u1324717oe.ha004.t.justns.ru
2a00:b700::39  Malicious Activity!

URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Submission: On November 25 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 2a00:b700::39, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u1324717oe.ha004.t.justns.ru.
This is the only time u1324717oe.ha004.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Meridian Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
12 2a00:b700::39 51659 (ASBAXET)
12 1
Domain
Subdomains
Transfer
12 justns.ru
u1324717oe.ha004.t.justns.ru
845 KB
12 1
Domain Requested by
12 u1324717oe.ha004.t.justns.ru u1324717oe.ha004.t.justns.ru
12 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Frame ID: 55103AC7365B76E5A975785E6B2ED9DC
Requests: 12 HTTP requests in this frame

Screenshot


Page Statistics

12
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

845 kB
Transfer

1238 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request ?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
u1324717oe.ha004.t.justns.ru/directing/Meridian/
6 KB
3 KB
Document
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3f24b0eda4dc4fd994b7db67ed8a17274c3aa916c10c04ae5238fdfbbf212299

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-type
text/html
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
etag
"19a0-5adbba0e-e58430f37e601225;gz"
accept-ranges
bytes
content-encoding
gzip
vary
Accept-Encoding,User-Agent
content-length
2339
date
Thu, 25 Nov 2021 16:23:48 GMT
server
LiteSpeed
modal.js
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
14 KB
3 KB
Script
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/modal.js
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3cac4b1254742ce96465863630f4eac5855ab8ae37d7a1b5f053ff9cb53a2ad0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
content-encoding
gzip
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"374f-5adbba0e-d529614c496e444c;gz"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
2800
expires
Thu, 02 Dec 2021 16:23:48 GMT
style.css
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
449 KB
71 KB
Stylesheet
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
e0cb5ee10b53d1cb412cbe64d333aa27dd5d4687ec57a3658d5d11e4ae12e0c5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
content-encoding
gzip
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"703e4-5adbba0e-370a97d71554b0ea;gz"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
72540
expires
Thu, 02 Dec 2021 16:23:48 GMT
meridian-logo.svg
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
3 KB
2 KB
Image
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/meridian-logo.svg
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
6afa9360163bdcb2b8656de5b584ad45cfc10219bf1694402d33539312cd866d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
content-encoding
gzip
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"c29-5adbba0e-3686e10d792763ff;gz"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
1398
expires
Thu, 02 Dec 2021 16:23:48 GMT
meridian-logo-white.svg
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
3 KB
2 KB
Image
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/meridian-logo-white.svg
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
af9401d5790476e46eeb3a0cdbe5c2970a0e0fd383aa61e9e7deeabc7830d131

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
content-encoding
gzip
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"c26-5adbba0e-cd730ace89db4368;gz"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
1396
expires
Thu, 02 Dec 2021 16:23:48 GMT
entrust.png
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
18 KB
19 KB
Image
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/entrust.png
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
203680b7945ca5c9f3697881f9af9c8ed160354675055d22fc34545910cd4d54

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"4946-5adbba0e-5c1683e40ad5fa8;;;"
vary
User-Agent
content-type
image/png
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
18758
expires
Thu, 02 Dec 2021 16:23:48 GMT
Retail_SignInBackground_All.jpg
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
427 KB
428 KB
Image
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/Retail_SignInBackground_All.jpg
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
aac20b1b405adb198927a78208b2d2a4e51d6ae57455ad1e69084ed9449a7e1e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/?sessionid=5e639134cbdf89db4243214a433b2426&securessl=true
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"6adb1-5adbba0e-20bd8d27e4a396f0;;;"
vary
User-Agent
content-type
image/jpeg
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
437681
expires
Thu, 02 Dec 2021 16:23:48 GMT
SourceSansPro-Regular.ttf.woff2
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
85 KB
85 KB
Font
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/SourceSansPro-Regular.ttf.woff2
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
27c06ca531d01f12d9e28d869000985e4cf84dd0724afe578e942d44f09d19c2

Request headers

Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Origin
http://u1324717oe.ha004.t.justns.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"1533c-5adbba0e-a8c8537f4e15678c;;;"
vary
User-Agent
content-type
font/woff2
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
86844
VarelaRound-Regular-webfont.woff
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
29 KB
29 KB
Font
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/VarelaRound-Regular-webfont.woff
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
67feead462747c0b1f6d34ea8cb9f01dd0052d22911f1b36bc6333214bef2796

Request headers

Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Origin
http://u1324717oe.ha004.t.justns.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"7300-5adbba0e-252b68bc91a00f74;;;"
vary
User-Agent
content-type
application/x-font-woff
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
29440
SourceSansPro-Semibold.ttf.woff2
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
84 KB
84 KB
Font
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/SourceSansPro-Semibold.ttf.woff2
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
b96f55ccea2c4ad959ca841fa881a893e7df33a2e575d621a81d2f1063b429c4

Request headers

Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Origin
http://u1324717oe.ha004.t.justns.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"150b4-5adbba0e-c4a2e5475a11ad70;;;"
vary
User-Agent
content-type
font/woff2
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
86196
SourceSansPro-It.ttf.woff2
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
35 KB
35 KB
Font
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/SourceSansPro-It.ttf.woff2
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
b72a7eb820405438765bd48f8f260bfc06af13ed3aac5a221373939a57041265

Request headers

Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Origin
http://u1324717oe.ha004.t.justns.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"8cb0-5adbba0e-5344e23297e35b60;;;"
vary
User-Agent
content-type
font/woff2
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
36016
SourceSansPro-Bold.ttf.woff2
u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/
84 KB
84 KB
Font
General
Full URL
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/SourceSansPro-Bold.ttf.woff2
Requested by
Host: u1324717oe.ha004.t.justns.ru
URL: http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Protocol
HTTP/1.1
Server
2a00:b700::39 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
929f75e2093d43828eaaa71f7e3a08646e7291c9ba076bda3fa566bcbd804735

Request headers

Referer
http://u1324717oe.ha004.t.justns.ru/directing/Meridian/login_files/style.css
Origin
http://u1324717oe.ha004.t.justns.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 25 Nov 2021 16:23:48 GMT
last-modified
Sat, 21 Apr 2018 22:24:14 GMT
server
LiteSpeed
etag
"14e64-5adbba0e-5dfbb985c0c9b6d6;;;"
vary
User-Agent
content-type
font/woff2
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
85604

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Meridian Bank (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| MsgBox function| YesNo function| YesNoCancel function| JavaScriptError function| empty function| change

0 Cookies