srv87503.ht-test.ru - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 78.110.50.131, located in Moscow, Russian Federation and belongs to HT-SYSTEMS-AS Uplinks:, RU. The main domain is srv87503.ht-test.ru.

This is the only time srv87503.ht-test.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 2	151.101.1.195 151.101.1.195	54113 (FASTLY) (FASTLY)
4	78.110.50.131 78.110.50.131	31240 (HT-SYSTEM...) (HT-SYSTEMS-AS Uplinks:)
1 2	2606:4700::68... 2606:4700::6810:7daf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	3

2 151.101.1.195 (United States) 1 redirects

ASN54113 (FASTLY, US)

office-f02a8.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 78.110.50.131 (Moscow, Russian Federation)

ASN31240 (HT-SYSTEMS-AS Uplinks:, RU)
PTR: cl33-w.ht-systems.ru

srv87503.ht-test.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:7daf (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ht-test.ru srv87503.ht-test.ru	313 KB
2	unpkg.com 1 redirects unpkg.com	12 KB
2	web.app 1 redirects office-f02a8.web.app	519 B
6	3

	Domain	Requested by
4	srv87503.ht-test.ru	srv87503.ht-test.ru
2	unpkg.com	1 redirects srv87503.ht-test.ru
2	office-f02a8.web.app	1 redirects
6	3

This site contains no links.

Subject Issuer	Validity	Valid
web.app GTS CA 1O1	`2020-02-16` - `2020-05-16`	3 months	crt.sh
ssl714328.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2020-02-18` - `2020-08-26`	6 months	crt.sh

This page contains 1 frames:

Primary Page: http://srv87503.ht-test.ru/retrieve/spool/?id=
Frame ID: BB2B7E1EDB9B83D4F2485658E27EBAAC
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://office-f02a8.web.app/deliver?id=Q4b1pKsydoMf@5KNHR.com HTTP 301
https://office-f02a8.web.app/deliver/?id=Q4b1pKsydoMf@5KNHR.com Page URL
http://srv87503.ht-test.ru/retrieve/spool/?id= Page URL

Page Statistics

6
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

325 kB
Transfer

352 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://office-f02a8.web.app/deliver?id=Q4b1pKsydoMf@5KNHR.com HTTP 301
https://office-f02a8.web.app/deliver/?id=Q4b1pKsydoMf@5KNHR.com Page URL
http://srv87503.ht-test.ru/retrieve/spool/?id= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://office-f02a8.web.app/deliver?id=Q4b1pKsydoMf@5KNHR.com HTTP 301
https://office-f02a8.web.app/deliver/?id=Q4b1pKsydoMf@5KNHR.com

Request Chain 4

https://unpkg.com/sweetalert/dist/sweetalert.min.js HTTP 302
https://unpkg.com/sweetalert@2.1.2/dist/sweetalert.min.js

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
office-f02a8.web.app/deliver/
Redirect Chain

https://office-f02a8.web.app/deliver?id=Q4b1pKsydoMf@5KNHR.com
https://office-f02a8.web.app/deliver/?id=Q4b1pKsydoMf@5KNHR.com

94 B
312 B

358ms
358ms

Document
text/html

151.101.1.195
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://office-f02a8.web.app/deliver/?id=Q4b1pKsydoMf@5KNHR.com

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.195 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

:method: GET
:authority: office-f02a8.web.app
:scheme: https
:path: /deliver/?id=Q4b1pKsydoMf@5KNHR.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
cache-control: max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
etag: 83f6583e1a7c45648816d8ebd7a2755d4c06c57dc65227c58dd82ad21029f051
last-modified: Thu, 20 Feb 2020 05:36:08 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
accept-ranges: bytes
date: Thu, 20 Feb 2020 06:12:45 GMT
x-served-by: cache-ams21031-AMS
x-cache: MISS
x-cache-hits: 0
x-timer: S1582179165.181823,VS0,VE345
vary: x-fh-requested-host, accept-encoding
content-length: 114

Redirect headers

status: 301
location: /deliver/?id=Q4b1pKsydoMf@5KNHR.com
content-type: text/plain; charset=utf-8
accept-ranges: bytes
date: Thu, 20 Feb 2020 06:12:45 GMT
x-served-by: cache-ams21031-AMS
x-cache: MISS
x-cache-hits: 0
x-timer: S1582179165.885665,VS0,VE282
vary: x-fh-requested-host, accept-encoding
content-length: 50

GET
H/1.1 200
OK Primary Request / Show response
srv87503.ht-test.ru/retrieve/spool/ 3 KB
3 KB 196ms
100ms Document
text/html 78.110.50.131
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv87503.ht-test.ru/retrieve/spool/?id=
Protocol: HTTP/1.1
Server: 78.110.50.131 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl33-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40 / PHP/5.6.40
Resource Hash: 8c6d61e2595f0ec0ad420984b258026562e9c3437011b267389e65cd0350871d

