ics.099282-client.nl
Open in
urlscan Pro
2a01:7c8:eb:0:149:210:209:90
Malicious Activity!
Public Scan
Effective URL: https://ics.099282-client.nl/login/
Submission: On September 06 via api from BE
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on September 6th 2019. Valid for: 3 months.
This is the only time ics.099282-client.nl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: International Card Services (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 195.216.243.155 195.216.243.155 | 29226 (MASTERTEL...) (MASTERTEL-AS Moscow) | |
1 3 | 185.27.134.141 185.27.134.141 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
1 4 | 2a02:6b8::1:119 2a02:6b8::1:119 | 13238 (YANDEX) (YANDEX) | |
1 2 | 88.212.201.196 88.212.201.196 | 39134 (UNITEDNET) (UNITEDNET) | |
3 | 2a01:7c8:eb:0... 2a01:7c8:eb:0:149:210:209:90 | 20857 (TRANSIP-A...) (TRANSIP-AS Amsterdam) | |
10 | 5 |
ASN29226 (MASTERTEL-AS Moscow, Russia, RU)
PTR: s5.unet.com
u.to |
ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
PTR: 14113427185.ifastnet.org
momentjegeduld.000a.biz |
ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL)
ics.099282-client.nl |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
yandex.ru
1 redirects
mc.yandex.ru |
93 KB |
3 |
099282-client.nl
ics.099282-client.nl |
149 KB |
3 |
000a.biz
1 redirects
momentjegeduld.000a.biz |
32 KB |
2 |
yadro.ru
1 redirects
counter.yadro.ru |
918 B |
1 |
u.to
u.to |
1011 B |
10 | 5 |
Domain | Requested by | |
---|---|---|
4 | mc.yandex.ru |
1 redirects
u.to
|
3 | ics.099282-client.nl |
momentjegeduld.000a.biz
ics.099282-client.nl |
3 | momentjegeduld.000a.biz |
1 redirects
u.to
momentjegeduld.000a.biz |
2 | counter.yadro.ru | 1 redirects |
1 | u.to | |
10 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
u.to Sectigo RSA Domain Validation Secure Server CA |
2019-08-23 - 2021-08-22 |
2 years | crt.sh |
bs.yandex.ru Yandex CA |
2018-10-03 - 2019-10-03 |
a year | crt.sh |
counter.yadro.ru COMODO ECC Domain Validation Secure Server CA |
2018-04-09 - 2020-04-08 |
2 years | crt.sh |
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
*.099282-client.nl Let's Encrypt Authority X3 |
2019-09-06 - 2019-12-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ics.099282-client.nl/login/
Frame ID: E505926851E172BD96AF0402013FA543
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://u.to/UTpCFg Page URL
- http://momentjegeduld.000a.biz/laden.php Page URL
-
http://momentjegeduld.000a.biz/laden.php?i=1
HTTP 302
https://ics.099282-client.nl/login/ Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://u.to/UTpCFg Page URL
- http://momentjegeduld.000a.biz/laden.php Page URL
-
http://momentjegeduld.000a.biz/laden.php?i=1
HTTP 302
https://ics.099282-client.nl/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/UTpCFg;1567810087207 HTTP 302
- https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/UTpCFg;1567810087207
- https://mc.yandex.ru/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2FUTpCFg&charset=utf-8&browser-info=ti%3A10%3Ans%3A1567810087011%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20190907004807%3Aet%3A1567810088%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1016019061%3Ahid%3A1015663224%3Ads%3A0%2C133%2C43%2C2%2C0%2C0%2C0%2C%2C%2C198%2C%2C%2C%3Agdpr%3A14%3Av%3A1708%3Awv%3A2%3Ast%3A1567810088%3Au%3A15678100871018284527%3At%3ARedirecting HTTP 302
- https://mc.yandex.ru/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2FUTpCFg&charset=utf-8&browser-info=ti%3A10%3Ans%3A1567810087011%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Afpr%3A216613626101%3Acn%3A1%3Aw%3A1600x1200%3Az%3A120%3Ai%3A20190907004807%3Aet%3A1567810088%3Aen%3Autf-8%3Ac%3A1%3Ala%3Aen-us%3Apv%3A1%3Arn%3A1016019061%3Ahid%3A1015663224%3Ads%3A0%2C133%2C43%2C2%2C0%2C0%2C0%2C%2C%2C198%2C%2C%2C%3Agdpr%3A14%3Av%3A1708%3Awv%3A2%3Ast%3A1567810088%3Au%3A15678100871018284527%3At%3ARedirecting
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
UTpCFg
u.to/ |
987 B 1011 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
laden.php
momentjegeduld.000a.biz/ |
843 B 837 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tag.js
mc.yandex.ru/metrika/ |
353 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hit;utostat
counter.yadro.ru/ Redirect Chain
|
43 B 421 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1
mc.yandex.ru/watch/51604940/ Redirect Chain
|
152 B 692 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
advert.gif
mc.yandex.ru/metrika/ |
43 B 445 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aes.js
momentjegeduld.000a.biz/ |
30 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
ics.099282-client.nl/login/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pixel.png
ics.099282-client.nl/login/images/ |
17 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
PG1.png
ics.099282-client.nl/login/images/ |
129 KB 129 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: International Card Services (Financial)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
counter.yadro.ru
ics.099282-client.nl
mc.yandex.ru
momentjegeduld.000a.biz
u.to
185.27.134.141
195.216.243.155
2a01:7c8:eb:0:149:210:209:90
2a02:6b8::1:119
88.212.201.196
05a13225a3c00a04a71119d1d2861b879bb592931334f2b4908c93be5637c7d2
4a59f7508c20f7046968579ab536b6c564fff5851ff7502f0e0d76c12531cb17
9694d98d6e8159e550c68d6851f368a6001f3c83fefbec235b464148546f46b5
a1531a7b982eed5098615dfe37ad9fb4fac7b8d42355eb798c1e8d1a5a79b1ea
a20857da785e0d57304821836cb04202909ef3aa062b8763c2cb4b7f013e29cd
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc