614807.selcdn.ru Open in urlscan Pro
2a00:ab00:0:12::238  Malicious Activity! Private Scan

Submitted URL: http://614807.selcdn.ru/jdon222/roman55.html#v.sales@damennaval.com
Effective URL: http://614807.selcdn.ru/jdon222/roman55.html
Submission: On October 31 via api from US — Scanned from DE

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 7 HTTP transactions. The main IP is 2a00:ab00:0:12::238, located in Russian Federation and belongs to SELECTEL, RU. The main domain is 614807.selcdn.ru.
This is the only time 614807.selcdn.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 2a00:ab00:0:1... 49505 (SELECTEL)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
2 2a00:1450:400... 15169 (GOOGLE)
1 173.208.219.13 32097 (WII)
1 1 137.117.218.101 8075 (MICROSOFT...)
1 2 2620:1ec:46::44 8068 (MICROSOFT...)
7 6
Apex Domain
Subdomains
Transfer
2 damen.com
www.damen.com
282 B
2 google.com
www.google.com
2 KB
1 damennaval.com
www.damennaval.com
349 B
1 pngitem.com
www.pngitem.com
55 KB
1 jquery.com
code.jquery.com
33 KB
1 selcdn.ru
614807.selcdn.ru
10 KB
7 6
Domain Requested by
2 www.damen.com 1 redirects 614807.selcdn.ru
2 www.google.com 614807.selcdn.ru
1 www.damennaval.com 1 redirects
1 www.pngitem.com 614807.selcdn.ru
1 code.jquery.com 614807.selcdn.ru
1 614807.selcdn.ru
7 6

This site contains no links.

Subject Issuer Validity Valid
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh
www.google.com
GTS CA 1C3
2021-10-04 -
2021-12-27
3 months crt.sh
pngitem.com
R3
2021-08-09 -
2021-11-07
3 months crt.sh
*.damen.com
GeoTrust TLS RSA CA G1
2021-02-17 -
2022-02-16
a year crt.sh

This page contains 2 frames:

Primary Page: http://614807.selcdn.ru/jdon222/roman55.html
Frame ID: 28D6B873C3CAAB909481F9B754038CCD
Requests: 7 HTTP requests in this frame

Frame: https://www.damen.com/companies/damen-schelde-naval-shipbuilding
Frame ID: FB6990608A4FC92A9AF2D1B934D3994B
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Webmail Portal Login - damennaval.com

Page Statistics

7
Requests

71 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

6
IPs

4
Countries

100 kB
Transfer

159 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://www.damennaval.com/ HTTP 307
  • http://www.damen.com/companies/damen-schelde-naval-shipbuilding HTTP 301
  • https://www.damen.com/companies/damen-schelde-naval-shipbuilding

