aprescres.moy.su Open in urlscan Pro
213.174.157.150  Malicious Activity! Public Scan

URL: https://aprescres.moy.su/page_recover.htm
Submission: On June 19 via automatic, source phishtank

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 213.174.157.150, located in Ashburn, United States and belongs to ADVANCEDHOSTERS-AS, NL. The main domain is aprescres.moy.su.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on February 21st 2019. Valid for: 2 years.
This is the only time aprescres.moy.su was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
10 213.174.157.150 39572 (ADVANCEDH...)
1 180.250.66.131 17974 (TELKOMNET...)
12 3
Apex Domain
Subdomains
Transfer
10 moy.su
aprescres.moy.su
53 KB
1 notifa.info
p02.notifa.info
993 B
12 2
Domain Requested by
10 aprescres.moy.su aprescres.moy.su
1 p02.notifa.info aprescres.moy.su
12 2

This site contains links to these domains. Also see Links.

Domain
www.help-account-n8ds4t.cf
www.000webhost.com
Subject Issuer Validity Valid
*.moy.su
Sectigo RSA Domain Validation Secure Server CA
2019-02-21 -
2021-02-20
2 years crt.sh
*.uzone.id
COMODO RSA Domain Validation Secure Server CA
2016-01-27 -
2019-01-26
3 years crt.sh

This page contains 1 frames:

Primary Page: https://aprescres.moy.su/page_recover.htm
Frame ID: 13ECEE45ED7D7548A53538F230560991
Requests: 11 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

12
Requests

83 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

54 kB
Transfer

139 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request page_recover.htm
aprescres.moy.su/
16 KB
7 KB
Document
General
Full URL
https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
6dde702e7f67cea7518c5fc8c40f92f9a98109d995f5753851fcff16496a857e

Request headers

Host
aprescres.moy.su
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server
nginx/1.8.0
Date
Wed, 19 Jun 2019 22:34:06 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Keep-Alive
timeout=15
Expires
Tue, 09 Jul 2019 22:34:06 GMT
Cache-Control
max-age=1728000
Content-Encoding
gzip
m.fb89sd9.css
aprescres.moy.su/
92 KB
22 KB
Stylesheet
General
Full URL
https://aprescres.moy.su/m.fb89sd9.css
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
aa03983922acf6ace41158ff5f013edfd9dd838dd7a0c545dd1bb413c4d562b6

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:06 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Jun 2019 19:56:37 GMT
Server
nginx/1.8.0
ETag
W/"5d0a9375-16f4b"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=1728000
Connection
keep-alive
Keep-Alive
timeout=15
Expires
Tue, 09 Jul 2019 22:34:06 GMT
m.fb897f65y.css
aprescres.moy.su/
9 KB
3 KB
Stylesheet
General
Full URL
https://aprescres.moy.su/m.fb897f65y.css
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
82c3d06b01cbc3aee305004063648b0fd400faf77a6aa1974e0781b04b350190

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:06 GMT
Content-Encoding
gzip
Last-Modified
Wed, 19 Jun 2019 19:56:37 GMT
Server
nginx/1.8.0
ETag
W/"5d0a9375-23b6"
Transfer-Encoding
chunked
Content-Type
text/css
Cache-Control
max-age=1728000
Connection
keep-alive
Keep-Alive
timeout=15
Expires
Tue, 09 Jul 2019 22:34:06 GMT
IoU6C6Z1Eqy.js.download
aprescres.moy.su/
0
0
Script
General
Full URL
https://aprescres.moy.su/IoU6C6Z1Eqy.js.download
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://aprescres.moy.su/page_recover.htm
Origin
https://aprescres.moy.su

Response headers

Date
Wed, 19 Jun 2019 22:34:06 GMT
Content-Encoding
gzip
Server
nginx/1.8.0
Connection
keep-alive
Keep-Alive
timeout=15
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
request
aprescres.moy.su/
0
0
Script
General
Full URL
https://aprescres.moy.su/request
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:06 GMT
Content-Encoding
gzip
Server
nginx/1.8.0
Connection
keep-alive
Keep-Alive
timeout=15
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
F8n3WrEc0r.png
aprescres.moy.su/
6 KB
7 KB
Image
General
Full URL
https://aprescres.moy.su/F8n3WrEc0r.png
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
91252e877e09c401110e603eaf0ff8eb78f7e38c1316db14f131fcb3f896bbb4

