URL: http://yusr.ru.xsph.ru/
Submission Tags: https://phish.report @phish_report Search All
Submission: On November 11 via api from FI — Scanned from FI

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main IP is 141.8.197.42, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is yusr.ru.xsph.ru.
This is the only time yusr.ru.xsph.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tuya (Financial)

Domain & IP information

IP Address AS Autonomous System
15 141.8.197.42 35278 (SPRINTHOST)
2 52.222.236.43 16509 (AMAZON-02)
3 45.60.46.18 19551 (INCAPSULA)
20 3
Apex Domain
Subdomains
Transfer
15 xsph.ru
yusr.ru.xsph.ru
87 KB
3 tuya.com.co
www.tuya.com.co — Cisco Umbrella Rank: 652551
100 KB
2 hotjar.com
script.hotjar.com — Cisco Umbrella Rank: 763
34 KB
20 3
Domain Requested by
15 yusr.ru.xsph.ru yusr.ru.xsph.ru
3 www.tuya.com.co yusr.ru.xsph.ru
2 script.hotjar.com yusr.ru.xsph.ru
20 3

This site contains no links.

Subject Issuer Validity Valid
*.hotjar.com
Amazon
2022-10-25 -
2023-11-23
a year crt.sh
*.tuya.com.co
Go Daddy Secure Certificate Authority - G2
2022-07-13 -
2023-07-02
a year crt.sh

This page contains 1 frames:

Primary Page: http://yusr.ru.xsph.ru/
Frame ID: EA8E8901DC0F761ED7E5537B4E86812C
Requests: 20 HTTP requests in this frame

Screenshot

Page Title

Transaccional

Page Statistics

20
Requests

25 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

221 kB
Transfer

424 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
yusr.ru.xsph.ru/
109 KB
21 KB
Document
General
Full URL
http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
f18318def5ac3a2e3732e8d6849f7d92238f55e63ba18f033738e91fec942925

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Fri, 11 Nov 2022 19:31:27 GMT
Server
openresty
Transfer-Encoding
chunked
Vary
Accept-Encoding
Default1.css
yusr.ru.xsph.ru/files/
16 KB
17 KB
Stylesheet
General
Full URL
http://yusr.ru.xsph.ru/files/Default1.css
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
721617d6bd7e2ea4388479bc9fc491f5aaeed5052b3a9921ab3414b62ff5078d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
preact-incoming-feedback.417f8858abb528f56b1d.js
yusr.ru.xsph.ru/files/
0
0
Script
General
Full URL
http://yusr.ru.xsph.ru/files/preact-incoming-feedback.417f8858abb528f56b1d.js
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Content-Encoding
gzip
Server
openresty
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
preact-incoming-feedback.563a27a83688364f89f9.js
script.hotjar.com/
153 KB
31 KB
Script
General
Full URL
https://script.hotjar.com/preact-incoming-feedback.563a27a83688364f89f9.js
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-43.fra56.r.cloudfront.net
Software
/
Resource Hash
e7187f115b4479924d6a12618adb811fd4376fb97666ed433a8afddd54160931
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 04 Oct 2022 09:17:54 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 3431ec594cac61983aae2d9ffaf23980.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
age
3320014
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
31521
last-modified
Wed, 13 Apr 2022 08:30:26 GMT
etag
"097cb79e983c8076614a6d4f7117b3c3"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
q31WUkRkiN2gJPWah3-nnpaEBB7AgA7zbdf3oM43paHs0YtYd5duzA==
botonAceptar.png
yusr.ru.xsph.ru/files/
2 KB
2 KB
Image
General
Full URL
http://yusr.ru.xsph.ru/files/botonAceptar.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
fdd025456871d99b45cf95a30a097d5c168a62c91fd86852cba4802321f6e36a

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
bannerPortalSinMarcas.PNG
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/
16 KB
16 KB
Image
General
Full URL
https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/bannerPortalSinMarcas.PNG
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/files/Default1.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.46.18 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
72a927e2b16de3869cd61aebf6cab10e36c1eb5a2a0d97c0d646f75483d56d1c
Security Headers
Name Value
Strict-Transport-Security 1; mode=max-age=31536000; includeSubDomains; preload, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-content-type
nosniff
strict-transport-security
1; mode=max-age=31536000; includeSubDomains; preload, max-age=31536000
Date
Fri, 11 Nov 2022 19:31:27 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 18 Jul 2022 22:02:17 GMT
X-CDN
Imperva
Etag
"6450c0bf29ad81:0"
X-Frame-Options
DENY
Content-Type
image/png
X-Iinfo
4-3492110-0 0CNN RT(1668195087877 60) q(0 -1 -1 1) r(0 -1)
Cache-Control
max-age=0
Server-Timing
dtSInfo;desc="0", dtRpid;desc="-2107596482"
Accept-Ranges
bytes
Content-Length
15929
x-xss-protection
1; mode=block
boton7.png
yusr.ru.xsph.ru/files/
390 B
647 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton7.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
2d0daec75f26c52c01310f34eb530f1bb7be8a63a5255c921342f900c6289997

