gorod-my.com.ua - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 195.191.24.196, located in Ukraine and belongs to HOSTPRO-AS, UA. The main domain is gorod-my.com.ua.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 9th 2017. Valid for: 3 months.

This is the only time gorod-my.com.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 5	195.191.24.196 195.191.24.196	196645 (HOSTPRO-AS) (HOSTPRO-AS)
1	107.161.23.28 107.161.23.28	3842 (RAMNODE) (RAMNODE - RamNode LLC)
5	2

5 195.191.24.196 (Ukraine) 1 redirects

ASN196645 (HOSTPRO-AS, UA)
PTR: skm111.hostsila.org

gorod-my.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.161.23.28 (Macon, United States)

ASN3842 (RAMNODE - RamNode LLC, US)
PTR: atlshared3.ramnode.com

vaincode.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	gorod-my.com.ua 1 redirects gorod-my.com.ua	243 B
1	vaincode.com vaincode.com
5	2

	Domain	Requested by
5	gorod-my.com.ua	1 redirects gorod-my.com.ua
1	vaincode.com	gorod-my.com.ua
5	2

This site contains no links.

Subject Issuer	Validity	Valid
gorod-my.com.ua Let's Encrypt Authority X3	`2017-12-09` - `2018-03-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php
Frame ID: (39ED75E24E356329889AAC88C71E9277)
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php HTTP 302
https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php Page URL
https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

