URL: http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
Submission Tags: phishing malicious Search All
Submission: On October 26 via api from US

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 78.110.50.127, located in Moscow, Russian Federation and belongs to HT-SYSTEMS-AS Uplinks:, RU. The main domain is srv89265.ht-test.ru.
This is the only time srv89265.ht-test.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 78.110.50.127 31240 (HT-SYSTEM...)
1 3 78.110.51.200 31240 (HT-SYSTEM...)
1 78.110.50.108 31240 (HT-SYSTEM...)
4 4
Apex Domain
Subdomains
Transfer
4 hts.ru
stats.hts.ru
www.hts.ru
24 KB
1 ht-test.ru
srv89265.ht-test.ru
12 KB
4 2
Domain Requested by
3 stats.hts.ru 1 redirects srv89265.ht-test.ru
1 www.hts.ru srv89265.ht-test.ru
1 srv89265.ht-test.ru
4 3

This site contains links to these domains. Also see Links.

Domain
www.hts.ru
Subject Issuer Validity Valid
*.hts.ru
COMODO RSA Domain Validation Secure Server CA
2017-09-01 -
2020-11-30
3 years crt.sh

This page contains 1 frames:

Primary Page: http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
Frame ID: 06FFA764EDC9C6F184F8D0B855EEA5B0
Requests: 5 HTTP requests in this frame

Screenshot


Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

35 kB
Transfer

79 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://stats.hts.ru/matomo.js HTTP 301
  • https://stats.hts.ru/matomo.js
Request Chain 3
  • http://stats.hts.ru/matomo.php?action_name=srv89265.ht-test.ru%2F%D0%A1%D0%B5%D1%80%D0%B2%D0%B8%D1%81%20%D0%BD%D0%B5%D0%B4%D0%BE%D1%81%D1%82%D1%83%D0%BF%D0%B5%D0%BD%20%2F%20Service%20Unavailable&idsite=2&rec=1&r=101876&h=6&m=46&s=38&url=http%3A%2F%2Fsrv89265.ht-test.ru%2Fpaypal.com%2Fupdate%2F191f2b%2Fmyaccount%2Fsignin%2F%3Fcountry.x%3Dnl%26amp&_id=9d0a856b8bde34c4&_idts=1603691198&_idvc=1&_idn=0&_refts=0&_viewts=1603691198&send_image=1&cookie=1&res=1600x1200&gt_ms=127&pv_id=z1qYko HTTP 307
  • https://stats.hts.ru/matomo.php?action_name=srv89265.ht-test.ru%2F%D0%A1%D0%B5%D1%80%D0%B2%D0%B8%D1%81%20%D0%BD%D0%B5%D0%B4%D0%BE%D1%81%D1%82%D1%83%D0%BF%D0%B5%D0%BD%20%2F%20Service%20Unavailable&idsite=2&rec=1&r=101876&h=6&m=46&s=38&url=http%3A%2F%2Fsrv89265.ht-test.ru%2Fpaypal.com%2Fupdate%2F191f2b%2Fmyaccount%2Fsignin%2F%3Fcountry.x%3Dnl%26amp&_id=9d0a856b8bde34c4&_idts=1603691198&_idvc=1&_idn=0&_refts=0&_viewts=1603691198&send_image=1&cookie=1&res=1600x1200&gt_ms=127&pv_id=z1qYko

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/
12 KB
12 KB
Document
General
Full URL
http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
Protocol
HTTP/1.0
Server
78.110.50.127 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS
cl32-w.ht-systems.ru
Software
/
Resource Hash
acce1f72f25858d5743532b21ba6394b8a471afc2ab0ca8710111a235aa7e76b

Request headers

Host
srv89265.ht-test.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control
no-cache
Connection
close
Content-Type
text/html
matomo.js
stats.hts.ru/
Redirect Chain
  • http://stats.hts.ru/matomo.js
  • https://stats.hts.ru/matomo.js
66 KB
22 KB
Script
General
Full URL
https://stats.hts.ru/matomo.js
Requested by
Host: srv89265.ht-test.ru
URL: http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.110.51.200 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS
78-110-51-200.net.hts.ru
Software
nginx /
Resource Hash
708b7b0650cb6c27ed0586a288264fdd3250109754f29115644a8dd03dd0d2f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 05:46:38 GMT
content-encoding
gzip
referrer-policy
origin
last-modified
Fri, 05 Jul 2019 12:17:54 GMT
server
nginx
etag
W/"5d1f3ff2-106c8"
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

Content-Security-Policy
frame-ancestors 'self'
Server
nginx
Date
Mon, 26 Oct 2020 05:46:38 GMT
Content-Type
text/html
Location
https://stats.hts.ru/matomo.js
Connection
keep-alive
Content-Length
162
X-XSS-Protection
1; mode=block
/
www.hts.ru/ru/jq/donate/
97 B
1 KB
XHR
General
Full URL
https://www.hts.ru/ru/jq/donate/?domain=srv89265.ht-test.ru
Requested by
Host: srv89265.ht-test.ru
URL: http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.110.50.108 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS
c6-w.ht-systems.ru
Software
nginx / PHP/5.4.16
Resource Hash
31471813b50740ed85c31a307ae6dff6535438b80767b7481e40988ce2219597
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' http://webvisor.com; default-src 'self' https://yandex.ru; font-src 'self'; script-src 'self' https://api-maps.yandex.ru https://maps.google.com https://code.jivosite.com https://www.googletagmanager.com https://stats.hts.ru https://mc.yandex.ru https://yastatic.net https://www.google-analytics.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://mc.yandex.ru https://code.jivosite.com https://*.jivosite.com; img-src 'self' https://ext.host-tracker.com https://api-maps.yandex.ru https://counter.yadro.ru http://cp.hts.ru https://mc.yandex.ru https://*.maps.yandex.net http://www.hts.ru http://hubble.ht-systems.ru https://stats.hts.ru https://www.google-analytics.com data:; media-src 'self' https://code.jivosite.com; style-src 'self' 'unsafe-inline'; object-src 'self'

