esarzt87-csera88776.freesite.host
Open in
urlscan Pro
2607:1b00:93b2:e42c::4f3d
Malicious Activity!
Public Scan
Effective URL: https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm
Submission: On April 08 via manual from IN
Summary
TLS certificate: Issued by RapidSSL RSA CA 2018 on October 3rd 2019. Valid for: 2 years.
This is the only time esarzt87-csera88776.freesite.host was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostNord AB (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 195.216.243.155 195.216.243.155 | 57724 (DDOS-GUARD) (DDOS-GUARD) | |
3 7 | 2a02:6b8::1:119 2a02:6b8::1:119 | 13238 (YANDEX) (YANDEX) | |
1 2 | 88.212.201.216 88.212.201.216 | 39134 (UNITEDNET) (UNITEDNET) | |
1 1 | 159.69.95.195 159.69.95.195 | 24940 (HETZNER-AS) (HETZNER-AS) | |
9 | 2607:1b00:93b... 2607:1b00:93b2:e42c::4f3d | 54456 (CLOUDACCE...) (CLOUDACCESS-NETWORK) | |
15 | 5 |
ASN24940 (HETZNER-AS, DE)
PTR: static.195.95.69.159.clients.your-server.de
qoo.gl |
ASN54456 (CLOUDACCESS-NETWORK, US)
esarzt87-csera88776.freesite.host |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
freesite.host
esarzt87-csera88776.freesite.host |
26 KB |
5 |
yandex.com
2 redirects
mc.yandex.com |
2 KB |
2 |
yadro.ru
1 redirects
counter.yadro.ru |
1 KB |
2 |
yandex.ru
1 redirects
mc.yandex.ru |
69 KB |
1 |
qoo.gl
1 redirects
qoo.gl |
763 B |
1 |
u.to
u.to |
1018 B |
15 | 6 |
Domain | Requested by | |
---|---|---|
9 | esarzt87-csera88776.freesite.host |
u.to
esarzt87-csera88776.freesite.host |
5 | mc.yandex.com |
2 redirects
u.to
|
2 | counter.yadro.ru |
1 redirects
u.to
|
2 | mc.yandex.ru |
1 redirects
u.to
|
1 | qoo.gl | 1 redirects |
1 | u.to | |
15 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
u.to GoGetSSL RSA DV CA |
2020-10-09 - 2021-10-09 |
a year | crt.sh |
mc.yandex.ru Yandex CA |
2021-02-27 - 2021-08-09 |
5 months | crt.sh |
counter.yadro.ru R3 |
2021-03-22 - 2021-06-20 |
3 months | crt.sh |
*.freesite.host RapidSSL RSA CA 2018 |
2019-10-03 - 2021-12-01 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm
Frame ID: F53AAA3389AE6A454E2077ABC6A5F2C6
Requests: 16 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://u.to/-gU7Gw Page URL
-
https://qoo.gl/767RYTR
HTTP 301
https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://u.to/-gU7Gw Page URL
-
https://qoo.gl/767RYTR
HTTP 301
https://esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/index.htm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://counter.yadro.ru/hit;utostat?r;s1600*1200*24;uhttps%3A//u.to/-gU7Gw;1617915307665 HTTP 302
- https://counter.yadro.ru/hit;utostat?q;r;s1600*1200*24;uhttps%3A//u.to/-gU7Gw;1617915307665
- https://mc.yandex.com/sync_cookie_image_check HTTP 302
- https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9237.qTG0V9wZRFVR74IE4BBFSZmn1fJVWGvIxQ-fo40x7wxFzu3VHwH098Go_JPSlHwD.2pFOIs07y_m0UWJ7KR44ACoMzK0%2C HTTP 302
- https://mc.yandex.com/sync_cookie_image_decide?token=9237.TKQVRv5mdU0T-_HQP7eKDIjhTPZRV80k4o0K3FL_X9Xa6jlXbp3zRx2QKY9EI-ipzTU4yQS0STF8-_efbI2r8w%2C%2C.TuEAO4AHmd7MOu5_3zRzGRx8E8E%2C
- https://mc.yandex.com/watch/51604940?wmode=7&page-url=https%3A%2F%2Fu.to%2F-gU7Gw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A482%3Acn%3A1%3Adp%3A0%3Als%3A550596131184%3Ahid%3A923006190%3Az%3A120%3Ai%3A20210408225507%3Aet%3A1617915308%3Ac%3A1%3Arn%3A814504868%3Au%3A1617915308647001282%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1617915307351%3Ads%3A2%2C204%2C85%2C2%2C0%2C0%2C%2C20%2C0%2C%2C%2C%2C320%3Adsn%3A2%2C204%2C85%2C3%2C0%2C0%2C%2C25%2C0%2C%2C%2C%2C320%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1617915308%3At%3ARedirecting HTTP 302
- https://mc.yandex.com/watch/51604940/1?wmode=7&page-url=https%3A%2F%2Fu.to%2F-gU7Gw&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A2qfickvpx9rcbpmn%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A482%3Acn%3A1%3Adp%3A0%3Als%3A550596131184%3Ahid%3A923006190%3Az%3A120%3Ai%3A20210408225507%3Aet%3A1617915308%3Ac%3A1%3Arn%3A814504868%3Au%3A1617915308647001282%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Ahdl%3A1%3Ans%3A1617915307351%3Ads%3A2%2C204%2C85%2C2%2C0%2C0%2C%2C20%2C0%2C%2C%2C%2C320%3Adsn%3A2%2C204%2C85%2C3%2C0%2C0%2C%2C25%2C0%2C%2C%2C%2C320%3Awv%3A2%3Arqnl%3A1%3Aadb%3A2%3Ati%3A2%3Ast%3A1617915308%3At%3ARedirecting
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
-gU7Gw
u.to/ |
999 B 1018 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
mc.yandex.ru/metrika/ |
215 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hit;utostat
counter.yadro.ru/ Redirect Chain
|
43 B 496 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sync_cookie_image_decide
mc.yandex.com/ Redirect Chain
|
75 B 75 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
advert.gif
mc.yandex.com/metrika/ |
43 B 136 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1
mc.yandex.com/watch/51604940/ Redirect Chain
|
203 B 284 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.htm
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/ Redirect Chain
|
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
portal.css
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cc.js
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
4 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
postnord-logo.svg
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
truck.png
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
8bbe3e0c728b31fe661482b382ea90bb.png
esarzt87-csera88776.freesite.host/media/43RDFD4/BSDF823734/82376GDG/YEHD65647/746GGDT5/Sikker%20betaling%20%234458669%20PostNord_fichiers/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
318 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
StagSansWeb-Book.woff
esarzt87-csera88776.freesite.host/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
StagSansWeb-Book.ttf
esarzt87-csera88776.freesite.host/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
STAGSANS-BOOK.OTF
esarzt87-csera88776.freesite.host/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostNord AB (Transportation)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| $cc object| antiClickjack function| showError function| setFocus undefined| getQueryString function| hideElements function| onLoadPage1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
esarzt87-csera88776.freesite.host/ | Name: b7dd6d5eca666c120ffa2f81cdd1f486 Value: 4392bb8e3aa5c44ae8d513baf62aae97 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
counter.yadro.ru
esarzt87-csera88776.freesite.host
mc.yandex.com
mc.yandex.ru
qoo.gl
u.to
159.69.95.195
195.216.243.155
2607:1b00:93b2:e42c::4f3d
2a02:6b8::1:119
88.212.201.216
197210b2bc4d27bb030f4200f49d03a61f5bb168495ff1ef889b54bfdb6465ba
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3ba73f75360efd1e119b4be51ab2d2b78eefe1a3474f8fb0608f7b876194a17d
4a1ffa1ba38dba98eb33a64eeba9347788e4aff54fc026387d715329858db994
4a325fe14bcb970779a6fa218637b68b3b0eae829ee0dd4405596daacc17417b
535787c4f4449d969e06c30ed43d0fa4e730eab8d6a871f35cef8db89b784b85
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6f9905cbfe09a09e285067f5a8b4274ec35552297c16bb4612c16c5736aff117
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
a02cd135625ec71ff31f3c0784b19510bb9e3582e56258ef070be0459fe8b195
a4e97fa82cfa954d1a71c7c13e57844c718fa48859d9452be6ce1bd282ef389c
c7bb63f0f60d7bba8dcd50709e67379e3cdf663aeb1c76d8d826016bf52e8df2
e9ba89ab3b24fc114a5fa5b57008e5c57455431f82e8b05ce656d343c8fb8a4a