urlscan.io logo urlscan.io
SecurityTrails logo

doo-yoo.ru Open in urlscan Pro
91.201.52.102  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://edcfun.com/keiss.htm
Effective URL: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Submission: On April 07 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 4 countries across 4 domains to perform 7 HTTP transactions. The main IP is 91.201.52.102, located in Russian Federation and belongs to INTERNET-PRO-AS, RU. The main domain is doo-yoo.ru.
TLS certificate: Issued by R3 on March 27th 2021. Valid for: 3 months.
This is the only time doo-yoo.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Stewart Title (Insurance)

Domain & IP information

IP Address AS Autonomous System
1 8.210.249.128 45102 (CNNIC-ALI...)
2 91.201.52.102 44128 (INTERNET-...)
3 72.32.60.139 33070 (RMH-14)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
7 4
Domain Requested by
3 stewartforeverfarm.com doo-yoo.ru
2 doo-yoo.ru edcfun.com
doo-yoo.ru
1 i.pinimg.com doo-yoo.ru
1 edcfun.com
7 4

This site contains links to these domains. Also see Links.

Domain
newhomepage.com
Subject Issuer Validity Valid
www.edcfun.com
TrustAsia TLS RSA CA		 2020-12-14 -
2021-12-13		 a year crt.sh
doo-yoo.ru
R3		 2021-03-27 -
2021-06-25		 3 months crt.sh
stewartforeverfarm.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2020-12-22 -
2021-12-22		 a year crt.sh
*.pinterest.com
DigiCert SHA2 High Assurance Server CA		 2020-07-16 -
2021-08-04		 a year crt.sh

This page contains 1 frames:

Primary Page: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Frame ID: D5C04177AE576F4B3E7DD03CFB0AA39A
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://edcfun.com/keiss.htm Page URL
  2. https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

4
Countries

7509 kB
Transfer

7514 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://edcfun.com/keiss.htm Page URL
  2. https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
keiss.htm
edcfun.com/ 		117 B
257 B 		Document
General
Check archive.org
Download Go to
Full URL
https://edcfun.com/keiss.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
8.210.249.128 Beijing, China, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software
Apache /
Resource Hash
5f171f5dbbaacbdc5c09662ce5710b885b80a34911fe72aae59d65d301d86cc2

Request headers

:method
GET
:authority
edcfun.com
:scheme
https
:path
/keiss.htm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Response headers

date
Wed, 07 Apr 2021 17:13:37 GMT
server
Apache
last-modified
Tue, 06 Apr 2021 11:22:18 GMT
etag
"75-5bf4c06ea6e80-gzip"
accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-length
121
content-type
text/html
Primary Request stewartforeverfarm.shtml
doo-yoo.ru/wp-admin/user/ST/ 		9 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Requested by
Host: edcfun.com
URL: https://edcfun.com/keiss.htm
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.201.52.102 , Russian Federation, ASN44128 (INTERNET-PRO-AS, RU),
Reverse DNS
h19.netangels.ru
Software
nginx/1.14.1 /
Resource Hash
a00eaf3c3f9854fe78db8b06d5146c93d5e1188fd537b66d4f819af218611bdc

Request headers

:method
GET
:authority
doo-yoo.ru
:scheme
https
:path
/wp-admin/user/ST/stewartforeverfarm.shtml
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://edcfun.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
Referer
https://edcfun.com/

Response headers

server
nginx/1.14.1
date
Wed, 07 Apr 2021 17:13:38 GMT
content-type
text/html; charset=utf-8
vary
Accept-Encoding
content-encoding
gzip
Stewart%20logo.png
stewartforeverfarm.com/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stewartforeverfarm.com/Stewart%20logo.png
Requested by
Host: doo-yoo.ru
URL: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
72.32.60.139 , United States, ASN33070 (RMH-14, US),
Reverse DNS
web.realnetsoftware.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
6a652ef5e98f3222ab7f71cc4df69308efe3a5ab1db1b18b6b2518010d16de67

Request headers

Referer
https://doo-yoo.ru/
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Response headers

Date
Wed, 07 Apr 2021 17:13:38 GMT
Last-Modified
Tue, 02 Mar 2021 23:32:57 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"afb65560bcfd71:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
9020
da3aa7a36976feb8d8db5ad5383382cd.png
i.pinimg.com/originals/da/3a/a7/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.pinimg.com/originals/da/3a/a7/da3aa7a36976feb8d8db5ad5383382cd.png
Requested by
Host: doo-yoo.ru
URL: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:18d::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f02bd85a7434e7d7378ebc4f053cb2c66508fa874a5b2aa07dc77ef6df3d35a1

Request headers

Referer
https://doo-yoo.ru/
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency
108
x-cdn
akamai
cache-miss-to-origin
YES
x-edgeconnect-midmile-rtt
65
etag
"cd726effd4829e48f880b40e31c485e2"
vary
Origin
content-type
image/png
cache-control
immutable, max-age=31536000
accept-ranges
bytes
content-length
21639
login.png
stewartforeverfarm.com/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stewartforeverfarm.com/images/login.png
Requested by
Host: doo-yoo.ru
URL: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
72.32.60.139 , United States, ASN33070 (RMH-14, US),
Reverse DNS
web.realnetsoftware.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
696f06310bca8843f400540ab43c62e5bab6ab7a4e9dbae7596fe8c929a45c75

Request headers

Referer
https://doo-yoo.ru/
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Response headers

Date
Wed, 07 Apr 2021 17:13:38 GMT
Last-Modified
Thu, 05 Jul 2018 23:17:46 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"b4c22b62b614d41:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
1988
bgEmpire.jpg
doo-yoo.ru/wp-admin/user/ST/StewartTitle/images/StewartTitle/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://doo-yoo.ru/wp-admin/user/ST/StewartTitle/images/StewartTitle/bgEmpire.jpg
Requested by
Host: doo-yoo.ru
URL: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.201.52.102 , Russian Federation, ASN44128 (INTERNET-PRO-AS, RU),
Reverse DNS
h19.netangels.ru
Software
nginx/1.14.1 / PHP/7.4.15
Resource Hash
bd4d12eaaae07d7d8ba0457031b7ae8131a5981124fd9aa325d453130522676b

Request headers

Referer
https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Response headers

date
Wed, 07 Apr 2021 17:13:38 GMT
content-encoding
gzip
server
nginx/1.14.1
x-powered-by
PHP/7.4.15
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate, max-age=0
link
<https://doo-yoo.ru/wp-json/>; rel="https://api.w.org/"
expires
Wed, 11 Jan 1984 05:00:00 GMT
video.mp4
stewartforeverfarm.com/StewartTitle/Video/ 		7 MB
7 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://stewartforeverfarm.com/StewartTitle/Video/video.mp4
Requested by
Host: doo-yoo.ru
URL: https://doo-yoo.ru/wp-admin/user/ST/stewartforeverfarm.shtml
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
72.32.60.139 , United States, ASN33070 (RMH-14, US),
Reverse DNS
web.realnetsoftware.com
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash

Request headers

Referer
https://doo-yoo.ru/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36
Range
bytes=0-

Response headers

Date
Wed, 07 Apr 2021 17:13:38 GMT
Last-Modified
Fri, 26 Jun 2020 16:33:29 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"d4a61e86d74bd61:0"
Content-Type
video/mp4
Content-Range
bytes 0-7633705/7633706
Accept-Ranges
bytes
Content-Length
7633706

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Stewart Title (Insurance)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| vid object| pauseButton function| vidFade object| video object| btn function| myFunction

0 Cookies