Request headers

Referer
http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Oct 2020 05:46:37 GMT
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 08:46:37 +0300
server
nginx
status
200
x-powered-by
PHP/5.4.16
vary
Accept-Encoding
content-type
text/plain;charset=cp1251
access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-security-policy
frame-ancestors 'self' http://webvisor.com; default-src 'self' https://yandex.ru; font-src 'self'; script-src 'self' https://api-maps.yandex.ru https://maps.google.com https://code.jivosite.com https://www.googletagmanager.com https://stats.hts.ru https://mc.yandex.ru https://yastatic.net https://www.google-analytics.com 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://mc.yandex.ru https://code.jivosite.com https://*.jivosite.com; img-src 'self' https://ext.host-tracker.com https://api-maps.yandex.ru https://counter.yadro.ru http://cp.hts.ru https://mc.yandex.ru https://*.maps.yandex.net http://www.hts.ru http://hubble.ht-systems.ru https://stats.hts.ru https://www.google-analytics.com data:; media-src 'self' https://code.jivosite.com; style-src 'self' 'unsafe-inline'; object-src 'self'
content-length
101
expires
Thu, 19 Nov 1981 08:52:00 GMT
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d59ace9c103111f44e753ca38bff71b99ca9716952db6212e710cc8a5b43442a

Request headers

Referer
http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
matomo.php
stats.hts.ru/
Redirect Chain
  • http://stats.hts.ru/matomo.php?action_name=srv89265.ht-test.ru%2F%D0%A1%D0%B5%D1%80%D0%B2%D0%B8%D1%81%20%D0%BD%D0%B5%D0%B4%D0%BE%D1%81%D1%82%D1%83%D0%BF%D0%B5%D0%BD%20%2F%20Service%20Unavailable&id...
  • https://stats.hts.ru/matomo.php?action_name=srv89265.ht-test.ru%2F%D0%A1%D0%B5%D1%80%D0%B2%D0%B8%D1%81%20%D0%BD%D0%B5%D0%B4%D0%BE%D1%81%D1%82%D1%83%D0%BF%D0%B5%D0%BD%20%2F%20Service%20Unavailable&i...
43 B
280 B
Image
General
Full URL
https://stats.hts.ru/matomo.php?action_name=srv89265.ht-test.ru%2F%D0%A1%D0%B5%D1%80%D0%B2%D0%B8%D1%81%20%D0%BD%D0%B5%D0%B4%D0%BE%D1%81%D1%82%D1%83%D0%BF%D0%B5%D0%BD%20%2F%20Service%20Unavailable&idsite=2&rec=1&r=101876&h=6&m=46&s=38&url=http%3A%2F%2Fsrv89265.ht-test.ru%2Fpaypal.com%2Fupdate%2F191f2b%2Fmyaccount%2Fsignin%2F%3Fcountry.x%3Dnl%26amp&_id=9d0a856b8bde34c4&_idts=1603691198&_idvc=1&_idn=0&_refts=0&_viewts=1603691198&send_image=1&cookie=1&res=1600x1200&gt_ms=127&pv_id=z1qYko
Requested by
Host: srv89265.ht-test.ru
URL: http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.110.51.200 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS
78-110-51-200.net.hts.ru
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
http://srv89265.ht-test.ru/paypal.com/update/191f2b/myaccount/signin/?country.x=nl&amp
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 26 Oct 2020 05:46:38 GMT
referrer-policy
origin
server
nginx
status
200
x-frame-options
SAMEORIGIN
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store
access-control-allow-credentials
true
strict-transport-security
max-age=31536000
vary
Origin
x-content-type-options
nosniff

Redirect headers

Location
https://stats.hts.ru/matomo.php?action_name=srv89265.ht-test.ru%2F%D0%A1%D0%B5%D1%80%D0%B2%D0%B8%D1%81%20%D0%BD%D0%B5%D0%B4%D0%BE%D1%81%D1%82%D1%83%D0%BF%D0%B5%D0%BD%20%2F%20Service%20Unavailable&idsite=2&rec=1&r=101876&h=6&m=46&s=38&url=http%3A%2F%2Fsrv89265.ht-test.ru%2Fpaypal.com%2Fupdate%2F191f2b%2Fmyaccount%2Fsignin%2F%3Fcountry.x%3Dnl%26amp&_id=9d0a856b8bde34c4&_idts=1603691198&_idvc=1&_idn=0&_refts=0&_viewts=1603691198&send_image=1&cookie=1&res=1600x1200&gt_ms=127&pv_id=z1qYko
Non-Authoritative-Reason
HSTS

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| _paq object| _0xae1c object| JSON_PIWIK object| Piwik object| Matomo object| AnalyticsTracker function| piwik_log

2 Cookies

Domain/Path Name / Value
srv89265.ht-test.ru/ Name: _pk_ses.2.095d
Value: 1
srv89265.ht-test.ru/ Name: _pk_id.2.095d
Value: 9d0a856b8bde34c4.1603691198.1.1603691198.1603691198.