esarzt87-csera88776.freesite.host
Open in
urlscan Pro
2607:1b00:93b2:e42c::4f3d
Malicious Activity!
Public Scan
Effective URL: https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm
Submission: On April 14 via manual from SE
Summary
TLS certificate: Issued by RapidSSL RSA CA 2018 on October 3rd 2019. Valid for: 2 years.
This is the only time esarzt87-csera88776.freesite.host was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostNord AB (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 195.216.243.155 195.216.243.155 | 57724 (DDOS-GUARD) (DDOS-GUARD) | |
3 7 | 2a02:6b8::1:119 2a02:6b8::1:119 | 13238 (YANDEX) (YANDEX) | |
1 2 | 88.212.201.204 88.212.201.204 | 39134 (UNITEDNET) (UNITEDNET) | |
1 1 | 159.69.95.195 159.69.95.195 | 24940 (HETZNER-AS) (HETZNER-AS) | |
9 | 2607:1b00:93b... 2607:1b00:93b2:e42c::4f3d | 54456 (CLOUDACCE...) (CLOUDACCESS-NETWORK) | |
15 | 5 |
ASN24940 (HETZNER-AS, DE)
PTR: static.195.95.69.159.clients.your-server.de
qoo.gl |
ASN54456 (CLOUDACCESS-NETWORK, US)
esarzt87-csera88776.freesite.host |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
freesite.host
esarzt87-csera88776.freesite.host |
26 KB |
5 |
yandex.com
2 redirects
mc.yandex.com |
2 KB |
2 |
yadro.ru
1 redirects
counter.yadro.ru |
1 KB |
2 |
yandex.ru
1 redirects
mc.yandex.ru |
69 KB |
1 |
qoo.gl
1 redirects
qoo.gl |
763 B |
1 |
u.to
u.to |
1018 B |
15 | 6 |
Domain | Requested by | |
---|---|---|
9 | esarzt87-csera88776.freesite.host |
u.to
esarzt87-csera88776.freesite.host |
5 | mc.yandex.com |
2 redirects
u.to
|
2 | counter.yadro.ru |
1 redirects
u.to
|
2 | mc.yandex.ru |
1 redirects
u.to
|
1 | qoo.gl | 1 redirects |
1 | u.to | |
15 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
u.to GoGetSSL RSA DV CA |
2020-10-09 - 2021-10-09 |
a year | crt.sh |
mc.yandex.ru Yandex CA |
2021-02-27 - 2021-08-09 |
5 months | crt.sh |
counter.yadro.ru R3 |
2021-03-22 - 2021-06-20 |
3 months | crt.sh |
*.freesite.host RapidSSL RSA CA 2018 |
2019-10-03 - 2021-12-01 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm
Frame ID: 97D49E41C102C74966626085F64F8E85
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://u.to/pRM_Gw Page URL
-
https://qoo.gl/34634ER
HTTP 301
https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://u.to/pRM_Gw Page URL
-
https://qoo.gl/34634ER
HTTP 301
https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/pRM_Gw;1618386019316 HTTP 302
- https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/pRM_Gw;1618386019316
- https://mc.yandex.com/sync_cookie_image_check HTTP 302
- https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9243.w1gUHK-ODhg-rWlq8x3l6fI02_AsocLHqg2mMvvU_Gxlq_Zikg4AgQH1nVxtLuxj.ywQ2tDM9iAjVAcx0y5ja8H0ecfI%2C HTTP 302
- https://mc.yandex.com/sync_cookie_image_decide?token=9243.Uf3o1_CC8TgjQgX1fneNFDfcZJ2rE2Y-bKf2nZlSEvANC8obVelykfjsYKxgOv8lHx43G3oMBozpPJbccJ1D4w%2C%2C.dQ0icuuPYF0IZM8jLtyvAiLArmk%2C
- https://mc.yandex.com/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2FpRM_Gw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A490%3Acn%3A1%3Adp%3A0%3Als%3A448522664235%3Ahid%3A667120239%3Az%3A120%3Ai%3A20210414094019%3Aet%3A1618386020%3Ac%3A1%3Arn%3A1014747540%3Au%3A161838602075428544%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1618386019086%3Ads%3A1%2C151%2C67%2C1%2C0%2C0%2C%2C5%2C0%2C%2C%2C%2C231%3Adsn%3A1%2C151%2C67%2C1%2C0%2C0%2C%2C10%2C0%2C%2C%2C%2C231%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1618386020%3At%3ARedirecting HTTP 302