Request headers

Host: srv87503.ht-test.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 06:12:45 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40
X-Powered-By: PHP/5.6.40
Content-Length: 3061
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK bootstrap.css
srv87503.ht-test.ru/retrieve/spool/ 169 KB
169 KB 61ms
60ms Stylesheet
text/css 78.110.50.131
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv87503.ht-test.ru/retrieve/spool/bootstrap.css
Requested by: Host: srv87503.ht-test.ru
URL: http://srv87503.ht-test.ru/retrieve/spool/?id=
Protocol: HTTP/1.1
Server: 78.110.50.131 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl33-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40 /
Resource Hash: 0ce7fbe215cdf921ed87d00a374404681d5d24898589a7fe60e068d09289b4ba

Request headers

Referer: http://srv87503.ht-test.ru/retrieve/spool/?id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 06:12:45 GMT
X-Cache-Lookup: MISS from hc1.hts.ru:80
Last-Modified: Mon, 14 Jan 2019 03:15:52 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40
ETag: "610e6843-2a327-57f62764f8a00"
X-Cache: MISS from hc1.hts.ru
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 172839

GET
H/1.1 200
OK jquery.min.js Show response
srv87503.ht-test.ru/retrieve/spool/ 90 KB
91 KB 109ms
97ms Script
text/javascript 78.110.50.131
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv87503.ht-test.ru/retrieve/spool/jquery.min.js
Requested by: Host: srv87503.ht-test.ru
URL: http://srv87503.ht-test.ru/retrieve/spool/?id=
Protocol: HTTP/1.1
Server: 78.110.50.131 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl33-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40 /
Resource Hash: c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Request headers

Referer: http://srv87503.ht-test.ru/retrieve/spool/?id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 06:12:45 GMT
X-Cache-Lookup: MISS from hc1.hts.ru:80
Last-Modified: Mon, 14 Jan 2019 03:14:44 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40
ETag: "610e685d-169d5-57f627241f100"
X-Cache: MISS from hc1.hts.ru
Content-Type: text/javascript
Accept-Ranges: bytes
Content-Length: 92629

GET
H/1.1 200
OK bootstrap.min.js Show response
srv87503.ht-test.ru/retrieve/spool/ 49 KB
50 KB 107ms
95ms Script
text/javascript 78.110.50.131
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv87503.ht-test.ru/retrieve/spool/bootstrap.min.js
Requested by: Host: srv87503.ht-test.ru
URL: http://srv87503.ht-test.ru/retrieve/spool/?id=
Protocol: HTTP/1.1
Server: 78.110.50.131 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl33-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40 /
Resource Hash: 0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339

Request headers

Referer: http://srv87503.ht-test.ru/retrieve/spool/?id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 20 Feb 2020 06:12:45 GMT
X-Cache-Lookup: MISS from hc2.hts.ru:80
Last-Modified: Mon, 14 Jan 2019 03:15:38 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/5.6.40
ETag: "610e6857-c5f4-57f627579ea80"
X-Cache: MISS from hc2.hts.ru
Content-Type: text/javascript
Accept-Ranges: bytes
Content-Length: 50676

GET
H2

200

sweetalert.min.js Show response
unpkg.com/sweetalert@2.1.2/dist/
Redirect Chain

https://unpkg.com/sweetalert/dist/sweetalert.min.js
https://unpkg.com/sweetalert@2.1.2/dist/sweetalert.min.js

40 KB
11 KB

19ms
19ms

Script
application/javascript

2606:4700::6810:7daf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/sweetalert@2.1.2/dist/sweetalert.min.js

Requested by

Host: srv87503.ht-test.ru
URL: http://srv87503.ht-test.ru/retrieve/spool/?id=

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://srv87503.ht-test.ru/retrieve/spool/?id=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 20 Feb 2020 06:12:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1115698
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
server: cloudflare
etag: W/"9f68-Kj2qvHAjLGNQq0jTJgXcSmrB8fo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: b4632d994bffa4b4d321cbcb555497e4
cache-control: public, max-age=31536000
cf-ray: 567e54aa1e226491-FRA

Redirect headers

date: Thu, 20 Feb 2020 06:12:45 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 28
status: 302
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 62
server: cloudflare
location: /sweetalert@2.1.2/dist/sweetalert.min.js
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
x-cloud-trace-context: faf186ff0dbe10fa167afd41759157be
cache-control: public, s-maxage=600, max-age=60
cf-ray: 567e54a9fe166491-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

office-f02a8.web.app
srv87503.ht-test.ru
unpkg.com
151.101.1.195
2606:4700::6810:7daf
78.110.50.131
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
0ce7fbe215cdf921ed87d00a374404681d5d24898589a7fe60e068d09289b4ba
2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b
8c6d61e2595f0ec0ad420984b258026562e9c3437011b267389e65cd0350871d
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

srv87503.ht-test.ru Open in urlscan Pro 78.110.50.131 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

33 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

325 kBTransfer

352 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

srv87503.ht-test.ru Open in urlscan Pro
78.110.50.131 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

33 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

325 kB
Transfer

352 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!