capitalone-confirmservice.com
151.248.127.112  Malicious Activity!

URL: http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Submission: On June 09 via automatic, source openphish

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 151.248.127.112, located in Russian Federation and belongs to AS-REG, RU. The main domain is capitalone-confirmservice.com.
This is the only time capitalone-confirmservice.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Domain & IP information

IP Address AS Autonomous System
3 151.248.127.112 197695 (AS-REG)
1 31.31.196.188 197695 (AS-REG)
4 3
Apex Domain
Subdomains
Transfer
4 capitalone-confirmservice.com
capitalone-confirmservice.com
49 KB
4 1
Domain Requested by
4 capitalone-confirmservice.com capitalone-confirmservice.com
4 1

This site contains links to these domains. Also see Links.

Domain
www.reg.ru
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Frame ID: 765F4702311DC56628B59411DDA6C996
Requests: 8 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
  • env /^Modernizr$/i

Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

3
IPs

1
Countries

49 kB
Transfer

152 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 43d187e01dac565e7d230a3bc8fa1229
capitalone-confirmservice.com/capitaleone/
3 KB
1 KB
Document
General
Full URL
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Protocol
HTTP/1.1
Server
151.248.127.112 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
ce3fec9b8d13b726759ab548cd22f582fb7f4f3a496847a1ab4c8f3f6ee46b7f

Request headers

Host
capitalone-confirmservice.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
765F4702311DC56628B59411DDA6C996

Response headers

Server
nginx
Date
Sat, 09 Jun 2018 19:48:28 GMT
Content-Type
text/html; charset=utf-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Content-Encoding
gzip
style.css
capitalone-confirmservice.com/hosting_static_404/
45 KB
10 KB
Stylesheet
General
Full URL
http://capitalone-confirmservice.com/hosting_static_404/style.css
Requested by
Host: capitalone-confirmservice.com
URL: http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Protocol
HTTP/1.1
Server
151.248.127.112 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
56f4838dd65531bf168be42f37133e0c5b93c84ffe0a01c2b858c9a7855f0eb0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
capitalone-confirmservice.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Connection
keep-alive
Cache-Control
no-cache
Referer
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sat, 09 Jun 2018 19:48:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2018 07:47:21 GMT
Server
nginx
ETag
W/"b4043f-b231-5636cc1c1577e"
Vary
Accept-Encoding
Content-Type
text/css
Transfer-Encoding
chunked
Connection
keep-alive
modernizr.js
capitalone-confirmservice.com/hosting_static_404/
6 KB
3 KB
Script
General
Full URL
http://capitalone-confirmservice.com/hosting_static_404/modernizr.js
Requested by
Host: capitalone-confirmservice.com
URL: http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Protocol
HTTP/1.1
Server
31.31.196.188 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
vip34.hosting.reg.ru
Software
nginx /
Resource Hash
eb3629322be83c8f2c6a43a6fd3cf9f3bc696f5bd8450c2cc421680c21762fdb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
capitalone-confirmservice.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Connection
keep-alive
Cache-Control
no-cache
Referer
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sat, 09 Jun 2018 19:48:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2018 07:47:21 GMT
Server
nginx
ETag
W/"b4044f-189a-5636cc1c16b06"
Vary
Accept-Encoding
Content-Type
text/javascript
Transfer-Encoding
chunked
Connection
keep-alive
script.js
capitalone-confirmservice.com/hosting_static_404/
94 KB
34 KB
Script
General
Full URL
http://capitalone-confirmservice.com/hosting_static_404/script.js
Requested by
Host: capitalone-confirmservice.com
URL: http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Protocol
HTTP/1.1
Server
151.248.127.112 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software
nginx /
Resource Hash
fcb94a09804ef464277ed011e4061702a46020f196b698f977ee89e26fff5ee3

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
capitalone-confirmservice.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept
*/*
Referer
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
Connection
keep-alive
Cache-Control
no-cache
Referer
http://capitalone-confirmservice.com/capitaleone/43d187e01dac565e7d230a3bc8fa1229
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date
Sat, 09 Jun 2018 19:48:28 GMT
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2018 07:47:21 GMT
Server
nginx
ETag
W/"b4044d-17838-5636cc1c18a45"
Vary
Accept-Encoding
Content-Type
text/javascript
Transfer-Encoding
chunked
Connection
keep-alive
truncated
/
443 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
56303af9365bc1e07223b08999cbcedc360e8f497850dde1b99bcea7626f84e2

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=US-ASCII
truncated
/
750 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c1f0abb48b1076aee12f5b80773fbfa9852a960a3157596a1435cc1861ff37c

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=US-ASCII
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
22e92b3a75d99f24af64202ef5f8cceea8843d5ca0a517a725c8712a512dea73

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=US-ASCII
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6908643b7f73e6e0f0d854b4ead07868066079f27454bd8532fec8a35ae5be4a

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=US-ASCII

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Modernizr object| punycode object| $dnames string| dname object| $prolongLink function| $ function| jQuery undefined| spans undefined| t undefined| text

0 Cookies