0 kB
Transfer

170 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php HTTP 302
https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php Page URL
https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php HTTP 302
https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	process1.php Show response gorod-my.com.ua/cache/mod_banners/poc/aple/rot/ Redirect Chain http://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php	876 B 0	234ms 152ms	Document text/html	195.191.24.196 HOSTPRO-AS
General Check archive.org Show headers Download Go to Full URL https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.191.24.196 , Ukraine, ASN196645 (HOSTPRO-AS, UA), Reverse DNS skm111.hostsila.org Software nginx / PHP/5.2.17 Resource Hash `497fa540a7e00634c79c5818674c1fac7dbd12bf3589ee63bb581770d933ccef` Request headers :path /cache/mod_banners/poc/aple/rot/process1.php accept-encoding gzip, deflate upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 :authority gorod-my.com.ua :scheme https :method GET User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers status 200 date Wed, 27 Dec 2017 04:11:56 GMT content-encoding gzip server nginx x-powered-by PHP/5.2.17 content-type text/html Redirect headers Location https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php Date Wed, 27 Dec 2017 04:11:55 GMT Server nginx Connection keep-alive Content-Length 251 Content-Type text/html; charset=iso-8859-1
GET H2	200	process.gif gorod-my.com.ua/cache/mod_banners/poc/aple/rot/img/	4 KB 0	34ms 34ms	Image image/gif	195.191.24.196 HOSTPRO-AS
General Check archive.org Show headers Download Go to Show image Full URL https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/img/process.gif Requested by Host: gorod-my.com.ua URL: https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.191.24.196 , Ukraine, ASN196645 (HOSTPRO-AS, UA), Reverse DNS skm111.hostsila.org Software nginx / Resource Hash `90e87b61b1413986fbe5fd642252b7b459407b4287394c76bd619ab05f8b0c69` Request headers :path /cache/mod_banners/poc/aple/rot/img/process.gif pragma no-cache accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority gorod-my.com.ua referer https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php :scheme https :method GET Referer https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma public date Wed, 27 Dec 2017 04:11:56 GMT last-modified Sat, 03 Jan 2015 19:08:58 GMT server nginx etag "54a83e4a-1072" content-type image/gif status 200 cache-control max-age=2592000 public, must-revalidate, proxy-revalidate accept-ranges bytes content-length 4210 expires Fri, 26 Jan 2018 04:11:56 GMT
GET H/1.1	404 Not Found	2.png vaincode.com/a/img/	0 0	402ms 106ms	Image text/html	107.161.23.28 RamNode LLC
General Check archive.org Show headers Download Go to Show image Full URL http://vaincode.com/a/img/2.png Requested by Host: gorod-my.com.ua URL: https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php Protocol HTTP/1.1 Server 107.161.23.28 Macon, United States, ASN3842 (RAMNODE - RamNode LLC, US), Reverse DNS atlshared3.ramnode.com Software LiteSpeed / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept image/webp,image/apng,image/,/;q=0.8 Pragma* no-cache Connection keep-alive Accept-Encoding gzip, deflate Host vaincode.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Pragma no-cache Date Wed, 27 Dec 2017 04:12:00 GMT Server LiteSpeed Content-Type text/html Cache-Control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Accept-Ranges bytes Content-Length 1148
GET H2	200	Primary Request card.php Show response gorod-my.com.ua/cache/mod_banners/poc/aple/rot/	4 KB 0	60ms 60ms	Document text/html	195.191.24.196 HOSTPRO-AS
General Check archive.org Show headers Download Go to Full URL https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.191.24.196 , Ukraine, ASN196645 (HOSTPRO-AS, UA), Reverse DNS skm111.hostsila.org Software nginx / PHP/5.2.17 Resource Hash `d0e89bb71f889d3667c35717f7faec06aff31097b2acd7f639a6c1dac0cb777b` Request headers :path /cache/mod_banners/poc/aple/rot/card.php pragma no-cache accept-encoding gzip, deflate upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 cache-control no-cache :authority gorod-my.com.ua referer https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php :scheme https :method GET Upgrade-Insecure-Requests 1 Referer https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/process1.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma no-cache date Wed, 27 Dec 2017 04:11:58 GMT content-encoding gzip server nginx x-powered-by PHP/5.2.17 content-type text/html status 200 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 set-cookie PHPSESSID=rvb1i10qir8la8k4bma9ttslq7; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	bg3.png gorod-my.com.ua/cache/mod_banners/poc/aple/rot/img/	161 KB 0	68ms 68ms	Image image/png	195.191.24.196 HOSTPRO-AS
General Check archive.org Show headers Download Go to Show image Full URL https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/img/bg3.png Requested by Host: gorod-my.com.ua URL: https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 195.191.24.196 , Ukraine, ASN196645 (HOSTPRO-AS, UA), Reverse DNS skm111.hostsila.org Software nginx / Resource Hash `f944d48d48cc49f15202e964306f14acd3bcf44c56ca73d821ee27bc48109255` Request headers :path /cache/mod_banners/poc/aple/rot/img/bg3.png pragma no-cache cookie PHPSESSID=rvb1i10qir8la8k4bma9ttslq7 accept-encoding gzip, deflate user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 accept image/webp,image/apng,image/,/;q=0.8 cache-control* no-cache :authority gorod-my.com.ua referer https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php :scheme https :method GET Referer https://gorod-my.com.ua/cache/mod_banners/poc/aple/rot/card.php User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma public date Wed, 27 Dec 2017 04:11:58 GMT last-modified Fri, 19 Feb 2016 09:34:26 GMT server nginx etag "56c6e1a2-282db" content-type image/png status 200 cache-control max-age=2592000 public, must-revalidate, proxy-revalidate accept-ranges bytes content-length 164571 expires Fri, 26 Jan 2018 04:11:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			gorod-my.com.ua/	1970-01-01 00:00:00	Name: PHPSESSID Value: rvb1i10qir8la8k4bma9ttslq7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gorod-my.com.ua
vaincode.com
107.161.23.28
195.191.24.196
497fa540a7e00634c79c5818674c1fac7dbd12bf3589ee63bb581770d933ccef
90e87b61b1413986fbe5fd642252b7b459407b4287394c76bd619ab05f8b0c69
d0e89bb71f889d3667c35717f7faec06aff31097b2acd7f639a6c1dac0cb777b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f944d48d48cc49f15202e964306f14acd3bcf44c56ca73d821ee27bc48109255

gorod-my.com.ua Open in urlscan Pro 195.191.24.196 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

0 kBTransfer

170 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

gorod-my.com.ua Open in urlscan Pro
195.191.24.196 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

0 kB
Transfer

170 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!