oooprog.ru Open in urlscan Pro
91.226.92.10 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
Submission: On February 11 via automatic, source openphish (February 11th 2022, 1:19:39 am UTC) — Scanned from DE

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 17 HTTP transactions. The main IP is 91.226.92.10, located in Russian Federation and belongs to ROSTELECOM-AS, RU. The main domain is oooprog.ru.

This is the only time oooprog.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Standard Bank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
17	91.226.92.10 91.226.92.10		12389 (ROSTELECO...) (ROSTELECOM-AS)
17	1

17 91.226.92.10 (Russian Federation)

ASN12389 (ROSTELECOM-AS, RU)
PTR: v1.sibhoster.ru

oooprog.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	oooprog.ru oooprog.ru	263 KB
17	1

	Domain	Requested by
17	oooprog.ru	oooprog.ru
17	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
Frame ID: 6924B707304427CAFB5691ECFC32FE0B
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Standard Bank Online Banking

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

17
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

263 kB
Transfer

1816 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request otp_authentication.php Show response
oooprog.ru/rusgenerals/plugins/sp_xx/app/ 11 KB
3 KB 475ms
236ms Document
text/html 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx / PHP/5.2.17

Resource Hash

75dfa4f491bd73a0aabd53968dfd32be514a6c0c1a718bb3ac7bb0fd7e9643f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Fri, 11 Feb 2022 01:19:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Upstream-Cache-Status: MISS
X-Server-Powered-By: Engintron
Content-Encoding: gzip

GET
H/1.1 200
OK app.min.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 67 KB
7 KB 95ms
94ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

299e172fe1689256371cfa87e838e714e3c5f0ec6b8d87edf3b42db96677dc2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 04 Dec 2021 10:03:00 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:34 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK sbg.png
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/ 3 KB
4 KB 190ms
96ms Image
image/png 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/sbg.png

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

1a3aac076d48e18c6bd7547ca190a9b705f78d38cfc61e5a00f391b642c5adab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Sat, 04 Dec 2021 08:15:20 GMT
Server: nginx
Content-Type: image/png
Expires: Tue, 12 Apr 2022 01:19:34 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3502
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK img_web_otp_240.png
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/ 23 KB
23 KB 187ms
93ms Image
image/png 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/img_web_otp_240.png

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

f94d4f6b5e28a18bb671a457d9518edd7e1670907b1516492aaeb37fdd7d6897

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 12 Feb 2021 11:52:50 GMT
Server: nginx
Content-Type: image/png
Expires: Tue, 12 Apr 2022 01:19:34 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23291
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK icon_south_africa_white.png
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/ 850 B
1 KB 191ms
96ms Image
image/png 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/icon_south_africa_white.png

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

659ec5c9f365d3e03d205766dcf6103fdb716dae3e99d8742d33f1e31eb37b2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Feb 2021 22:52:48 GMT
Server: nginx
Content-Type: image/png
Expires: Tue, 12 Apr 2022 01:19:34 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 850
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK icon_global_white.png
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/ 1 KB
1 KB 195ms
101ms Image
image/png 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/icon_global_white.png

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

a98db87f78fe65c1c150fe8eddba301a4040bec74b19304bcad6405dbc323d9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Feb 2021 22:52:48 GMT
Server: nginx
Content-Type: image/png
Expires: Tue, 12 Apr 2022 01:19:34 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1090
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK icon_email_white.png
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/ 795 B
1 KB 259ms
164ms Image
image/png 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/img/icon_email_white.png

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

2daf53b1d65351e31f6c8513731bec5ecd65fd1c072d8ddd5521e35cc31a73de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/app/otp_authentication.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Feb 2021 22:52:48 GMT
Server: nginx
Content-Type: image/png
Expires: Tue, 12 Apr 2022 01:19:34 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 795
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK app.min-blessed49.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 303 KB
33 KB 107ms
107ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed49.css?z=1612885494473

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

d17e6f2d39ee771eb41fb6a167661ce69fc228af8daf99bcb2f5a5058f5e20da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 10 Dec 2021 06:52:24 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:34 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK app.min-blessed45.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 425 KB
21 KB 194ms
99ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed45.css?z=1612885494473

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

c415bbd5aeeaa215da204eeacdad5471ee670c054e295a2df1232a575166a2cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:34 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 12 Feb 2021 02:51:08 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:34 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK app.min-blessed44.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 104 KB
13 KB 253ms
99ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed44.css?z=1612885494473

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

1d37a24706a9b7ef61dfef37effcf7e9668080b854e2ecba5db74f89c208230d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 12 Feb 2021 02:51:08 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:35 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK app.min-blessed41.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 240 KB
32 KB 263ms
103ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed41.css?z=1612885494473

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

a932a73280a10e52e2b30a07d2e6b5839885712421129781d7b985cb53292600

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 04 Dec 2021 10:02:58 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:35 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK app.min-blessed40.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 324 KB
29 KB 271ms
108ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed40.css?z=1612885494473

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

c47b3a698d8e57d6edd9932c60661a5556e651c1ad5553851503f8f912640c5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 04 Dec 2021 10:02:56 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:35 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK app.min-blessed39.css
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/ 247 KB
26 KB 286ms
101ms Stylesheet
text/css 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed39.css?z=1612885494473

