u1505021.cp.regruhosting.ru Open in urlscan Pro
31.31.198.241  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response u1505021.cp.regruhosting.ru/Secure/Secure/index/	7 KB 3 KB	130ms 75ms	Document text/html	31.31.198.241 AS-REG
General Check archive.org Show headers Download Go to Full URL http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol HTTP/1.1 Server 31.31.198.241 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp112.hosting.reg.ru Software nginx / Resource Hash 7accea4778e784e11ec43bf8a0dc007130da8e292868d7e46c457416588af2f1 Request headers Host u1505021.cp.regruhosting.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Server nginx Date Wed, 27 Oct 2021 01:02:32 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Last-Modified Tue, 19 Oct 2021 12:29:36 GMT Content-Encoding gzip
GET H2	200	screen.css acs4.3dsecure.no/mdpayacs/content/040/	3 KB 1 KB	488ms 25ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/screen.css Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Oct 2021 01:02:32 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 19:50:43 GMT server nginx etag W/"614b8913-c14" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	gh-buttons.css acs4.3dsecure.no/mdpayacs/content/040/dk/	13 KB 3 KB	488ms 26ms	Stylesheet text/css	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Oct 2021 01:02:32 GMT content-encoding gzip last-modified Wed, 22 Sep 2021 19:50:43 GMT server nginx etag W/"614b8913-3290" vary Accept-Encoding content-type text/css strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	commons.js Show response acs4.3dsecure.no/mdpayacs/content/	1 KB 823 B	490ms 28ms	Script application/javascript	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/commons.js Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Oct 2021 01:02:32 GMT content-encoding gzip last-modified Thu, 04 Oct 2018 00:56:30 GMT server nginx etag W/"1202-1538614590000" vary Accept-Encoding content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	490ms 29ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H/1.1	200 OK	date_time.js Show response u1505021.cp.regruhosting.ru/Secure/Secure/index/Autentisering_files/	823 B 588 B	49ms 49ms	Script application/javascript	31.31.198.241 AS-REG
General Check archive.org Show headers Download Go to Full URL http://u1505021.cp.regruhosting.ru/Secure/Secure/index/Autentisering_files/date_time.js Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol HTTP/1.1 Server 31.31.198.241 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp112.hosting.reg.ru Software nginx / Resource Hash c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb Request headers Pragma no-cache Accept-Encoding gzip, deflate Host u1505021.cp.regruhosting.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept */* Referer http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 27 Oct 2021 01:02:32 GMT Content-Encoding gzip Last-Modified Thu, 14 Feb 2019 12:05:24 GMT Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type application/javascript
GET H/1.1	200 OK	logo170.png u1505021.cp.regruhosting.ru/Secure/Secure/index/	5 KB 6 KB	792ms 791ms	Image image/png	31.31.198.241 AS-REG
General Check archive.org Show headers Download Go to Show image Full URL http://u1505021.cp.regruhosting.ru/Secure/Secure/index/logo170.png Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol HTTP/1.1 Server 31.31.198.241 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp112.hosting.reg.ru Software nginx / Resource Hash 7cff082fe3676f7e02428c7d1b72b5daf671c05eb60e4e53ddd10267080111f0 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host u1505021.cp.regruhosting.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 27 Oct 2021 01:02:33 GMT Last-Modified Mon, 20 Sep 2021 15:24:00 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 5437 Content-Type image/png
GET H/1.1	200 OK	payment-logos.png u1505021.cp.regruhosting.ru/Secure/Secure/index/	102 KB 102 KB	793ms 743ms	Image image/png	31.31.198.241 AS-REG
General Check archive.org Show headers Download Go to Show image Full URL http://u1505021.cp.regruhosting.ru/Secure/Secure/index/payment-logos.png Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol HTTP/1.1 Server 31.31.198.241 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp112.hosting.reg.ru Software nginx / Resource Hash 16247d383e1830d97e5be2d528ad536b2b25a261745e63d953dc37edb1800660 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host u1505021.cp.regruhosting.ru Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Referer http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Connection keep-alive Cache-Control no-cache Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Date Wed, 27 Oct 2021 01:02:33 GMT Last-Modified Wed, 20 Jan 2021 12:21:04 GMT Server nginx Connection keep-alive Accept-Ranges bytes Content-Length 103945 Content-Type image/png
GET H2	404	jquery-1.9.1.min.js acs4.3dsecure.no/mdpayacs/content/040/js/	0 0	29ms 28ms	Script text/html	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Full URL https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H2	200	plazma%D7%90%D7%91%D7%98%D7%97%D7%AA%20%D7%9E%D7%99%D7%93%D7%A2.jpg www.bankhapoalim.co.il/sites/default/files/media/plazma/Footer/	94 KB 95 KB	265ms 198ms	Image image/jpeg	45.60.207.1 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.bankhapoalim.co.il/sites/default/files/media/plazma/Footer/plazma%D7%90%D7%91%D7%98%D7%97%D7%AA%20%D7%9E%D7%99%D7%93%D7%A2.jpg Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.60.207.1 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 76c6a479e5eb4ab9d273ec6b73d71e69bd419ed45088bdc79d1bccc4ba48e6c4 Security Headers Name Value Strict-Transport-Security max-age=16070400; includeSubDomains X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block; Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Oct 2021 01:02:32 GMT x-content-type-options nosniff, nosniff last-modified Mon, 02 Dec 2019 10:28:16 GMT etag "1787e-598b609985000" x-frame-options SAMEORIGIN content-type image/jpeg x-iinfo 10-67444869-67444872 nNNN RT(1635296552106 0) q(0 0 1 11) r(1 1) U5 strict-transport-security max-age=16070400; includeSubDomains accept-ranges bytes content-length 96382 x-xss-protection 1; mode=block;
GET H2	200	bg-today.jpg www.searates.com/design/images/index/	5 KB 5 KB	33ms 7ms	Image image/jpeg	52.29.192.40 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.searates.com/design/images/index/bg-today.jpg Requested by Host: u1505021.cp.regruhosting.ru URL: http://u1505021.cp.regruhosting.ru/Secure/Secure/index/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.29.192.40 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-29-192-40.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 08c53ea28b527150c02fa6ce4220fbcfa1cbebf221d889ca04089fc9ac638b10 Request headers Accept-Language de-DE,de;q=0.9 Referer http://u1505021.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Oct 2021 01:02:32 GMT last-modified Tue, 26 Oct 2021 16:12:14 GMT server nginx etag "617828de-129b" content-type image/jpeg access-control-allow-origin * cache-control max-age=10368000, public accept-ranges bytes content-length 4763 expires Thu, 24 Feb 2022 01:02:32 GMT
GET H2	200	gh-icons.png acs4.3dsecure.no/mdpayacs/content/040/dk/	4 KB 4 KB	26ms 26ms	Image image/png	185.42.168.133 MODIRUM
General Check archive.org Show headers Download Go to Show image Full URL https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-icons.png Requested by Host: acs4.3dsecure.no URL: https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.42.168.133 , Norway, ASN62248 (MODIRUM, NO), Reverse DNS Software nginx / Resource Hash 018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://acs4.3dsecure.no/mdpayacs/content/040/dk/gh-buttons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 27 Oct 2021 01:02:32 GMT last-modified Wed, 22 Sep 2021 19:50:43 GMT server nginx etag "614b8913-f6c" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 3948

