www.f0658947.xsph.ru
Open in
urlscan Pro
141.8.193.236
Malicious Activity!
Public Scan
Submission: On May 13 via automatic, source openphish — Scanned from DE
Summary
This is the only time www.f0658947.xsph.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Made in China (Supplychain)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 141.8.193.236 141.8.193.236 | 35278 (SPRINTHOST) (SPRINTHOST) | |
2 | 104.18.20.229 104.18.20.229 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.30.240 104.18.30.240 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 3 |
ASN35278 (SPRINTHOST, RU)
PTR: eldir.from.sh
www.f0658947.xsph.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
xsph.ru
www.f0658947.xsph.ru |
113 KB |
2 |
micstatic.com
www.micstatic.com — Cisco Umbrella Rank: 115767 |
19 KB |
1 |
made-in-china.com
login.made-in-china.com |
5 KB |
6 | 3 |
Domain | Requested by | |
---|---|---|
3 | www.f0658947.xsph.ru |
www.f0658947.xsph.ru
|
2 | www.micstatic.com |
www.f0658947.xsph.ru
www.micstatic.com |
1 | login.made-in-china.com |
www.f0658947.xsph.ru
|
6 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.micstatic.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-12-02 - 2023-01-02 |
a year | crt.sh |
*.made-in-china.com DigiCert CN RSA CA G1 |
2021-08-03 - 2022-09-03 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.f0658947.xsph.ru/2/MIC/index.php
Frame ID: EA4E4FAAAFF10734D16B24B1E2646F45
Requests: 6 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.php
www.f0658947.xsph.ru/2/MIC/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global_013252bf.css
www.micstatic.com/gb/css/ |
90 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
login.made-in-china.com/css/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ad.jpg
www.f0658947.xsph.ru/2/MIC/images/ |
110 KB 111 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb.png
www.f0658947.xsph.ru/2/MIC/images/ |
459 B 765 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
www.micstatic.com/gb/img/logo-2019/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Made in China (Supplychain)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
login.made-in-china.com
www.f0658947.xsph.ru
www.micstatic.com
104.18.20.229
104.18.30.240
141.8.193.236
3689af2f25af67ef76a1a4fd2132171ddcfe81e65e0c6514b02917cce85aaa28
488ea251bdaf29ab45c94699fef89ad3368bfef0c0f24b671dcbefd4e474679d
54eee85fe2098ee631082c6efc3b5dbdf2cc4f0f39dcd2ec6b3de2fc33be5d10
899ba7f14f24bdebbf842537173e6f48412250fa4ddf497a1f45ed3fa790af20
c6e6f20c6c0b65b55494eacfc697850ae9af53e844f7295fa4fbdac00da0182a
f02d5c69d1f7b6a2fdfb1dca84060243bc6a1bac3423d87635bb904fb7b1beb1