receptionm.temp.swtest.ru

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 77.222.40.223, located in Russian Federation and belongs to SWEB-AS, RU. The main domain is receptionm.temp.swtest.ru.

This is the only time receptionm.temp.swtest.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Orange (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1 1	107.180.27.213 107.180.27.213	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
5	77.222.40.223 77.222.40.223	44112 (SWEB-AS) (SWEB-AS)
1	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
6	2

1 107.180.27.213 (Ashburn, United States) 1 redirects

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-27-213.ip.secureserver.net

alkami.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 77.222.40.223 (Russian Federation)

ASN44112 (SWEB-AS, RU)
PTR: vh292.sweb.ru

receptionm.temp.swtest.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

smtp1-edbef.firebaseapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	swtest.ru receptionm.temp.swtest.ru	111 KB
1	firebaseapp.com smtp1-edbef.firebaseapp.com	755 B
1	alkami.be 1 redirects alkami.be	317 B
6	3

	Domain	Requested by
5	receptionm.temp.swtest.ru	receptionm.temp.swtest.ru
1	smtp1-edbef.firebaseapp.com	receptionm.temp.swtest.ru
1	alkami.be	1 redirects
6	3

This site contains no links.

Subject Issuer	Validity	Valid
firebaseapp.com GTS CA 1D4	`2022-06-21` - `2022-09-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
Frame ID: 9F33BBE2F535FF6569D288A3E7AD3F7E
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Authentification

Page URL History Show full URLs

https://alkami.be/eXasL HTTP 301
http://receptionm.temp.swtest.ru/public%202%20Orange%202/ Page URL

Page Statistics

6
Requests

17 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

112 kB
Transfer

117 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://alkami.be/eXasL HTTP 301
http://receptionm.temp.swtest.ru/public%202%20Orange%202/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
receptionm.temp.swtest.ru/public%202%20Orange%202/
Redirect Chain

https://alkami.be/eXasL
http://receptionm.temp.swtest.ru/public%202%20Orange%202/

6 KB
3 KB

325ms
69ms

Document
text/html

77.222.40.223
SWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
Protocol: HTTP/1.1
Server: 77.222.40.223 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS: vh292.sweb.ru
Software: nginx/1.19.1 /
Resource Hash: 55ca192d7581ca6fbed2b3007d4953491c3b61c73d30b6e2797ccacd173f5ecc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 27 Jun 2022 16:25:25 GMT
ETag: W/"8d45ab-1657-5e1b726b1bb00"
Keep-Alive: timeout=10
Last-Modified: Sat, 18 Jun 2022 11:27:08 GMT
Server: nginx/1.19.1
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 1
content-type: text/html; charset=UTF-8
date: Mon, 27 Jun 2022 16:25:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
pragma: no-cache
server: Apache
vary: Accept-Encoding
x-powered-by: PHP/8.0.19

GET
H2 200 smtp.js Show response
smtp1-edbef.firebaseapp.com/ 871 B
755 B 155ms
39ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://smtp1-edbef.firebaseapp.com/smtp.js

Requested by

Host: receptionm.temp.swtest.ru
URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://receptionm.temp.swtest.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
last-modified: Thu, 12 Mar 2020 20:21:20 GMT
x-timer: S1656347126.513863,VS0,VE1
etag: "a6843aa02244acd5da02e62d6a4226e4e98cb4970964d8419ce5db8882852b40-br"
x-served-by: cache-muc13977-MUC
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
date: Mon, 27 Jun 2022 16:25:25 GMT
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 387
x-cache-hits: 1

GET
H/1.1 200
OK styles.css
receptionm.temp.swtest.ru/public%202%20Orange%202/css/ 5 KB
1 KB 64ms
63ms Stylesheet
text/css 77.222.40.223
SWEB-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/css/styles.css
Requested by: Host: receptionm.temp.swtest.ru
URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
Protocol: HTTP/1.1
Server: 77.222.40.223 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS: vh292.sweb.ru
Software: nginx/1.19.1 /
Resource Hash: 5ca79c05b41c5b56a993a8358fc2002d46f48676e5ecf8b643496c49421d1a9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 27 Jun 2022 16:25:25 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 Feb 2021 09:26:02 GMT
Server: nginx/1.19.1
ETag: W/"8d45a7-13a8-5bc119f9ebe80"
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=10