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request roman55.html
614807.selcdn.ru/jdon222/
9 KB
10 KB
Document
General
Full URL
http://614807.selcdn.ru/jdon222/roman55.html
Protocol
HTTP/1.1
Server
2a00:ab00:0:12::238 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
/
Resource Hash
2b07aa08c38111a52ebd558f2df482aed53faa269521108b94e38d6da48b39e6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges
Content-Length
9550
Content-Type
text/html
Etag
"ae1e9527ae09063d2be25bf7fc44f8dc"
Last-Modified
Thu, 28 Oct 2021 23:58:37 GMT
X-Timestamp
1635465516.21139
X-Trans-Id
16b25738d0081e0c
Date
Sun, 31 Oct 2021 00:20:19 GMT
Age
18645
jquery-1.11.1.min.js
code.jquery.com/
94 KB
33 KB
Script
General
Full URL
https://code.jquery.com/jquery-1.11.1.min.js
Requested by
Host: 614807.selcdn.ru
URL: http://614807.selcdn.ru/jdon222/roman55.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://614807.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 05:31:03 GMT
content-encoding
gzip
last-modified
Fri, 24 Oct 2014 00:16:07 GMT
server
nginx
etag
W/"54499a47-1762a"
vary
Accept-Encoding
x-hw
1635658263.dop215.fr8.t,1635658263.cds224.fr8.hn,1635658263.cds227.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
33202
favicons
www.google.com/s2/
492 B
1 KB
Image
General
Full URL
https://www.google.com/s2/favicons?domain=biofactlife.com
Requested by
Host: 614807.selcdn.ru
URL: http://614807.selcdn.ru/jdon222/roman55.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-NaLNrqB8lUT2Vm0zanuYTQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-NaLNrqB8lUT2Vm0zanuYTQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport, require-trusted-types-for 'script';report-uri /s2/_/FaviconHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://614807.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 04:51:03 GMT
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin
age
2400
x-frame-options
SAMEORIGIN
content-type
image/png
cache-control
public, max-age=28800
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'report-sample' 'nonce-NaLNrqB8lUT2Vm0zanuYTQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-NaLNrqB8lUT2Vm0zanuYTQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport, require-trusted-types-for 'script';report-uri /s2/_/FaviconHttp/cspreport
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
492
x-xss-protection
0
expires
Sun, 31 Oct 2021 12:51:03 GMT
26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
www.pngitem.com/pimgs/m/
55 KB
55 KB
Image
General
Full URL
https://www.pngitem.com/pimgs/m/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
Requested by
Host: 614807.selcdn.ru
URL: http://614807.selcdn.ru/jdon222/roman55.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.208.219.13 Kansas City, United States, ASN32097 (WII, US),
Reverse DNS
angle.excellentfixmemory.us
Software
nginx/1.14.0 /
Resource Hash
42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://614807.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date
Sun, 31 Oct 2021 05:31:03 GMT
Last-Modified
Tue, 15 Oct 2019 13:09:45 GMT
Server
nginx/1.14.0
ETag
"5da5c519-db2d"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
56109
truncated
/
558 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://614807.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
520 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://614807.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type
image/png
damen-schelde-naval-shipbuilding
www.damen.com/companies/ Frame FB69
Redirect Chain
  • https://www.damennaval.com/
  • http://www.damen.com/companies/damen-schelde-naval-shipbuilding
  • https://www.damen.com/companies/damen-schelde-naval-shipbuilding
0
0
Document
General
Full URL
https://www.damen.com/companies/damen-schelde-naval-shipbuilding
Requested by
Host: 614807.selcdn.ru
URL: http://614807.selcdn.ru/jdon222/roman55.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::44 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ Next.js
Resource Hash
Security Headers
Name Value
Content-Security-Policy connect-src 'self' https://gapi.storyblok.com/v1/api https://consent.cookie-script.com wss://*.hotjar.com http://app.storyblok.com https://app.storyblok.com/f/storyblok-latest.js https://player.vimeo.com/api/player.js http://static.hotjar.com/c/ https://www.googletagmanager.com/gtm.js https://eu2.cdn.thunderhead.com/one/rt/js/one-tag.js https://connect.facebook.net/en_US/fbevents.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com https://script.hotjar.com/ https://vars.hotjar.com/ https://connect.facebook.net https://script.hotjar.com https://player.vimeo.com https://www.google-analytics.com https://in.hotjar.com *.hotjar.com https://vc.hotjar.io *.thunderhead.com https://dxp-acc-apollo.azurewebsites.net https://dxp-dev-apollo.azurewebsites.net https://dxp-prd-apollo.azurewebsites.net https://dxp-tst-apollo.azurewebsites.net https://api.mapbox.com/ https://events.mapbox.com/ https://stats.g.doubleclick.net/; default-src 'self'; font-src 'self' https://fonts.gstatic.com; frame-src https://player.vimeo.com https://www.youtube-nocookie.com https://www.youtube.com https://vars.hotjar.com https://www.google.com https://www.recaptcha.net; img-src 'self' http://a.storyblok.com https://res.cloudinary.com https://img2.storyblok.com https://px.ads.linkedin.com/collect https://www.google-analytics.com/collect https://www.facebook.com https://connect.facebook.com *.thunderhead.com data:; style-src 'self' 'unsafe-inline' https://app.storyblok.com https://app.storyblok.com/f/blokeditor.css https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/normalize.min.css https://fonts.googleapis.com/css2; script-src 'self' 'nonce-WmNFB1' http://app.storyblok.com https://app.storyblok.com/f/storyblok-latest.js https://player.vimeo.com/api/player.js http://static.hotjar.com/c/ https://www.googletagmanager.com/gtm.js https://eu2.cdn.thunderhead.com/one/rt/js/one-tag.js https://connect.facebook.net/en_US/fbevents.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com https://script.hotjar.com/ https://vars.hotjar.com/ https://connect.facebook.net https://script.hotjar.com https://player.vimeo.com https://www.google-analytics.com https://in.hotjar.com *.hotjar.com https://vc.hotjar.io *.thunderhead.com https://www.recaptcha.net https://www.gstatic.com/ *.cookie-script.com blob:; frame-ancestors http://app.storyblok.com
Strict-Transport-Security max-age=63072000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