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton2.png
yusr.ru.xsph.ru/files/
488 B
745 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton2.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
12fc39cdac1886eba91a0882380f130d9cff3534eec583aaaa349e5afcde14a4

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton1.png
yusr.ru.xsph.ru/files/
329 B
586 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton1.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
2411bc81e5dd4fdc795a7c765c31646965ff3fdbcaba38b9796b23ca3e817191

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton6.png
yusr.ru.xsph.ru/files/
517 B
774 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton6.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
a4713e3c1063ab18c1319bf940a36bc597d7e85407f2568642b114845a9b9e5d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton8.png
yusr.ru.xsph.ru/files/
490 B
747 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton8.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
d31390e89366f51a42e5520688b7c602c5f7235d71b721eea5f5ec8b0af7b071

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton3.png
yusr.ru.xsph.ru/files/
526 B
783 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton3.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
45cac3045106999a87b8f867765d0487a6580553db77eb2fdbb79210ef72dd96

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton0.png
yusr.ru.xsph.ru/files/
478 B
735 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton0.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
8dda372f4a3d8531c00fae6565385ca7e4236e4f650260a387fd86dbfb36a39c

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton4.png
yusr.ru.xsph.ru/files/
430 B
687 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton4.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
9e92deeeefa3bc60c2ce77feb04cebb5cbd0696eb184d52530db195661e96ce5

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton5.png
yusr.ru.xsph.ru/files/
487 B
744 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton5.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
00cb7af9fe26b7938c6dae7dadeef23dcffd61ac52df210615514d29d5beef51

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
boton9.png
yusr.ru.xsph.ru/files/
517 B
774 B
Image
General
Full URL
http://yusr.ru.xsph.ru/files/boton9.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
29bb7140bb550ab6462f97744b0517fb8a7c2df23f452a9e6be930f588ca1f7e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
BotonBorrar.png
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/
4 KB
5 KB
Image
General
Full URL
https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/BotonBorrar.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/files/Default1.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.46.18 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
3b78b12f2643778c214d1994ac99e64993e98997dc502a3164a8582f5d82d99b
Security Headers
Name Value
Strict-Transport-Security 1; mode=max-age=31536000; includeSubDomains; preload, max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-content-type
nosniff
strict-transport-security
1; mode=max-age=31536000; includeSubDomains; preload, max-age=31536000
Date
Fri, 11 Nov 2022 19:31:27 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 18 Jul 2022 22:14:11 GMT
X-CDN
Imperva
Etag
"4d8057b5f39ad81:0"
X-Frame-Options
DENY
Content-Type
image/png
X-Iinfo
4-3492111-0 0CNN RT(1668195087877 61) q(0 -1 -1 3) r(0 -1)
Cache-Control
max-age=0
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1184385543"
Accept-Ranges
bytes
Content-Length
4277
x-xss-protection
1; mode=block
PublicidadPortal.JPG
www.tuya.com.co/PortalTransaccionalTuya/App_Themes/Imagenes/
77 KB
78 KB
Image
General
Full URL
https://www.tuya.com.co:8461/PortalTransaccionalTuya/App_Themes/Imagenes/PublicidadPortal.JPG
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/files/Default1.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.60.46.18 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155
Security Headers
Name Value
Strict-Transport-Security 1; mode=max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-content-type
nosniff
strict-transport-security
1; mode=max-age=31536000; includeSubDomains; preload
Date
Fri, 11 Nov 2022 19:31:28 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 18 Jul 2022 22:02:17 GMT
X-CDN
Imperva
ETag
"f150bebf29ad81:0"
X-Frame-Options
DENY
Content-Type
image/jpeg
X-Iinfo
16-40755638-40755647 NNNN CT(168 189 0) RT(1668195088051 279) q(0 0 3 3) r(5 5) U18
Cache-Control
max-age=0
Server-Timing
dtSInfo;desc="0", dtRpid;desc="1060520137"
Accept-Ranges
bytes
Content-Length
78850
x-xss-protection
1; mode=block
titulos-productos.png
yusr.ru.xsph.ru/files/
40 KB
40 KB
Image
General
Full URL
http://yusr.ru.xsph.ru/files/titulos-productos.png
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/files/Default1.css
Protocol
HTTP/1.1
Server
141.8.197.42 , Russian Federation, ASN35278 (SPRINTHOST, RU),
Reverse DNS
techproxy.from.sh
Software
openresty /
Resource Hash
7faebc0f10df9657e25c137ad413ec2850639a3008fcbbaecbb1e9730051db15

