urlscan.io logo urlscan.io
SecurityTrails logo

www.f0658947.xsph.ru Open in urlscan Pro
141.8.193.236  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.f0658947.xsph.ru/2/MIC/index.php
Submission: On May 13 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 141.8.193.236, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is www.f0658947.xsph.ru.
This is the only time www.f0658947.xsph.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Made in China (Supplychain)

Domain & IP information

IP Address AS Autonomous System
3 141.8.193.236 35278 (SPRINTHOST)
2 104.18.20.229 13335 (CLOUDFLAR...)
1 104.18.30.240 13335 (CLOUDFLAR...)
6 3
Apex Domain
Subdomains		 Transfer
3 xsph.ru
www.f0658947.xsph.ru
113 KB
2 micstatic.com
www.micstatic.com — Cisco Umbrella Rank: 115767
19 KB
1 made-in-china.com
login.made-in-china.com
5 KB
6 3
Domain Requested by
3 www.f0658947.xsph.ru www.f0658947.xsph.ru
2 www.micstatic.com www.f0658947.xsph.ru
www.micstatic.com
1 login.made-in-china.com www.f0658947.xsph.ru
6 3

This site contains no links.

Subject Issuer Validity Valid
*.micstatic.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-12-02 -
2023-01-02		 a year crt.sh
*.made-in-china.com
DigiCert CN RSA CA G1		 2021-08-03 -
2022-09-03		 a year crt.sh

This page contains 1 frames:

Primary Page: http://www.f0658947.xsph.ru/2/MIC/index.php
Frame ID: EA4E4FAAAFF10734D16B24B1E2646F45
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign In | Made-in-China.com

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

137 kB
Transfer

231 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.php
www.f0658947.xsph.ru/2/MIC/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.f0658947.xsph.ru/2/MIC/index.php
Protocol
HTTP/1.1
Server
141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
eldir.from.sh
Software
openresty /
Resource Hash
3689af2f25af67ef76a1a4fd2132171ddcfe81e65e0c6514b02917cce85aaa28

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Fri, 13 May 2022 13:29:45 GMT
Server
openresty
Transfer-Encoding
chunked
Vary
Accept-Encoding
global_013252bf.css
www.micstatic.com/gb/css/ 		90 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.micstatic.com/gb/css/global_013252bf.css
Requested by
Host: www.f0658947.xsph.ru
URL: http://www.f0658947.xsph.ru/2/MIC/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
899ba7f14f24bdebbf842537173e6f48412250fa4ddf497a1f45ed3fa790af20

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.f0658947.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 13 May 2022 13:29:45 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 15 Aug 2019 07:16:26 GMT
server
cloudflare
age
17815
etag
W/"5d5506ca-1666e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=315360000
cf-ray
70abbeac185a9963-FRA
expires
Mon, 10 May 2032 13:29:45 GMT
login.css
login.made-in-china.com/css/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.made-in-china.com/css/login.css?t=hXwxJpnTFARY
Requested by
Host: www.f0658947.xsph.ru
URL: http://www.f0658947.xsph.ru/2/MIC/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.30.240 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54eee85fe2098ee631082c6efc3b5dbdf2cc4f0f39dcd2ec6b3de2fc33be5d10

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.f0658947.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 13 May 2022 13:29:45 GMT
content-encoding
gzip
cf-cache-status
REVALIDATED
last-modified
Tue, 26 Apr 2022 03:47:07 GMT
server
cloudflare
etag
W/"21917-1650944827000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=14400
server-timing
app;dur=0
cf-ray
70abbeac1872697b-FRA
expires
Fri, 13 May 2022 17:29:45 GMT
ad.jpg
www.f0658947.xsph.ru/2/MIC/images/ 		110 KB
111 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.f0658947.xsph.ru/2/MIC/images/ad.jpg
Requested by
Host: www.f0658947.xsph.ru
URL: http://www.f0658947.xsph.ru/2/MIC/index.php
Protocol
HTTP/1.1
Server
141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
eldir.from.sh
Software
openresty /
Resource Hash
f02d5c69d1f7b6a2fdfb1dca84060243bc6a1bac3423d87635bb904fb7b1beb1

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.f0658947.xsph.ru/2/MIC/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Fri, 13 May 2022 13:29:45 GMT
Last-Modified
Thu, 20 Aug 2020 17:07:32 GMT
Server
openresty
ETag
"5f3eadd4-1b8e3"
Content-Type
image/jpeg
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
112867
Expires
Fri, 20 May 2022 13:29:45 GMT
fb.png
www.f0658947.xsph.ru/2/MIC/images/ 		459 B
765 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.f0658947.xsph.ru/2/MIC/images/fb.png
Requested by
Host: www.f0658947.xsph.ru
URL: http://www.f0658947.xsph.ru/2/MIC/index.php
Protocol
HTTP/1.1
Server
141.8.193.236 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
eldir.from.sh
Software
openresty /
Resource Hash
c6e6f20c6c0b65b55494eacfc697850ae9af53e844f7295fa4fbdac00da0182a

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://www.f0658947.xsph.ru/2/MIC/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Fri, 13 May 2022 13:29:45 GMT
Last-Modified
Thu, 20 Aug 2020 17:07:32 GMT
Server
openresty
ETag
"5f3eadd4-1cb"
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
459
Expires
Fri, 20 May 2022 13:29:45 GMT
logo.png
www.micstatic.com/gb/img/logo-2019/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.micstatic.com/gb/img/logo-2019/logo.png?v=1
Requested by
Host: www.micstatic.com
URL: https://www.micstatic.com/gb/css/global_013252bf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.20.229 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
488ea251bdaf29ab45c94699fef89ad3368bfef0c0f24b671dcbefd4e474679d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.micstatic.com/gb/css/global_013252bf.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 13 May 2022 13:29:45 GMT
cf-cache-status
HIT
last-modified
Thu, 24 Sep 2020 12:32:20 GMT
server
cloudflare
age
393093
etag
"5f6c91d4-120d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=315360000
accept-ranges
bytes
cf-ray
70abbead2a939963-FRA
content-length
4621
expires
Mon, 10 May 2032 13:29:45 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Made in China (Supplychain)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone

0 Cookies