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:06 GMT
Last-Modified
Wed, 19 Jun 2019 19:56:37 GMT
Server
nginx/1.8.0
ETag
"5d0a9375-18bb"
Content-Type
image/png
Cache-Control
max-age=1728000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
6331
Expires
Tue, 09 Jul 2019 22:34:06 GMT
hsts-pixel.gif
aprescres.moy.su/
43 B
374 B
Image
General
Full URL
https://aprescres.moy.su/hsts-pixel.gif
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:07 GMT
Last-Modified
Wed, 19 Jun 2019 19:56:37 GMT
Server
nginx/1.8.0
ETag
"5d0a9375-2b"
Content-Type
image/gif
Cache-Control
max-age=1728000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
43
Expires
Tue, 09 Jul 2019 22:34:07 GMT
footer-powered-by-000webhost-white2.webp
aprescres.moy.su/
2 KB
2 KB
Image
General
Full URL
https://aprescres.moy.su/footer-powered-by-000webhost-white2.webp
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:07 GMT
Last-Modified
Wed, 19 Jun 2019 19:56:37 GMT
Server
nginx/1.8.0
ETag
"5d0a9375-6a0"
Content-Type
application/octet-stream
Cache-Control
max-age=1728000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=15
Content-Length
1696
Expires
Tue, 09 Jul 2019 22:34:07 GMT
fb9hHvqMKNN.png
aprescres.moy.su/vimg/
7 KB
7 KB
Image
General
Full URL
https://aprescres.moy.su/vimg/fb9hHvqMKNN.png
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
f0b1b29de07d2f831f4978036ded359f60063eeba22a2d50c66978f3ff896df4

Request headers

Referer
https://aprescres.moy.su/page_recover.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:07 GMT
Content-Encoding
gzip
Server
nginx/1.8.0
Connection
keep-alive
Keep-Alive
timeout=15
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Yw0RiQgp0g-.png
aprescres.moy.su/rsrc.php/v3/yT/r/
7 KB
7 KB
Image
General
Full URL
https://aprescres.moy.su/rsrc.php/v3/yT/r/Yw0RiQgp0g-.png
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.174.157.150 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
s101.ucoz.net
Software
nginx/1.8.0 /
Resource Hash
f0b1b29de07d2f831f4978036ded359f60063eeba22a2d50c66978f3ff896df4

Request headers

Referer
https://aprescres.moy.su/m.fb89sd9.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 19 Jun 2019 22:34:07 GMT
Content-Encoding
gzip
Server
nginx/1.8.0
Connection
keep-alive
Keep-Alive
timeout=15
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
request
p02.notifa.info/3fsmd3/
393 B
993 B
Script
General
Full URL
https://p02.notifa.info/3fsmd3/request?id=1&enc=9UwkxLgY9&params=4TtHaUQnUEiP6K%2fc5C582JKzDzTsXZH2I%2f4s6DCJAIEuSVOGSbLf1iVWqzSvxLgMzAm2xywBWIA0v5DO20c8JCyb9zo1JzUj6AKfjNgwkL37iBdQE1jcv5VWpYB%2fVJRoS3n42hCz6StPYKveilihIWWbUYsuhbiSGswGWMAMtf%2bbek82LelGcTZzw09v6pFRJTy2S25oTqrc%2bQDyDEIwPPCnFDlwRWAGoRkkdE1HE4Nij8Zxh4TYPW8JORLZEA%2bPvPTQPYNnVgpKGnOfgL7bffqL%2b8WZLDTOUid%2fyI99mGO9GU6WfZTIL7Bz%2fHKWt%2fTwiqa86Q1%2bbxgXgEKPNo29wJwri15Pgvv3cndFCae%2b%2bI671n2hV7NpwXabT%2fIVs%2fQuih8Jpo9jfVM%2b%2fSVDG7uNSkW5zuXIeYQWG7vqJTMf8NyYE1GhcJCq%2fIDPfK2LHb8FNMnX0EjDjSb90Eg%2bKjxt3TwejQsrmKVCW8WpUD%2bN05cRos1Otq5FfANFMW%2b2M3M9c3M6HvQ6tqA0HztjyAimH3spe71wV6lHgOPc%2bnWSD4FYNIZ7xa%2fTpQM4n169Y%2bTPCLdy6bLszATwJ3CducQDHzOMsfOUM9g3nGaf8uSvfckBwApA3Uu5zvYLmiQCqGZr&idc_r=13762146131&domain=aprescres.moy.su&sw=1600&sh=1200
Requested by
Host: aprescres.moy.su
URL: https://aprescres.moy.su/page_recover.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
180.250.66.131 Jakarta, Indonesia, ASN17974 (TELKOMNET-AS2-AP PT Telekomunikasi Indonesia, ID),
Reverse DNS
131.subnet180-250-66.speedy.telkom.net.id
Software
/
Resource Hash
4bed72f44e8337fb4f0afe4e1567ba1a5cf11e6ca01d3d2d5ef286f46dbe5ad6
Security Headers
Name Value
Strict-Transport-Security max-age=1

Request headers

Referer
https://aprescres.moy.su/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 19 Jun 2019 22:32:41 GMT
Content-Encoding
gzip
Vary
Accept-Encoding, Accept-Encoding
Connection
keep-alive
Content-Type
text/javascript
Cache-Control
no-cache, no-store, must-revalidate
Transfer-Encoding
chunked
Strict-Transport-Security
max-age=1
Expires
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| envFlush object| Env number| __DEV__ function| CavalryLogger function| __updateOrientation function| mousedwn function| netbro_cache_analytics function| sync function| requestCfs function| loadFrame

0 Cookies