![](/screenshots/665c5ce5-32b6-4605-9e7b-125359839bf3.png)
u0673130.cp.regruhosting.ru
Open in
urlscan Pro
31.31.198.13
Malicious Activity!
Public Scan
Effective URL: http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/
Submission: On March 12 via manual from ES
Summary
This is the only time u0673130.cp.regruhosting.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 66.6.33.159 66.6.33.159 | 26101 (YAHOO-3) (YAHOO-3 - Yahoo!) | |
1 | 104.244.42.5 104.244.42.5 | 13414 (TWITTER) (TWITTER - Twitter Inc.) | |
1 1 | 47.52.132.253 47.52.132.253 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
1 | 203.107.232.3 203.107.232.3 | 7693 (COMNET-TH...) (COMNET-TH KSC Commercial Internet Co. Ltd.) | |
2 28 | 31.31.198.13 31.31.198.13 | 197695 (AS-REG) (AS-REG) | |
1 | 193.41.234.21 193.41.234.21 | 16289 (ING-DIREC...) (ING-DIRECT-SPAIN) | |
30 | 5 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
blog.xaoyo.net |
ASN7693 (COMNET-TH KSC Commercial Internet Co. Ltd., TH)
www.bac.co.th |
ASN197695 (AS-REG, RU)
PTR: scp78.hosting.reg.ru
u0673130.cp.regruhosting.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
28 |
regruhosting.ru
2 redirects
u0673130.cp.regruhosting.ru |
1 MB |
1 |
ingdirect.es
ing.ingdirect.es |
87 KB |
1 |
bac.co.th
www.bac.co.th |
390 B |
1 |
xaoyo.net
1 redirects
blog.xaoyo.net |
465 B |
1 |
t.co
t.co |
639 B |
1 |
umblr.com
t.umblr.com |
970 B |
30 | 6 |
Domain | Requested by | |
---|---|---|
28 | u0673130.cp.regruhosting.ru |
2 redirects
u0673130.cp.regruhosting.ru
|
1 | ing.ingdirect.es |
u0673130.cp.regruhosting.ru
|
1 | www.bac.co.th |
t.co
|
1 | blog.xaoyo.net | 1 redirects |
1 | t.co |
t.umblr.com
|
1 | t.umblr.com | |
30 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
ing.ingdirect.es |
Subject Issuer | Validity | Valid | |
---|---|---|---|
umblr.com DigiCert SHA2 High Assurance Server CA |
2018-11-25 - 2019-05-24 |
6 months | crt.sh |
t.co DigiCert SHA2 Extended Validation Server CA |
2017-01-12 - 2019-04-12 |
2 years | crt.sh |
www.bac.co.th Go Daddy Secure Certificate Authority - G2 |
2019-01-15 - 2020-01-15 |
a year | crt.sh |
ing.ingdirect.es DigiCert Global CA G2 |
2018-03-12 - 2020-03-28 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/
Frame ID: 73618458DCA6A8B2FA1956770EE94B4D
Requests: 29 HTTP requests in this frame
Frame:
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/dest5.html
Frame ID: 1B38A7DBB50BEB41831583A31BC7C442
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/665c5ce5-32b6-4605-9e7b-125359839bf3.png)
Page URL History Show full URLs
- https://t.umblr.com/redirect?z=https%3A%2F%2Ft.co%2FBuKKZY8fdv&t=YTdlZTJmMGZhNDNhMWFkNzhlMDUyNWM... Page URL
- https://t.co/BuKKZY8fdv Page URL
-
http://blog.xaoyo.net/urlredirect.php?go=https://www.bac.co.th/baccrm/custom/56sdfg56df.html
HTTP 302
https://www.bac.co.th/baccrm/custom/56sdfg56df.html Page URL
-
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/
HTTP 302
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4 HTTP 301
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/ Page URL
Detected technologies
![](/vendor/wappa/icons/Lua.png)
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
![](/vendor/wappa/icons/OpenResty.png)
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
![](/vendor/wappa/icons/RequireJS.png)
Detected patterns
- script /require.*\.js/i
Twitter Bootstrap () Expand
Detected patterns
- script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: PolÃtica de cookies
Search URL Search Domain Scan URL
Title: DNI electrónico.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.umblr.com/redirect?z=https%3A%2F%2Ft.co%2FBuKKZY8fdv&t=YTdlZTJmMGZhNDNhMWFkNzhlMDUyNWMxMmViOTUyMzQyNDY4Nzk2YyxrVXByTlNVZA%3D%3D&b=t%3AmIBdIzrKxnN7te2unrbsAw&p=https%3A%2F%2Fimysticalblizzardcollectionme.tumblr.com%2Fpost%2F183386105363%2Fhttpstcobukkzy8fdv&m=1 Page URL
- https://t.co/BuKKZY8fdv Page URL
-
http://blog.xaoyo.net/urlredirect.php?go=https://www.bac.co.th/baccrm/custom/56sdfg56df.html
HTTP 302
https://www.bac.co.th/baccrm/custom/56sdfg56df.html Page URL
-
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/
HTTP 302
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4 HTTP 301
http://u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- http://blog.xaoyo.net/urlredirect.php?go=https://www.bac.co.th/baccrm/custom/56sdfg56df.html HTTP 302
- https://www.bac.co.th/baccrm/custom/56sdfg56df.html
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
redirect
t.umblr.com/ |
295 B 970 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BuKKZY8fdv
t.co/ |
475 B 639 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
56sdfg56df.html
www.bac.co.th/baccrm/custom/ Redirect Chain
|
112 B 390 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/ Redirect Chain
|
28 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s0689907103637
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
312 B 503 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActivityServer.bs
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
60 B 250 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActivityServer(1).bs
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
60 B 250 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.sync.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
transactional.css
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
3 MB 400 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-require-config.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
libs.bootstrap.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.bootstrap.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.2.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GlobalConfiguration.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.bootstrap.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overall-position.bootstrap.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overall-position.usualResources.bootstrap.js.t%C3%A9l%C3%A9chargement
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logoING.svg
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
33 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
norton-logo.png
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LogoDNIE-trazado.svg
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
13 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ Frame 1B38 |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner-login_1164x300.jpg
ing.ingdirect.es/genoma_transactional/cms_files/posglobal/images/login/ |
87 KB 87 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
transactional.css
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/index_files/ |
3 MB 400 KB |
Font
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icono_twyp.svg
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/assets/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons-typography.woff
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/styles/icons-typography/assets/fonts/ |
209 KB 210 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-direct-icons.woff
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/assets/icon-font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-direct-icons.ttf
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/assets/icon-font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-direct-icons.woff
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/assets/icon-font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
INGMeWeb-Regular.ttf
u0673130.cp.regruhosting.ru/Servicios-informente6569562232/aca4dafda41bfeb6fc6993d9df8899e4/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask string| locationHref object| loginReleaseVersion undefined| parentURL undefined| urlsAllowed object| s_4_Integrate_Eyeblaster_ACM_get_00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | deny |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
blog.xaoyo.net
ing.ingdirect.es
t.co
t.umblr.com
u0673130.cp.regruhosting.ru
www.bac.co.th
104.244.42.5
193.41.234.21
203.107.232.3
31.31.198.13
47.52.132.253
66.6.33.159
06d777a08d4a929416222ae3efc2aac3448e42e148546b6272186b3ae34e2840
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
2f2c0872cf8bde37e0afb4ca5b7ca8015375e0ae8a4f83ccdbf879aca84f14d7
3a54d887d8aa316d9dfbcb3d4f15fa0a5cd6d46efcfbdcb1bd6ee10ce987cb83
51d245c03264bfeafda684039b197f12cc46c285d003189d155923f6a101b204
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
7137101d85e846dd1abafecf053d03a381bbf63d59ee9a10b92a96b06d7f6d7c
9333473effc6bced92f7eb03baefe1cfb2075e28298c0c0ce930c8fe915365b0
a5c74ae990d5d2b575b740de198718c44c9126a1b06358cc2833dce69c655b4b
b1eea92de29b507fdaec41b96d3139e30a089512a920e3c96820a3fc34b8acfd
ca5eafe66082f6c80b6143b5db44da159e755bafec80c2b672dba99efac88977