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://yusr.ru.xsph.ru/files/Default1.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Fri, 11 Nov 2022 19:31:28 GMT
Server
openresty
Transfer-Encoding
chunked
Content-Type
image/png
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Expires
Fri, 18 Nov 2022 19:31:28 GMT
font-hotjar_5.65042d.woff2
script.hotjar.com/
2 KB
3 KB
Font
General
Full URL
https://script.hotjar.com/font-hotjar_5.65042d.woff2
Requested by
Host: yusr.ru.xsph.ru
URL: http://yusr.ru.xsph.ru/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-43.fra56.r.cloudfront.net
Software
/
Resource Hash
fab4fef6bbfa8d6464403a14be7de1be5e3e63637a96d994fab10266e1eaf6da
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
http://yusr.ru.xsph.ru/
Origin
http://yusr.ru.xsph.ru
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 04 Oct 2022 09:16:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 9987fa8ab620895e83d1d8f10c40f6d2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
age
3320127
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
last-modified
Tue, 04 Oct 2022 07:09:34 GMT
etag
"c9fb9163f8b7be37023ebe649688bebf"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
CPsVQf-laqRfaxKXIOqMJbRiiO3K1LIlv72AbyBnidyXXezpWGjP6A==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tuya (Financial)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| key_new string| key object| theForm function| __doPostBack function| key_pass function| clear_key function| soloNumeros

3 Cookies

Domain/Path Name / Value
.tuya.com.co/ Name: incap_ses_1094_1881794
Value: v51mY+idyxG3L8H9HKwuDw+jbmMAAAAAKYZ8Zu02CCYrdhWssdxpfA==
.tuya.com.co/ Name: visid_incap_1881794
Value: B+FVO32vRrWm1hFM9Lm1ZBCjbmMAAAAAQUIPAAAAAABxDEd3tP4ikPQO+zg0fVw9
.tuya.com.co/ Name: incap_ses_1612_1881794
Value: BOcLCL6Jm2uY+SXWmvleFhCjbmMAAAAAdsCPOm6WRpKRKi8lput0cQ==

1 Console Messages

Source Level URL
Text
network error URL: http://yusr.ru.xsph.ru/files/preact-incoming-feedback.417f8858abb528f56b1d.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

script.hotjar.com
www.tuya.com.co
yusr.ru.xsph.ru
141.8.197.42
45.60.46.18
52.222.236.43
00cb7af9fe26b7938c6dae7dadeef23dcffd61ac52df210615514d29d5beef51
12fc39cdac1886eba91a0882380f130d9cff3534eec583aaaa349e5afcde14a4
2411bc81e5dd4fdc795a7c765c31646965ff3fdbcaba38b9796b23ca3e817191
29bb7140bb550ab6462f97744b0517fb8a7c2df23f452a9e6be930f588ca1f7e
2d0daec75f26c52c01310f34eb530f1bb7be8a63a5255c921342f900c6289997
3b78b12f2643778c214d1994ac99e64993e98997dc502a3164a8582f5d82d99b
45cac3045106999a87b8f867765d0487a6580553db77eb2fdbb79210ef72dd96
721617d6bd7e2ea4388479bc9fc491f5aaeed5052b3a9921ab3414b62ff5078d
72a927e2b16de3869cd61aebf6cab10e36c1eb5a2a0d97c0d646f75483d56d1c
7faebc0f10df9657e25c137ad413ec2850639a3008fcbbaecbb1e9730051db15
883d0861ea6fc9fb497342decbc083f5a6c56ce1215c325c1d323886f0763155
8dda372f4a3d8531c00fae6565385ca7e4236e4f650260a387fd86dbfb36a39c
9e92deeeefa3bc60c2ce77feb04cebb5cbd0696eb184d52530db195661e96ce5
a4713e3c1063ab18c1319bf940a36bc597d7e85407f2568642b114845a9b9e5d
d31390e89366f51a42e5520688b7c602c5f7235d71b721eea5f5ec8b0af7b071
e7187f115b4479924d6a12618adb811fd4376fb97666ed433a8afddd54160931
f18318def5ac3a2e3732e8d6849f7d92238f55e63ba18f033738e91fec942925
fab4fef6bbfa8d6464403a14be7de1be5e3e63637a96d994fab10266e1eaf6da
fdd025456871d99b45cf95a30a097d5c168a62c91fd86852cba4802321f6e36a