- https://mc.yandex.com/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2FpRM_Gw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A490%3Acn%3A1%3Adp%3A0%3Als%3A448522664235%3Ahid%3A667120239%3Az%3A120%3Ai%3A20210414094019%3Aet%3A1618386020%3Ac%3A1%3Arn%3A1014747540%3Au%3A161838602075428544%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1618386019086%3Ads%3A1%2C151%2C67%2C1%2C0%2C0%2C%2C5%2C0%2C%2C%2C%2C231%3Adsn%3A1%2C151%2C67%2C1%2C0%2C0%2C%2C10%2C0%2C%2C%2C%2C231%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1618386020%3At%3ARedirecting
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
pRM_Gw
u.to/ |
999 B 1018 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
mc.yandex.ru/metrika/ |
215 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hit;utostat
counter.yadro.ru/ Redirect Chain
|
43 B 496 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sync_cookie_image_decide
mc.yandex.com/ Redirect Chain
|
75 B 75 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
advert.gif
mc.yandex.com/metrika/ |
43 B 136 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1
mc.yandex.com/watch/51604940/ Redirect Chain
|
203 B 284 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.htm
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/ Redirect Chain
|
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
portal.css
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc.js
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
4 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
postnord-logo.svg
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
truck.png
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8bbe3e0c728b31fe661482b382ea90bb.png
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
318 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
StagSansWeb-Book.woff
esarzt87-csera88776.freesite.host/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
StagSansWeb-Book.ttf
esarzt87-csera88776.freesite.host/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
STAGSANS-BOOK.OTF
esarzt87-csera88776.freesite.host/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostNord AB (Transportation)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| $cc object| antiClickjack function| showError function| setFocus undefined| getQueryString function| hideElements function| onLoadPage1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
esarzt87-csera88776.freesite.host/ | Name: b7dd6d5eca666c120ffa2f81cdd1f486 Value: 93ac4841fd4c98051090e80e0f95d927 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
counter.yadro.ru
esarzt87-csera88776.freesite.host
mc.yandex.com
mc.yandex.ru
qoo.gl
u.to
159.69.95.195
195.216.243.155
2607:1b00:93b2:e42c::4f3d
2a02:6b8::1:119
88.212.201.204
197210b2bc4d27bb030f4200f49d03a61f5bb168495ff1ef889b54bfdb6465ba
21bafe5b030b6da2e39d3ea5f72f466eec4c88004d6f85597b396dd2b2136cde
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3ba73f75360efd1e119b4be51ab2d2b78eefe1a3474f8fb0608f7b876194a17d
535787c4f4449d969e06c30ed43d0fa4e730eab8d6a871f35cef8db89b784b85
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5acd5b0aefec349b8c705422b293122bb2e0e1bf77777463f565180e77ef2115
6f9905cbfe09a09e285067f5a8b4274ec35552297c16bb4612c16c5736aff117
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
a02cd135625ec71ff31f3c0784b19510bb9e3582e56258ef070be0459fe8b195
a4e97fa82cfa954d1a71c7c13e57844c718fa48859d9452be6ce1bd282ef389c
c7bb63f0f60d7bba8dcd50709e67379e3cdf663aeb1c76d8d826016bf52e8df2
e9ba89ab3b24fc114a5fa5b57008e5c57455431f82e8b05ce656d343c8fb8a4a