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

e2746c264f16133ab654e9183c737eaf312c358a80f8b56c03c3b71f54e13473

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Sat, 04 Dec 2021 10:02:58 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: text/css
Expires: Sun, 13 Mar 2022 01:19:35 GMT
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
X-Server-Powered-By: Engintron
Connection: keep-alive
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 404
Not Found Background_Image_Large.jpg
oooprog.ru/rusgenerals/plugins/sp_xx/img/ 315 B
315 B 102ms
102ms Image
text/html 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/img/Background_Image_Large.jpg

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed40.css?z=1612885494473

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed40.css?z=1612885494473
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bentonsans-regular-webfont.woff
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/fonts/bentonsans/regular/ 12 KB
12 KB 100ms
100ms Font
font/woff 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/fonts/bentonsans/regular/bentonsans-regular-webfont.woff

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed41.css?z=1612885494473

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

0402b8e6e3b789ffec9618f6baea5b80a5c7d20a44394327a4d5a8e5ee369acf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed41.css?z=1612885494473
Origin: http://oooprog.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Feb 2021 22:52:48 GMT
Server: nginx
Content-Type: font/woff
Expires: Tue, 12 Apr 2022 01:19:35 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11864
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK fontawesome-webfont.woff
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/fonts/ 43 KB
44 KB 98ms
97ms Font
font/woff 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/fonts/fontawesome-webfont.woff

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed49.css?z=1612885494473

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed49.css?z=1612885494473
Origin: http://oooprog.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Feb 2021 14:52:48 GMT
Server: nginx
Content-Type: font/woff
Expires: Tue, 12 Apr 2022 01:19:35 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 44432
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

GET
H/1.1 200
OK bentonsans-medium-webfont.woff
oooprog.ru/rusgenerals/plugins/sp_xx/libraries/fonts/bentonsans/medium/ 12 KB
12 KB 97ms
97ms Font
font/woff 91.226.92.10
ROSTELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/fonts/bentonsans/medium/bentonsans-medium-webfont.woff

Requested by

Host: oooprog.ru
URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed41.css?z=1612885494473

Protocol

HTTP/1.1

Server

91.226.92.10 , Russian Federation, ASN12389 (ROSTELECOM-AS, RU),

Reverse DNS

v1.sibhoster.ru

Software

nginx /

Resource Hash

e22403a94b6dafdf14e615863c37f711615cd794d3cd09812a947c974bf99cca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://oooprog.ru/rusgenerals/plugins/sp_xx/libraries/css/app.min-blessed41.css?z=1612885494473
Origin: http://oooprog.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Fri, 11 Feb 2022 01:19:35 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 08 Feb 2021 22:52:48 GMT
Server: nginx
Content-Type: font/woff
Expires: Tue, 12 Apr 2022 01:19:35 GMT
Cache-Control: max-age=5184000
X-Server-Powered-By: Engintron
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11876
X-XSS-Protection: 1; mode=block
X-Nginx-Upstream-Cache-Status: STALE

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Standard Bank (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| isInputNumber

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			oooprog.ru/	1969-12-31 23:59:59	Name: PHPSESSID Value: sllqmjbe07nk902jkdtmd9tma3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://oooprog.ru/rusgenerals/plugins/sp_xx/img/Background_Image_Large.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

oooprog.ru
91.226.92.10
0402b8e6e3b789ffec9618f6baea5b80a5c7d20a44394327a4d5a8e5ee369acf
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
1a3aac076d48e18c6bd7547ca190a9b705f78d38cfc61e5a00f391b642c5adab
1d37a24706a9b7ef61dfef37effcf7e9668080b854e2ecba5db74f89c208230d
299e172fe1689256371cfa87e838e714e3c5f0ec6b8d87edf3b42db96677dc2e
2daf53b1d65351e31f6c8513731bec5ecd65fd1c072d8ddd5521e35cc31a73de
659ec5c9f365d3e03d205766dcf6103fdb716dae3e99d8742d33f1e31eb37b2d
75dfa4f491bd73a0aabd53968dfd32be514a6c0c1a718bb3ac7bb0fd7e9643f0
a932a73280a10e52e2b30a07d2e6b5839885712421129781d7b985cb53292600
a98db87f78fe65c1c150fe8eddba301a4040bec74b19304bcad6405dbc323d9d
c415bbd5aeeaa215da204eeacdad5471ee670c054e295a2df1232a575166a2cf
c47b3a698d8e57d6edd9932c60661a5556e651c1ad5553851503f8f912640c5e
d17e6f2d39ee771eb41fb6a167661ce69fc228af8daf99bcb2f5a5058f5e20da
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e22403a94b6dafdf14e615863c37f711615cd794d3cd09812a947c974bf99cca
e2746c264f16133ab654e9183c737eaf312c358a80f8b56c03c3b71f54e13473
f94d4f6b5e28a18bb671a457d9518edd7e1670907b1516492aaeb37fdd7d6897

oooprog.ru Open in urlscan Pro 91.226.92.10 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

263 kBTransfer

1816 kBSize

1 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

oooprog.ru Open in urlscan Pro
91.226.92.10 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

263 kB
Transfer

1816 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!