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Israel Post (Transporation)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| date_time function| onBodyLoad function| validate object| date number| year number| month object| months number| d number| day object| days string| h string| m number| s string| result

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bankhapoalim.co.il/	1969-12-31 23:59:59	Name: nlbi_2405640 Value: gDJtRiDsqCQ1wN/aTdinZgAAAAAvpjPVP0jqRV8tu7tqTYwh
			.bankhapoalim.co.il/	1970-01-20 06:59:32	Name: visid_incap_2405640 Value: VhQ+POGQRJeWI6gZFE3R/iileGEAAAAAQUIPAAAAAAAUGmQmoL30fNMQLcf0cDR5
			.bankhapoalim.co.il/	1969-12-31 23:59:59	Name: incap_ses_875_2405640 Value: go5JdWIzj2TxqO9vHqAkDCileGEAAAAAUc0TPpB2yKiAnm1/quFqOA==

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://acs4.3dsecure.no/mdpayacs/content/040/js/jquery-1.9.1.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acs4.3dsecure.no
u1505021.cp.regruhosting.ru
www.bankhapoalim.co.il
www.searates.com
185.42.168.133
31.31.198.241
45.60.207.1
52.29.192.40
018c7d12a799726510b7d6e7ce4a18023b3f70aded8102d3cdee725f34175658
08c53ea28b527150c02fa6ce4220fbcfa1cbebf221d889ca04089fc9ac638b10
16247d383e1830d97e5be2d528ad536b2b25a261745e63d953dc37edb1800660
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
76c6a479e5eb4ab9d273ec6b73d71e69bd419ed45088bdc79d1bccc4ba48e6c4
7accea4778e784e11ec43bf8a0dc007130da8e292868d7e46c457416588af2f1
7cff082fe3676f7e02428c7d1b72b5daf671c05eb60e4e53ddd10267080111f0
c755ac1453166b808d71cdcd5ddce44e18137d626666e38564feeedfb7cdd1cb