u575682wtz.ha003.t.justns.ru Open in urlscan Pro
2a00:b700::29  Malicious Activity! Public Scan

Submitted URL: https://billetclub.com//modules/blockcart/g.php
Effective URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Submission: On January 16 via manual from CA

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 20 HTTP transactions. The main IP is 2a00:b700::29, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u575682wtz.ha003.t.justns.ru.
This is the only time u575682wtz.ha003.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 213.186.33.40 16276 (OVH)
1 46.105.201.240 16276 (OVH)
1 192.99.8.28 16276 (OVH)
1 16 2a00:b700::29 51659 (ASBAXET)
2 23.111.9.35 33438 (HIGHWINDS2)
20 5
Domain Requested by
16 u575682wtz.ha003.t.justns.ru 1 redirects u575682wtz.ha003.t.justns.ru
2 use.fontawesome.com u575682wtz.ha003.t.justns.ru
1 s4.histats.com s10.histats.com
1 s10.histats.com billetclub.com
1 billetclub.com
20 5

This site contains no links.

Subject Issuer Validity Valid
billetclub.com
Let's Encrypt Authority X3
2020-01-14 -
2020-04-13
3 months crt.sh
histats.com
Let's Encrypt Authority X3
2019-12-27 -
2020-03-26
3 months crt.sh
*.fontawesome.com
DigiCert SHA2 Secure Server CA
2019-10-28 -
2020-12-23
a year crt.sh

This page contains 1 frames:

Primary Page: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Frame ID: 84EAD8242EDE06DC0B999933D5900D13
Requests: 20 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://billetclub.com//modules/blockcart/g.php Page URL
  2. http://u575682wtz.ha003.t.justns.ru/post/post HTTP 301
    http://u575682wtz.ha003.t.justns.ru/post/post/ Page URL
  3. http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
  • html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

25 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

202 kB
Transfer

347 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://billetclub.com//modules/blockcart/g.php Page URL
  2. http://u575682wtz.ha003.t.justns.ru/post/post HTTP 301
    http://u575682wtz.ha003.t.justns.ru/post/post/ Page URL
  3. http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • http://u575682wtz.ha003.t.justns.ru/post/post HTTP 301
  • http://u575682wtz.ha003.t.justns.ru/post/post/

20 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
g.php
billetclub.com//modules/blockcart/
763 B
692 B
Document
General
Full URL
https://billetclub.com//modules/blockcart/g.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.186.33.40 Quesnoy-sur-Deule, France, ASN16276 (OVH, FR),
Reverse DNS
cluster011.ovh.net
Software
Apache / PHP/7.2
Resource Hash
f1799a1074015fb5ff0a1f3081a0893a2bcdebd68cc5bbf44d32612ce6bc2bbf

Request headers

:method
GET
:authority
billetclub.com
:scheme
https
:path
//modules/blockcart/g.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
date
Thu, 16 Jan 2020 17:36:22 GMT
content-type
text/html; charset=UTF-8
server
Apache
x-powered-by
PHP/7.2
vary
Accept-Encoding
content-encoding
gzip
x-iplb-instance
29566
set-cookie
SERVERID104280=112095|XiCfG|XiCfG; path=/
cache-control
private
js15_as.js
s10.histats.com/
11 KB
4 KB
Script
General
Full URL
https://s10.histats.com/js15_as.js
Requested by
Host: billetclub.com
URL: https://billetclub.com//modules/blockcart/g.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668

Request headers

Referer
https://billetclub.com//modules/blockcart/g.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Thu, 16 Jan 2020 17:35:44 GMT
content-encoding
br
last-modified
Thu, 06 Dec 2018 14:12:12 GMT
x-cdn-pop-ip
51.254.41.192/26
etag
"-139234964"
x-cacheable
Matched cache
content-type
text/javascript
status
200
x-cdn-pop
rbx1
accept-ranges
bytes
content-length
4333
x-request-id
954441173
0.php
s4.histats.com/stats/
49 B
320 B
Script
General
Full URL
https://s4.histats.com/stats/0.php?4131264&@f16&@g1&@h1&@i1&@j1579196182833&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-21428229&@b3:1579196183&@b4:js15_as.js&@b5:60&@a-_0.2.1&@vhttps%3A%2F%2Fbilletclub.com%2F%2Fmodules%2Fblockcart%2Fg.php&@w
Requested by
Host: s10.histats.com
URL: https://s10.histats.com/js15_as.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.99.8.28 Richmond Hill, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns523448.ip-192-99-8.net
Software
/
Resource Hash
b4f95908468d65e7095a165e0c47f3292bb262cce35f87695af2c5c61385773d

Request headers

Referer
https://billetclub.com//modules/blockcart/g.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:23 GMT
Connection
close
Content-Length
49
Content-Type
text/html;charset=UTF-8
Cookie set /
u575682wtz.ha003.t.justns.ru/post/post/
Redirect Chain
  • http://u575682wtz.ha003.t.justns.ru/post/post
  • http://u575682wtz.ha003.t.justns.ru/post/post/
219 B
589 B
Document
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
5b3898c4e5bbec2b5c3e2fdd372c4899bbcb7e4e6f9eea10656b453d36b7f829

Request headers

Host
u575682wtz.ha003.t.justns.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Connection
Keep-Alive
Set-Cookie
PHPSESSID=b656bfda90618db4758b92db57cada8a; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Content-Type
text/html; charset-UTF-8;charset=UTF-8
Content-Length
183
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Date
Thu, 16 Jan 2020 17:36:24 GMT
Server
LiteSpeed

Redirect headers

Connection
Keep-Alive
Content-Type
text/html
Content-Length
705
Date
Thu, 16 Jan 2020 17:36:23 GMT
Server
LiteSpeed
Location
http://u575682wtz.ha003.t.justns.ru/post/post/
Vary
User-Agent
Primary Request sign-in.php
u575682wtz.ha003.t.justns.ru/post/post/
6 KB
2 KB
Document
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
a672859a31f3e9c4c9286d4fd83889c81c3cde992d8b27e911ab627c5c54d1ea

Request headers

Host
u575682wtz.ha003.t.justns.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://u575682wtz.ha003.t.justns.ru/post/post/
Accept-Encoding
gzip, deflate
Cookie
PHPSESSID=b656bfda90618db4758b92db57cada8a
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
http://u575682wtz.ha003.t.justns.ru/post/post/

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
2299
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Date
Thu, 16 Jan 2020 17:36:24 GMT
Server
LiteSpeed
jquery-latest.min.js
u575682wtz.ha003.t.justns.ru/post/post/lib/js/
94 KB
37 KB
Script
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/js/jquery-latest.min.js
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"1762a-5e208298-4d25fc72d1ee6fa6;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
37500
Expires
Thu, 23 Jan 2020 17:36:24 GMT
jquery.mask.min.js
u575682wtz.ha003.t.justns.ru/post/post/lib/js/
8 KB
4 KB
Script
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/js/jquery.mask.min.js
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"1ff9-5e208298-155d46c7a681ec3d;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
3609
Expires
Thu, 23 Jan 2020 17:36:24 GMT
Acc_Carding.js
u575682wtz.ha003.t.justns.ru/post/post/lib/js/
1 KB
826 B
Script
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/js/Acc_Carding.js
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
8ae2198685862aa7223d6992148994c2b2f5f812746c2b0cb661163e0ffd2e06

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"5b0-5e208298-1bc012c2a182baaa;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
421
Expires
Thu, 23 Jan 2020 17:36:24 GMT
chronopost.css
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
2 KB
1 KB
Stylesheet
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/chronopost.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
8f43a9f3e13f3e6e4037387a79d9df3a705d27b808fb4d346209a7a18062c011

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"78f-5e208298-2e0afc996fa0782;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
748
Expires
Thu, 23 Jan 2020 17:36:24 GMT
loading.css
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
482 B
670 B
Stylesheet
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/loading.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
be77f65264e66598326119e42d38a363c12311df7aa5b15d98717d46e098d546

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"1e2-5e208298-84b1c78a08634f15;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
279
Expires
Thu, 23 Jan 2020 17:36:24 GMT
style.css
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
3 KB
1 KB
Stylesheet
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/style.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3302f8bc164c287ddd6b68e127f573416bce177f16f4364b04a77d3de4bd4eed

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"a92-5e208298-12ff5e2c2f1b1068;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
887
Expires
Thu, 23 Jan 2020 17:36:24 GMT
stylee.css
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
7 KB
2 KB
Stylesheet
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/stylee.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"1b59-5e208298-e49ddd48478430fd;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1957
Expires
Thu, 23 Jan 2020 17:36:24 GMT
css_1.css
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
0
347 B
Stylesheet
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/css_1.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"0-5e208298-2b6621bc6d26df32;;;"
Vary
User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
0
Expires
Thu, 23 Jan 2020 17:36:24 GMT
font-awesome.min.css
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
30 KB
8 KB
Stylesheet
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/font-awesome.min.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"7918-5e208298-5a27ab8df00bcc75;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
7749
Expires
Thu, 23 Jan 2020 17:36:24 GMT
all.css
use.fontawesome.com/releases/v5.1.0/css/
45 KB
11 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.1.0/css/all.css
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Origin
http://u575682wtz.ha003.t.justns.ru

