u1950673.cp.regruhosting.ru

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 31.31.198.232, located in Russian Federation and belongs to AS-REG, RU. The main domain is u1950673.cp.regruhosting.ru.

This is the only time u1950673.cp.regruhosting.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ficohsa (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	34.149.204.188 34.149.204.188	15169 (GOOGLE) (GOOGLE)
4	31.31.198.232 31.31.198.232	197695 (AS-REG) (AS-REG)
5	2

1 34.149.204.188 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 188.204.149.34.bc.googleusercontent.com

pagserviweb.actualizardeweb.repl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 31.31.198.232 (Russian Federation)

ASN197695 (AS-REG, RU)
PTR: scp103.hosting.reg.ru

u1950673.cp.regruhosting.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	regruhosting.ru u1950673.cp.regruhosting.ru	45 KB
1	repl.co 1 redirects pagserviweb.actualizardeweb.repl.co	272 B
0	ficohsa.com Failed spmfondo.ficohsa.com Failed
5	3

	Domain	Requested by
4	u1950673.cp.regruhosting.ru	u1950673.cp.regruhosting.ru
1	pagserviweb.actualizardeweb.repl.co	1 redirects
0	spmfondo.ficohsa.com Failed	u1950673.cp.regruhosting.ru
5	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://u1950673.cp.regruhosting.ru/
Frame ID: E482BDBA84165DE09F01A3D08895E342
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ficohsa

Page URL History Show full URLs

https://pagserviweb.actualizardeweb.repl.co/ HTTP 302
http://u1950673.cp.regruhosting.ru/ Page URL

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

55 kB
Transfer

164 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pagserviweb.actualizardeweb.repl.co/ HTTP 302
http://u1950673.cp.regruhosting.ru/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response u1950673.cp.regruhosting.ru/ Redirect Chain https://pagserviweb.actualizardeweb.repl.co/ http://u1950673.cp.regruhosting.ru/	2 KB 1 KB	1089ms 787ms	Document text/html	31.31.198.232 AS-REG
General Check archive.org Show headers Download Go to Full URL http://u1950673.cp.regruhosting.ru/ Protocol HTTP/1.1 Server 31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp103.hosting.reg.ru Software nginx / Resource Hash `27013b3c20bd77e1ce94f44eb7d3c617b63083e4cc3ad4161b00f1b4152a1a42` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html Date Wed, 22 Feb 2023 18:03:56 GMT Last-Modified Wed, 22 Feb 2023 15:49:01 GMT Server nginx Transfer-Encoding chunked Redirect headers content-type text/html; charset=UTF-8 date Wed, 22 Feb 2023 18:03:55 GMT expect-ct max-age=2592000, report-uri="https://sentry.repl.it/api/10/security/?sentry_key=615192fd532445bfbbbe966cd7131791" host pagserviweb.actualizardeweb.repl.co location http://u1950673.cp.regruhosting.ru/ replit-cluster global strict-transport-security max-age=7555552; includeSubDomains x-powered-by PHP/7.4.21
GET H/1.1	404 Not Found	prisma.js u1950673.cp.regruhosting.ru/campaigns.ficohsa.com_443/sdk/javascript/	0 0	405ms 405ms	Script text/html	31.31.198.232 AS-REG
General Check archive.org Show headers Download Go to Full URL http://u1950673.cp.regruhosting.ru/campaigns.ficohsa.com_443/sdk/javascript/prisma.js Requested by Host: u1950673.cp.regruhosting.ru URL: http://u1950673.cp.regruhosting.ru/ Protocol HTTP/1.1 Server 31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp103.hosting.reg.ru Software nginx / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer http://u1950673.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Wed, 22 Feb 2023 18:03:57 GMT Content-Encoding gzip Last-Modified Wed, 31 Aug 2022 07:19:10 GMT Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	styles.b1d6cdcc40a888de1051.bundle.css u1950673.cp.regruhosting.ru/Ficohsa_files/	149 KB 44 KB	416ms 415ms	Stylesheet text/css	31.31.198.232 AS-REG
General Check archive.org Show headers Download Go to Full URL http://u1950673.cp.regruhosting.ru/Ficohsa_files/styles.b1d6cdcc40a888de1051.bundle.css Requested by Host: u1950673.cp.regruhosting.ru URL: http://u1950673.cp.regruhosting.ru/ Protocol HTTP/1.1 Server 31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp103.hosting.reg.ru Software nginx / Resource Hash `de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1` Request headers accept-language jp-JP,jp;q=0.9 Referer http://u1950673.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Wed, 22 Feb 2023 18:03:57 GMT Content-Encoding gzip Last-Modified Wed, 22 Feb 2023 15:49:13 GMT Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/css
GET H/1.1	404 Not Found	inline.ca44eecbf42bd41b6278.bundle.js u1950673.cp.regruhosting.ru/	0 0	1959ms 1658ms	Script text/html	31.31.198.232 AS-REG
General Check archive.org Show headers Download Go to Full URL http://u1950673.cp.regruhosting.ru/inline.ca44eecbf42bd41b6278.bundle.js Requested by Host: u1950673.cp.regruhosting.ru URL: http://u1950673.cp.regruhosting.ru/ Protocol HTTP/1.1 Server 31.31.198.232 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS scp103.hosting.reg.ru Software nginx / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer http://u1950673.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Wed, 22 Feb 2023 18:03:58 GMT Content-Encoding gzip Last-Modified Wed, 31 Aug 2022 07:19:10 GMT Server nginx Connection keep-alive Transfer-Encoding chunked Content-Type text/html; charset=utf-8
GET		login.js spmfondo.ficohsa.com/scriptdealer/script/v1/6d8vd/	0 0

GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c5ec4be8ab39da6b3c70de4c17bb84c7af0491fe519380607b791e10a339978` Request headers accept-language jp-JP,jp;q=0.9 Referer http://u1950673.cp.regruhosting.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	10 KB 10 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62` Request headers Referer http://u1950673.cp.regruhosting.ru/ Origin http://u1950673.cp.regruhosting.ru accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Content-Type font/woff2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: spmfondo.ficohsa.com
URL: https://spmfondo.ficohsa.com/scriptdealer/script/v1/6d8vd/login.js?clientId=c24ec572-88e6-41ab-9aa9-af7144c5a394&websiteId=1045

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ficohsa (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange object| _dmo

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://u1950673.cp.regruhosting.ru/campaigns.ficohsa.com_443/sdk/javascript/prisma.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://u1950673.cp.regruhosting.ru/inline.ca44eecbf42bd41b6278.bundle.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pagserviweb.actualizardeweb.repl.co
spmfondo.ficohsa.com
u1950673.cp.regruhosting.ru
spmfondo.ficohsa.com
31.31.198.232
34.149.204.188
27013b3c20bd77e1ce94f44eb7d3c617b63083e4cc3ad4161b00f1b4152a1a42
6c5ec4be8ab39da6b3c70de4c17bb84c7af0491fe519380607b791e10a339978
de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62

u1950673.cp.regruhosting.ru Open in urlscan Pro 31.31.198.232 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

0 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

55 kBTransfer

164 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

u1950673.cp.regruhosting.ru Open in urlscan Pro
31.31.198.232 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

55 kB
Transfer

164 kB
Size

0
Cookies

5 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!