urlscan.io logo urlscan.io
SecurityTrails logo

zbyhpworkstation.com Open in urlscan Pro
45.138.157.223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://holodokvsegda.ru/
Effective URL: https://zbyhpworkstation.com/c44hc47r/
Submission: On May 23 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 45.138.157.223, located in Moscow, Russian Federation and belongs to STARK-INDUSTRIES, GB. The main domain is zbyhpworkstation.com.
TLS certificate: Issued by R3 on May 21st 2024. Valid for: 3 months.
This is the only time zbyhpworkstation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
1 1 2a00:f940:2:2... 197695 (AS-REG)
7 45.138.157.223 44477 (STARK-IND...)
8 2
Apex Domain
Subdomains		 Transfer
7 zbyhpworkstation.com
zbyhpworkstation.com
470 KB
1 holodokvsegda.ru
holodokvsegda.ru
85 B
8 2
Domain Requested by
7 zbyhpworkstation.com zbyhpworkstation.com
1 holodokvsegda.ru 1 redirects
8 2

This site contains no links.

Subject Issuer Validity Valid
zbyhpworkstation.com
R3		 2024-05-21 -
2024-08-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://zbyhpworkstation.com/c44hc47r/
Frame ID: 0EB03FEF1A2A734E4F676D3533A48F4F
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Главная

Page URL History Show full URLs

  1. http://holodokvsegda.ru/ HTTP 307
    https://holodokvsegda.ru/ HTTP 301
    https://zbyhpworkstation.com/c44hc47r/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

8
Requests

88 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

470 kB
Transfer

467 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://holodokvsegda.ru/ HTTP 307
    https://holodokvsegda.ru/ HTTP 301
    https://zbyhpworkstation.com/c44hc47r/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
zbyhpworkstation.com/c44hc47r/
Redirect Chain
  • http://holodokvsegda.ru/
  • https://holodokvsegda.ru/
  • https://zbyhpworkstation.com/c44hc47r/
355 B
758 B 		Document
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/c44hc47r/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
cbb20c331c87e6d25481d5e56ad9a2202eb9757af4e171104a961b92960b6093

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
access-control-max-age
3628800
cache-control
public, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 23 May 2024 09:39:36 GMT
etag
W/"163-18defcef008"
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall

Redirect headers

content-type
text/html
date
Thu, 23 May 2024 09:39:35 GMT
location
https://zbyhpworkstation.com/c44hc47r/
server
nginx
index-affbc48c.js
zbyhpworkstation.com/c44hc47r/assets/ 		265 KB
265 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/c44hc47r/assets/index-affbc48c.js
Requested by
Host: zbyhpworkstation.com
URL: https://zbyhpworkstation.com/c44hc47r/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
2a32f987b6641bef1e3da0af267d4de2b3c753275409fcb0d85ae36725a064f8

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://zbyhpworkstation.com/c44hc47r/
Origin
https://zbyhpworkstation.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 23 May 2024 09:39:36 GMT
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
etag
W/"42200-18defcef008"
access-control-max-age
3628800
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
270848
index-62abddb2.css
zbyhpworkstation.com/c44hc47r/assets/ 		202 KB
202 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/c44hc47r/assets/index-62abddb2.css
Requested by
Host: zbyhpworkstation.com
URL: https://zbyhpworkstation.com/c44hc47r/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
62abddb23181d4e77fbeec5b5bc80f6577b46da5a2be68c08dc26880f65e4cd6

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://zbyhpworkstation.com/c44hc47r/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 23 May 2024 09:39:36 GMT
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
etag
W/"3271d-18defcef008"
access-control-max-age
3628800
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
206621
/
zbyhpworkstation.com/socket.io/ 		118 B
469 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/socket.io/?EIO=4&transport=polling&t=O-aqV-E
Requested by
Host: zbyhpworkstation.com
URL: https://zbyhpworkstation.com/c44hc47r/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
829925dfef5b857b7b2e08937abf155b91092eb4cb59c036239ce760553bb39d

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept
*/*
Referer
https://zbyhpworkstation.com/c44hc47r/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 23 May 2024 09:39:37 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
118
favicon.ico
zbyhpworkstation.com/ 		0
0
/
zbyhpworkstation.com/socket.io/ 		2 B
339 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/socket.io/?EIO=4&transport=polling&t=O-aqW1Q&sid=IjsDGebgm0oUvMboAlid
Requested by
Host: zbyhpworkstation.com
URL: https://zbyhpworkstation.com/c44hc47r/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-type
text/plain;charset=UTF-8
Accept
*/*
Referer
https://zbyhpworkstation.com/c44hc47r/
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 23 May 2024 09:39:37 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/html
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
2
/
zbyhpworkstation.com/socket.io/ 		32 B
382 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/socket.io/?EIO=4&transport=polling&t=O-aqW1R&sid=IjsDGebgm0oUvMboAlid
Requested by
Host: zbyhpworkstation.com
URL: https://zbyhpworkstation.com/c44hc47r/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
71d818f2ccf2c43cfd03f36d9567e445c0cbcc53702a185e7f01017b31769df5

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept
*/*
Referer
https://zbyhpworkstation.com/c44hc47r/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 23 May 2024 09:39:37 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
32
/
zbyhpworkstation.com/socket.io/ 		1 B
350 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://zbyhpworkstation.com/socket.io/?EIO=4&transport=polling&t=O-aqW4g&sid=IjsDGebgm0oUvMboAlid
Requested by
Host: zbyhpworkstation.com
URL: https://zbyhpworkstation.com/c44hc47r/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
45.138.157.223 Moscow, Russian Federation, ASN44477 (STARK-INDUSTRIES, GB),
Reverse DNS
vm2528763.stark-industries.solutions
Software
stormwall /
Resource Hash
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept
*/*
Referer
https://zbyhpworkstation.com/c44hc47r/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 23 May 2024 09:39:37 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
zbyhpworkstation.com
URL
https://zbyhpworkstation.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| __VUE__

1 Cookies

Domain/Path Name / Value
zbyhpworkstation.com/ Name: Auth
Value: 90e6891c98dc12cbcf6853505065b069

1 Console Messages

Source Level URL
Text
network error URL: https://zbyhpworkstation.com/favicon.ico
Message:
Failed to load resource: net::ERR_HTTP2_PROTOCOL_ERROR