13:01:05 GMT Server LiteSpeed
GET H/1.1	404 Not Found	ds.css holacoin.us/dev/test/css/	0 0	425ms 375ms	Stylesheet text/html	198.54.115.111 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://holacoin.us/dev/test/css/ds.css Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 198.54.115.111 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server227-2.web-hosting.com Software / Resource Hash Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	403 Forbidden	jquery-1-4-4-min.js romeoonweb.altervista.org/dbox/3/	0 0	145ms 94ms	Script text/html	138.201.140.207 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://romeoonweb.altervista.org/dbox/3/jquery-1-4-4-min.js Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 138.201.140.207 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS ns386.altervista.org Software / Resource Hash Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	jquery-latest.js Show response code.jquery.com/	276 KB 82 KB	15ms 7ms	Script application/javascript	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL http://code.jquery.com/jquery-latest.js Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `3029834a820c79c154c377f52e2719fc3ff2a27600a07ae089ea7fde9087f6bc` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 25 May 2020 13:01:05 GMT Content-Encoding gzip Last-Modified Fri, 24 Oct 2014 00:16:08 GMT Server nginx ETag "54499a48-4508e" Vary Accept-Encoding X-HW 1590411665.dop019.fr8.t,1590411665.cds012.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=86400, public Connection Keep-Alive Accept-Ranges bytes Content-Length 83875
GET H/1.1	200 OK	jump.html Show response xoom.virgilio.it/ Redirect Chain http://jnansbil.xoom.it/js/jquery.js http://xoom.virgilio.it/jump.html https://xoom.virgilio.it/jump.html	0 0	355ms 90ms	Script text/html	213.209.17.182 MATRIX-AS
General Check archive.org Show headers Download Go to Full URL https://xoom.virgilio.it/jump.html Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 213.209.17.182 Assago, Italy, ASN8660 (MATRIX-AS, IT), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Location https://xoom.virgilio.it/jump.html Server BigIP Connection Keep-Alive Content-Length 0
GET H/1.1	200 OK	tab.css u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/css/	2 KB 1007 B	42ms 40ms	Stylesheet text/css	2a00:b700::39 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/css/tab.css Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `d582920d9c90fef2118de87eda620a20348162a946748bdc76a44a9abf207c38` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 25 May 2020 13:01:05 GMT Content-Encoding gzip Last-Modified Tue, 14 Apr 2020 11:50:07 GMT Server LiteSpeed Etag "899-5e95a36f-2ef4c5bcee4ca1bf;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 616 Expires Mon, 01 Jun 2020 13:01:05 GMT
GET H/1.1	200 OK	info_01.gif u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/	18 KB 18 KB	80ms 39ms	Image image/gif	2a00:b700::39 ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/info_01.gif Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `6ee2d8c4384f67dc6980e55b4e6a22a880836435cce9ab320f9b454d1534fa8d` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 25 May 2020 13:01:05 GMT Last-Modified Tue, 14 Apr 2020 11:50:07 GMT Server LiteSpeed Etag "46ec-5e95a36f-4c701ab09249b4e0;;;" Vary User-Agent Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 18156 Expires Mon, 01 Jun 2020 13:01:05 GMT
GET H/1.1	200 OK	info_02.gif u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/	5 KB 6 KB	79ms 39ms	Image image/gif	2a00:b700::39 ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/info_02.gif Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `fca5ec98a36acb46a3568a32cac03546bdf3e6342a30a6fcaba0c7d5fef93b50` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 25 May 2020 13:01:05 GMT Last-Modified Tue, 14 Apr 2020 11:50:07 GMT Server LiteSpeed Etag "15ee-5e95a36f-2ea622dc648764b4;;;" Vary User-Agent Content-Type image/gif Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 5614 Expires Mon, 01 Jun 2020 13:01:05 GMT
GET H/1.1	403 Forbidden	jquery-1-4-4-min.js romeoonweb.altervista.org/dbox/3/	0 0	63ms 63ms	Script text/html	138.201.140.207 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL http://romeoonweb.altervista.org/dbox/3/jquery-1-4-4-min.js Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 138.201.140.207 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS ns386.altervista.org Software / Resource Hash Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	bg1.jpg u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/	14 KB 14 KB	40ms 40ms	Image image/jpeg	2a00:b700::39 ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/bg1.jpg Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `c4729fae0d705b375370bfacb82c70dd5a961af711ab7931c309ec42e1eb12c7` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 25 May 2020 13:01:06 GMT Last-Modified Tue, 14 Apr 2020 11:50:07 GMT Server LiteSpeed Etag "3776-5e95a36f-179d5a1f106e0492;;;" Vary User-Agent Content-Type image/jpeg Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 14198 Expires Mon, 01 Jun 2020 13:01:06 GMT
GET H/1.1	200 OK	bkg-thead34.png u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/	290 B 642 B	39ms 39ms	Image image/png	2a00:b700::39 ASBAXET
General Check archive.org Show headers Download Go to Show image Full URL http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/images/bkg-thead34.png Requested by Host: u687733lca.ha004.t.justns.ru URL: http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php Protocol HTTP/1.1 Server 2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `da48fdb6ed67fd49d33084799b59315f2399c9d7030de058b349c721105dae9f` Request headers Referer http://u687733lca.ha004.t.justns.ru/voscomptesenligne/postale/mescomptes/postale.activation/phone.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 25 May 2020 13:01:06 GMT Last-Modified Tue, 14 Apr 2020 11:50:07 GMT Server LiteSpeed Etag "122-5e95a36f-771cce29a7fc984a;;;" Vary User-Agent Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 290 Expires Mon, 01 Jun 2020 13:01:06 GMT

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
holacoin.us
jnansbil.xoom.it
romeoonweb.altervista.org
u687733lca.ha004.t.justns.ru
xoom.virgilio.it
138.201.140.207
198.54.115.111
2001:4de0:ac19::1:b:2b
213.209.17.176
213.209.17.182
2a00:b700::39
3029834a820c79c154c377f52e2719fc3ff2a27600a07ae089ea7fde9087f6bc
6ee2d8c4384f67dc6980e55b4e6a22a880836435cce9ab320f9b454d1534fa8d
c4729fae0d705b375370bfacb82c70dd5a961af711ab7931c309ec42e1eb12c7
d582920d9c90fef2118de87eda620a20348162a946748bdc76a44a9abf207c38
da48fdb6ed67fd49d33084799b59315f2399c9d7030de058b349c721105dae9f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eafdf76898b7b53951d04b329b91cf674a9595fee43d96011c1efdc273d85092
fca5ec98a36acb46a3568a32cac03546bdf3e6342a30a6fcaba0c7d5fef93b50

u687733lca.ha004.t.justns.ru Open in urlscan Pro 2a00:b700::39 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

9 %HTTPS

33 %IPv6

6 Domains

6 Subdomains

5 IPs

5 Countries

124 kBTransfer

321 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

0 Cookies

Indicators

u687733lca.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::39 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

9 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

5
IPs

5
Countries

124 kB
Transfer

321 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions