u1950673.cp.regruhosting.ru Open in urlscan Pro
31.31.198.232  Malicious Activity! Public Scan

URL: http://u1950673.cp.regruhosting.ru/
Submission: On February 22 via api from JP — Scanned from JP

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 31.31.198.232, located in Russian Federation and belongs to AS-REG, RU. The main domain is u1950673.cp.regruhosting.ru.
This is the only time u1950673.cp.regruhosting.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ficohsa (Banking)

Domain & IP information

IP Address AS Autonomous System
4 31.31.198.232 197695 (AS-REG)
5 2
Apex Domain
Subdomains
Transfer
4 regruhosting.ru
u1950673.cp.regruhosting.ru
45 KB
0 ficohsa.com Failed
spmfondo.ficohsa.com Failed
5 2
Domain Requested by
4 u1950673.cp.regruhosting.ru u1950673.cp.regruhosting.ru
0 spmfondo.ficohsa.com Failed u1950673.cp.regruhosting.ru
5 2

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://u1950673.cp.regruhosting.ru/
Frame ID: FC41E318C9F388F5264B35E954D57632
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Ficohsa

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

55 kB
Transfer

164 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
u1950673.cp.regruhosting.ru/
2 KB
1 KB
Document
General
Full URL
http://u1950673.cp.regruhosting.ru/
Protocol
HTTP/1.1
Server
31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
scp103.hosting.reg.ru
Software
nginx /
Resource Hash
27013b3c20bd77e1ce94f44eb7d3c617b63083e4cc3ad4161b00f1b4152a1a42

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Wed, 22 Feb 2023 18:03:54 GMT
Last-Modified
Wed, 22 Feb 2023 15:49:01 GMT
Server
nginx
Transfer-Encoding
chunked
prisma.js
u1950673.cp.regruhosting.ru/campaigns.ficohsa.com_443/sdk/javascript/
0
0
Script
General
Full URL
http://u1950673.cp.regruhosting.ru/campaigns.ficohsa.com_443/sdk/javascript/prisma.js
Requested by
Host: u1950673.cp.regruhosting.ru
URL: http://u1950673.cp.regruhosting.ru/
Protocol
HTTP/1.1
Server
31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
scp103.hosting.reg.ru
Software
nginx /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://u1950673.cp.regruhosting.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Wed, 22 Feb 2023 18:03:55 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 Aug 2022 07:19:10 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
styles.b1d6cdcc40a888de1051.bundle.css
u1950673.cp.regruhosting.ru/Ficohsa_files/
149 KB
44 KB
Stylesheet
General
Full URL
http://u1950673.cp.regruhosting.ru/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css
Requested by
Host: u1950673.cp.regruhosting.ru
URL: http://u1950673.cp.regruhosting.ru/
Protocol
HTTP/1.1
Server
31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
scp103.hosting.reg.ru
Software
nginx /
Resource Hash
de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://u1950673.cp.regruhosting.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Wed, 22 Feb 2023 18:03:55 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Feb 2023 15:49:13 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/css
inline.ca44eecbf42bd41b6278.bundle.js
u1950673.cp.regruhosting.ru/
0
0
Script
General
Full URL
http://u1950673.cp.regruhosting.ru/inline.ca44eecbf42bd41b6278.bundle.js
Requested by
Host: u1950673.cp.regruhosting.ru
URL: http://u1950673.cp.regruhosting.ru/
Protocol
HTTP/1.1
Server
31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
scp103.hosting.reg.ru
Software
nginx /
Resource Hash

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://u1950673.cp.regruhosting.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Wed, 22 Feb 2023 18:03:55 GMT
Content-Encoding
gzip
Last-Modified
Wed, 31 Aug 2022 07:19:10 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=utf-8
login.js
spmfondo.ficohsa.com/scriptdealer/script/v1/2f6vh8/
0
0

truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6c5ec4be8ab39da6b3c70de4c17bb84c7af0491fe519380607b791e10a339978

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://u1950673.cp.regruhosting.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
10 KB
10 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

Request headers

Referer
http://u1950673.cp.regruhosting.ru/
Origin
http://u1950673.cp.regruhosting.ru
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Content-Type
font/woff2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
spmfondo.ficohsa.com
URL
https://spmfondo.ficohsa.com/scriptdealer/script/v1/2f6vh8/login.js?clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394&websiteId=1045

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ficohsa (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange object| _dmo

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: http://u1950673.cp.regruhosting.ru/campaigns.ficohsa.com_443/sdk/javascript/prisma.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://u1950673.cp.regruhosting.ru/inline.ca44eecbf42bd41b6278.bundle.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)