GET
H/1.1 200
OK logo.png
receptionm.temp.swtest.ru/public%202%20Orange%202/img/ 3 KB
4 KB 62ms
61ms Image
image/png 77.222.40.223
SWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/img/logo.png
Requested by: Host: receptionm.temp.swtest.ru
URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
Protocol: HTTP/1.1
Server: 77.222.40.223 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS: vh292.sweb.ru
Software: nginx/1.19.1 /
Resource Hash: b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 27 Jun 2022 16:25:25 GMT
Last-Modified: Wed, 24 Feb 2021 09:27:48 GMT
Server: nginx/1.19.1
ETag: "8d45a9-d1a-5bc11a5f02d00"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=10
Content-Length: 3354

GET
H/1.1 200
OK sidebar.png
receptionm.temp.swtest.ru/public%202%20Orange%202/img/ 29 KB
29 KB 65ms
65ms Image
image/png 77.222.40.223
SWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/img/sidebar.png
Requested by: Host: receptionm.temp.swtest.ru
URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
Protocol: HTTP/1.1
Server: 77.222.40.223 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS: vh292.sweb.ru
Software: nginx/1.19.1 /
Resource Hash: 8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 27 Jun 2022 16:25:25 GMT
Last-Modified: Wed, 24 Feb 2021 10:09:16 GMT
Server: nginx/1.19.1
ETag: "8d45aa-72b7-5bc123a3c0b00"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=10
Content-Length: 29367

GET
H/1.1 200
OK footer.png
receptionm.temp.swtest.ru/public%202%20Orange%202/img/ 74 KB
74 KB 78ms
78ms Image
image/png 77.222.40.223
SWEB-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/img/footer.png
Requested by: Host: receptionm.temp.swtest.ru
URL: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
Protocol: HTTP/1.1
Server: 77.222.40.223 , Russian Federation, ASN44112 (SWEB-AS, RU),
Reverse DNS: vh292.sweb.ru
Software: nginx/1.19.1 /
Resource Hash: f6c90b7db38e12494f591eaec3dd476e50e3217026732d9918952e747d80850f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://receptionm.temp.swtest.ru/public%202%20Orange%202/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 27 Jun 2022 16:25:25 GMT
Last-Modified: Wed, 24 Feb 2021 10:09:40 GMT
Server: nginx/1.19.1
ETag: "8d45a8-128a1-5bc123baa4100"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=10
Content-Length: 75937

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			alkami.be/	1969-12-31 23:59:59	Name: PHPSESSID Value: qkddgmbg5jgm024pnnkctr9jel
			alkami.be/	1970-01-20 04:05:48	Name: short_88 Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

alkami.be
receptionm.temp.swtest.ru
smtp1-edbef.firebaseapp.com
107.180.27.213
2620:0:890::100
77.222.40.223
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
55ca192d7581ca6fbed2b3007d4953491c3b61c73d30b6e2797ccacd173f5ecc
5ca79c05b41c5b56a993a8358fc2002d46f48676e5ecf8b643496c49421d1a9a
8dab2dc2566251e916a476c846ea0ed1ce459d26917a088146765ea6b2bef997
b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472
f6c90b7db38e12494f591eaec3dd476e50e3217026732d9918952e747d80850f

receptionm.temp.swtest.ru Open in urlscan Pro 77.222.40.223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

6 Requests

17 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

112 kBTransfer

117 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

2 Cookies

Indicators

receptionm.temp.swtest.ru Open in urlscan Pro
77.222.40.223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

17 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

112 kB
Transfer

117 kB
Size

2
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!