shtihel.ru
Open in
urlscan Pro
2a03:4900:0:6037:80:78:250:147
Malicious Activity!
Public Scan
Submitted URL: http://smartblitz.feriadesoftware.cl/includes/erv.php
Effective URL: http://shtihel.ru/files/premium/aspge/index.html
Submission: On July 20 via manual from NZ
Effective URL: http://shtihel.ru/files/premium/aspge/index.html
Submission: On July 20 via manual from NZ
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 4 HTTP transactions.
The main IP is 2a03:4900:0:6037:80:78:250:147, located in
Russian Federation and
belongs to AGAVA3, RU.
The main domain is shtihel.ru.
This is the only time shtihel.ru was scanned on urlscan.io!
This is the only time shtihel.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ASB Bank (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 200.1.22.252 200.1.22.252 | 26610 (Universid...) (Universidad Tecnica Federico Santa Maria) | |
| 3 | 2a03:4900:0:6... 2a03:4900:0:6037:80:78:250:147 | 43146 (AGAVA3) (AGAVA3) | |
| 4 | 2 |
1
200.1.22.252
(Valparaiso, Chile)
ASN26610 (Universidad Tecnica Federico Santa Maria, CL)
PTR: horo.inf.santiago.usm.cl
ASN26610 (Universidad Tecnica Federico Santa Maria, CL)
PTR: horo.inf.santiago.usm.cl
| smartblitz.feriadesoftware.cl |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
shtihel.ru
shtihel.ru |
35 KB |
| 1 |
feriadesoftware.cl
smartblitz.feriadesoftware.cl |
396 B |
| 4 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | shtihel.ru |
shtihel.ru
|
| 1 | smartblitz.feriadesoftware.cl | |
| 4 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://shtihel.ru/files/premium/aspge/index.html
Frame ID: 53205AB7BCD25C4636BEC6F4D4E1BF22
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://smartblitz.feriadesoftware.cl/includes/erv.php Page URL
- http://shtihel.ru/files/premium/aspge/index.html Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
CentOS
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /CentOS/i
Varnish
(Cache Tools)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers via /.*Varnish/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://smartblitz.feriadesoftware.cl/includes/erv.php Page URL
- http://shtihel.ru/files/premium/aspge/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
erv.php
smartblitz.feriadesoftware.cl/includes/ |
148 B 396 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
index.html
shtihel.ru/files/premium/aspge/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
asblogin.png
shtihel.ru/files/premium/aspge/ |
32 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.png
shtihel.ru/files/premium/aspge/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ASB Bank (Banking)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
shtihel.ru
smartblitz.feriadesoftware.cl
200.1.22.252
2a03:4900:0:6037:80:78:250:147
056862309e7e97e4e8d27ebe7c45a39250b5e21e5a8c9bc71096e5f285ebef17
0a8c9cadd01493c7dae4f55104934ed6827d5b384254b498a4040b2b65d9212e
78ad3dddab7f7d0a675b4ce8d71c294727e8b015e4eab6e8bf3c02663efc14af