![](/screenshots/6dc5b426-bf41-43c8-80e1-f5b124626310.png)
zavodfanera.ru
Open in
urlscan Pro
176.99.5.147
Malicious Activity!
Public Scan
Effective URL: https://zavodfanera.ru/contact-us-2/Racspace.com/
Submission: On February 17 via manual from IN
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on December 27th 2019. Valid for: 3 months.
This is the only time zavodfanera.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Rackspace (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 107.180.29.18 107.180.29.18 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 2606:4700::68... 2606:4700::6811:4004 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 176.99.5.147 176.99.5.147 | 49352 (LOGOL-AS) (LOGOL-AS) | |
9 | 3 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-29-18.ip.secureserver.net
rounduprealtycebu.com |
ASN49352 (LOGOL-AS, RU)
PTR: d40902.acod.regrucolo.ru
zavodfanera.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
zavodfanera.ru
zavodfanera.ru |
136 KB |
1 |
cloudflare.com
ajax.cloudflare.com |
2 KB |
1 |
rounduprealtycebu.com
rounduprealtycebu.com |
842 B |
9 | 3 |
Domain | Requested by | |
---|---|---|
7 | zavodfanera.ru |
zavodfanera.ru
|
1 | ajax.cloudflare.com |
rounduprealtycebu.com
|
1 | rounduprealtycebu.com | |
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2019-12-05 - 2020-06-12 |
6 months | crt.sh |
zavodfanera.ru Let's Encrypt Authority X3 |
2019-12-27 - 2020-03-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zavodfanera.ru/contact-us-2/Racspace.com/
Frame ID: 8A4FE6693B12918107C36EC8745B86CB
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/6dc5b426-bf41-43c8-80e1-f5b124626310.png)
Page URL History Show full URLs
- http://rounduprealtycebu.com/wp-admin/js/ Page URL
- https://zavodfanera.ru/contact-us-2/Racspace.com/ Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://rounduprealtycebu.com/wp-admin/js/ Page URL
- https://zavodfanera.ru/contact-us-2/Racspace.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://ajax.cloudflare.com/cdn-cgi/nexp/dok3v=fb690a32f5/cloudflare.min.js HTTP 307
- https://ajax.cloudflare.com/cdn-cgi/nexp/dok3v=fb690a32f5/cloudflare.min.js
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
rounduprealtycebu.com/wp-admin/js/ |
701 B 842 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cloudflare.min.js
ajax.cloudflare.com/cdn-cgi/nexp/dok3v=fb690a32f5/ Redirect Chain
|
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
zavodfanera.ru/contact-us-2/Racspace.com/ |
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
zavodfanera.ru/contact-us-2/Racspace.com/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
zavodfanera.ru/contact-us-2/Racspace.com/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
zavodfanera.ru/contact-us-2/Racspace.com/media/ |
19 KB 19 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-appstore.svg
zavodfanera.ru/contact-us-2/Racspace.com/media/ |
12 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-playstore.png
zavodfanera.ru/contact-us-2/Racspace.com/media/ |
14 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
zavodfanera.ru/contact-us-2/Racspace.com/ |
747 B 914 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Rackspace (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery function| validateInput0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
rounduprealtycebu.com
zavodfanera.ru
107.180.29.18
176.99.5.147
2606:4700::6811:4004
1c5a6fa085d8985092ebb8f8d12a5302f7f475230559bb6ea24b82de0f4edfe9
215e46442382af6784b854e56f70c527d0d205a367c58567c308d3c3fbe31cc2
25178aeef6eb6b83b96f5f2d004eda3bffbb37122de64afbaef7107b384a4132
5de57d878173443ace04bdb74b0016aa4e7e2b63c5abc50f92a95fb120cd19fb
84ae6d578a9103b9515f88ad20d4c8c33fb139ae806ef1ba24883eb098ce849b
c1b48cebe4518523df4febda89d387a211652786c4b9e4ad33f34a1ce62bc88b
f22d2d062732ffa6a3eeb7bfab6c4c86b2e91ae93a7ba5a02594e9ad15a1554e
fdce77a6d0053f32d231518a84a71bcab5c86045ed52369da00b89d4284aef46