cache-control
s-maxage=60, stale-while-revalidate
content-type
text/html; charset=utf-8
content-encoding
gzip
etag
"50801-G3rnY9GOJAMKeVynWw2dQ12YE6o"
vary
Accept-Encoding
content-security-policy
connect-src 'self' https://gapi.storyblok.com/v1/api https://consent.cookie-script.com wss://*.hotjar.com http://app.storyblok.com https://app.storyblok.com/f/storyblok-latest.js https://player.vimeo.com/api/player.js http://static.hotjar.com/c/ https://www.googletagmanager.com/gtm.js https://eu2.cdn.thunderhead.com/one/rt/js/one-tag.js https://connect.facebook.net/en_US/fbevents.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com https://script.hotjar.com/ https://vars.hotjar.com/ https://connect.facebook.net https://script.hotjar.com https://player.vimeo.com https://www.google-analytics.com https://in.hotjar.com *.hotjar.com https://vc.hotjar.io *.thunderhead.com https://dxp-acc-apollo.azurewebsites.net https://dxp-dev-apollo.azurewebsites.net https://dxp-prd-apollo.azurewebsites.net https://dxp-tst-apollo.azurewebsites.net https://api.mapbox.com/ https://events.mapbox.com/ https://stats.g.doubleclick.net/; default-src 'self'; font-src 'self' https://fonts.gstatic.com; frame-src https://player.vimeo.com https://www.youtube-nocookie.com https://www.youtube.com https://vars.hotjar.com https://www.google.com https://www.recaptcha.net; img-src 'self' http://a.storyblok.com https://res.cloudinary.com https://img2.storyblok.com https://px.ads.linkedin.com/collect https://www.google-analytics.com/collect https://www.facebook.com https://connect.facebook.com *.thunderhead.com data:; style-src 'self' 'unsafe-inline' https://app.storyblok.com https://app.storyblok.com/f/blokeditor.css https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/normalize.min.css https://fonts.googleapis.com/css2; script-src 'self' 'nonce-WmNFB1' http://app.storyblok.com https://app.storyblok.com/f/storyblok-latest.js https://player.vimeo.com/api/player.js http://static.hotjar.com/c/ https://www.googletagmanager.com/gtm.js https://eu2.cdn.thunderhead.com/one/rt/js/one-tag.js https://connect.facebook.net/en_US/fbevents.js https://snap.licdn.com/li.lms-analytics/insight.min.js https://www.google-analytics.com https://script.hotjar.com/ https://vars.hotjar.com/ https://connect.facebook.net https://script.hotjar.com https://player.vimeo.com https://www.google-analytics.com https://in.hotjar.com *.hotjar.com https://vc.hotjar.io *.thunderhead.com https://www.recaptcha.net https://www.gstatic.com/ *.cookie-script.com blob:; frame-ancestors http://app.storyblok.com
strict-transport-security
max-age=63072000
x-frame-options
deny
x-download-options
noopen
x-content-type-options
nosniff
referrer-policy
same-origin
x-xss-protection
1
x-powered-by
Next.js
x-cache
CONFIG_NOCACHE
x-azure-ref
0GCp+YQAAAAA5n2iIiHDPQI2tHK5JoPSfQU1TMDRFREdFMTgyMABhN2UxMjI2Mi0xNjczLTQ4YzktODk4Yi0wMmFkNWQ2YjdiMzE=
date
Sun, 31 Oct 2021 05:31:04 GMT

Redirect headers

Location
https://www.damen.com/companies/damen-schelde-naval-shipbuilding
X-Azure-Ref
0GCp+YQAAAACgwykLGjJHRZkxh/h45mhhQU1TMDRFREdFMTgxOQBhN2UxMjI2Mi0xNjczLTQ4YzktODk4Yi0wMmFkNWQ2YjdiMzE=
Date
Sun, 31 Oct 2021 05:31:03 GMT
Content-Length
0
favicons
www.google.com/s2/
273 B
1 KB
Image
General
Full URL
https://www.google.com/s2/favicons?domain=damennaval.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
123c317496ac01b04f8c2e54cd0a39315ec98ab5e07e479704c8bfa23211c393
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /s2/_/FaviconHttp/cspreport, script-src 'report-sample' 'nonce-JLSd2XeP1K7TFjeqKm4+UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-JLSd2XeP1K7TFjeqKm4+UQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://614807.selcdn.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date
Sun, 31 Oct 2021 05:31:04 GMT
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin; report-to="FaviconHttp"
x-frame-options
SAMEORIGIN
report-to
{"group":"FaviconHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/FaviconHttp/external"}]}
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
content-security-policy
require-trusted-types-for 'script';report-uri /s2/_/FaviconHttp/cspreport, script-src 'report-sample' 'nonce-JLSd2XeP1K7TFjeqKm4+UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /s2/_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-JLSd2XeP1K7TFjeqKm4+UQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /s2/_/FaviconHttp/cspreport
content-type
image/png
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Sun, 31 Oct 2021 05:31:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery object| _0x29a3 function| _0x40b2 function| _0x2e20a0 string| hash number| n function| goNow

2 Cookies

Domain/Path Name / Value
.www.damennaval.com/ Name: ARRAffinitySameSite
Value: 35fbc4bf1e1481cf080cbb56028396449132b7b3e0d1ed88b47e0f5a8250823d
.google.com/ Name: NID
Value: 511=XElWyQWcKDj_LmVBSbbQxe1Vt0DBTTrcf68o6mbAzh_t7ZqeK1div-TWaMbrIEn40gg9nqc2cr3EIIEcuHPmYFzrnHnPPUR-bdQTIDYhf-GUU2lWFfkY5COQJoIG_STU3egEDaqYcr7pc0wL5GVnBJIvW-d8z2gB-PIdG55YoQM

1 Console Messages

Source Level URL
Text
security error
Message:
Refused to frame 'https://www.damen.com/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors http://app.storyblok.com".