Response headers

date
Thu, 16 Jan 2020 17:36:24 GMT
content-encoding
gzip
last-modified
Wed, 20 Jun 2018 20:19:16 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
etag
W/"826c57385f3d35cfed5478ba7b1f5c03"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
status
200
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
canada-post.svg
u575682wtz.ha003.t.justns.ru/post/post/lib/img/
8 KB
3 KB
Image
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/img/canada-post.svg
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
7f0672c2b4104ffcb7aae218d58536ea2067f08f2c980177f1010ba7d761d11f

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"2198-5e208298-a60dbb39d381ace1;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2920
Expires
Thu, 23 Jan 2020 17:36:24 GMT
gov-canada-logo.svg
u575682wtz.ha003.t.justns.ru/post/post/lib/img/
14 KB
6 KB
Image
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/img/gov-canada-logo.svg
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Content-Encoding
gzip
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"37b3-5e208298-336282c3c8c0b163;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5613
Expires
Thu, 23 Jan 2020 17:36:24 GMT
Acc_mask.js
u575682wtz.ha003.t.justns.ru/post/post/lib/js/
128 B
492 B
Script
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/js/Acc_mask.js
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
15efc3fdcbaccb10adfeef693861db381e4422e739a20cd544aacdcda2b78595

Request headers

Referer
http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"80-5e208298-5f14c9df833d59f1;;;"
Vary
User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
128
Expires
Thu, 23 Jan 2020 17:36:24 GMT
PlutoSansDPDRegular-Web.woff
u575682wtz.ha003.t.justns.ru/post/post/lib/css/
59 KB
59 KB
Font
General
Full URL
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/PlutoSansDPDRegular-Web.woff
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
HTTP/1.1
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
http://u575682wtz.ha003.t.justns.ru/post/post/lib/css/chronopost.css
Origin
http://u575682wtz.ha003.t.justns.ru

Response headers

Date
Thu, 16 Jan 2020 17:36:24 GMT
Last-Modified
Thu, 16 Jan 2020 15:34:48 GMT
Server
LiteSpeed
Etag
"ea8a-5e208298-517d8743c9929a78;;;"
Vary
User-Agent
Content-Type
application/x-font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
60042
fa-solid-900.woff2
use.fontawesome.com/releases/v5.1.0/webfonts/
58 KB
59 KB
Font
General
Full URL
https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2
Requested by
Host: u575682wtz.ha003.t.justns.ru
URL: http://u575682wtz.ha003.t.justns.ru/post/post/sign-in.php?id=47471541
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://use.fontawesome.com/releases/v5.1.0/css/all.css
Origin
http://u575682wtz.ha003.t.justns.ru

Response headers

date
Thu, 16 Jan 2020 17:36:24 GMT
last-modified
Wed, 20 Jun 2018 20:19:36 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
etag
"18d2347ab2a9f40ca2247cdb03303d84"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
font/woff2
status
200
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
accept-ranges
bytes
content-length
59572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery object| $jscomp function| myFunction

1 Cookies

Domain/Path Name / Value
u575682wtz.ha003.t.justns.ru/ Name: PHPSESSID
Value: b656bfda90618db4758b92db57cada8a

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billetclub.com
s10.histats.com
s4.histats.com
u575682wtz.ha003.t.justns.ru
use.fontawesome.com
192.99.8.28
213.186.33.40
23.111.9.35
2a00:b700::29
46.105.201.240
15efc3fdcbaccb10adfeef693861db381e4422e739a20cd544aacdcda2b78595
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668
3302f8bc164c287ddd6b68e127f573416bce177f16f4364b04a77d3de4bd4eed
523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5b3898c4e5bbec2b5c3e2fdd372c4899bbcb7e4e6f9eea10656b453d36b7f829
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f0672c2b4104ffcb7aae218d58536ea2067f08f2c980177f1010ba7d761d11f
8ae2198685862aa7223d6992148994c2b2f5f812746c2b0cb661163e0ffd2e06
8f43a9f3e13f3e6e4037387a79d9df3a705d27b808fb4d346209a7a18062c011
a672859a31f3e9c4c9286d4fd83889c81c3cde992d8b27e911ab627c5c54d1ea
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
b4f95908468d65e7095a165e0c47f3292bb262cce35f87695af2c5c61385773d
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
be77f65264e66598326119e42d38a363c12311df7aa5b15d98717d46e098d546
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1799a1074015fb5ff0a1f3081a0893a2bcdebd68cc5bbf44d32612ce6bc2bbf