![](/screenshots/8edcf8ab-ac66-47f6-8d1b-cb34cfa9e3b4.png)
u0674082.cp.regruhosting.ru
Open in
urlscan Pro
31.31.198.12
Malicious Activity!
Public Scan
Effective URL: http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/
Submission: On March 13 via manual from ES
Summary
This is the only time u0674082.cp.regruhosting.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: ING Group (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.5 104.244.42.5 | 13414 (TWITTER) (TWITTER - Twitter Inc.) | |
1 1 | 47.52.132.253 47.52.132.253 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
1 | 203.107.232.3 203.107.232.3 | 7693 (COMNET-TH...) (COMNET-TH KSC Commercial Internet Co. Ltd.) | |
3 29 | 31.31.198.12 31.31.198.12 | 197695 (AS-REG) (AS-REG) | |
1 | 193.41.234.21 193.41.234.21 | 16289 (ING-DIREC...) (ING-DIRECT-SPAIN) | |
29 | 4 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
blog.xaoyo.net |
ASN7693 (COMNET-TH KSC Commercial Internet Co. Ltd., TH)
www.bac.co.th |
ASN197695 (AS-REG, RU)
PTR: scp77.hosting.reg.ru
u0674082.cp.regruhosting.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
regruhosting.ru
3 redirects
u0674082.cp.regruhosting.ru |
1 MB |
1 |
ingdirect.es
ing.ingdirect.es |
87 KB |
1 |
bac.co.th
www.bac.co.th |
389 B |
1 |
xaoyo.net
1 redirects
blog.xaoyo.net |
463 B |
1 |
t.co
t.co |
511 B |
29 | 5 |
Domain | Requested by | |
---|---|---|
29 | u0674082.cp.regruhosting.ru |
3 redirects
u0674082.cp.regruhosting.ru
|
1 | ing.ingdirect.es | |
1 | www.bac.co.th |
t.co
|
1 | blog.xaoyo.net | 1 redirects |
1 | t.co | |
29 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
ing.ingdirect.es |
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert SHA2 High Assurance Server CA |
2019-03-07 - 2020-03-07 |
a year | crt.sh |
www.bac.co.th Go Daddy Secure Certificate Authority - G2 |
2019-01-15 - 2020-01-15 |
a year | crt.sh |
ing.ingdirect.es DigiCert Global CA G2 |
2018-03-12 - 2020-03-28 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/
Frame ID: 0F951C3D934D1366C8B3CC3DF7D51176
Requests: 28 HTTP requests in this frame
Frame:
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/dest5.html
Frame ID: 3A926AD608238FADBDBA27E1429F463A
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/8edcf8ab-ac66-47f6-8d1b-cb34cfa9e3b4.png)
Page URL History Show full URLs
- https://t.co/gdyLJkeUfj Page URL
-
http://blog.xaoyo.net/urlredirect.php?go=https://www.bac.co.th/baccrm/custom/55555555.html
HTTP 302
https://www.bac.co.th/baccrm/custom/55555555.html Page URL
-
http://u0674082.cp.regruhosting.ru//Service32/infos/INFOS56568956
HTTP 301
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/ HTTP 302
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30 HTTP 301
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/ Page URL
Detected technologies
![](/vendor/wappa/icons/RequireJS.png)
Detected patterns
- script /require.*\.js/i
Twitter Bootstrap () Expand
Detected patterns
- script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Política de cookies
Search URL Search Domain Scan URL
Title: DNI electrónico.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/gdyLJkeUfj Page URL
-
http://blog.xaoyo.net/urlredirect.php?go=https://www.bac.co.th/baccrm/custom/55555555.html
HTTP 302
https://www.bac.co.th/baccrm/custom/55555555.html Page URL
-
http://u0674082.cp.regruhosting.ru//Service32/infos/INFOS56568956
HTTP 301
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/ HTTP 302
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30 HTTP 301
http://u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://blog.xaoyo.net/urlredirect.php?go=https://www.bac.co.th/baccrm/custom/55555555.html HTTP 302
- https://www.bac.co.th/baccrm/custom/55555555.html
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
gdyLJkeUfj
t.co/ |
469 B 511 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
55555555.html
www.bac.co.th/baccrm/custom/ Redirect Chain
|
111 B 389 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/ Redirect Chain
|
28 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s0689907103637
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
312 B 503 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActivityServer.bs
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
60 B 250 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ActivityServer(1).bs
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
60 B 250 B |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.sync.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
transactional.css
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
3 MB 400 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app-require-config.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
libs.bootstrap.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.bootstrap.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utag.2.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GlobalConfiguration.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.bootstrap.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overall-position.bootstrap.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
overall-position.usualResources.bootstrap.js.t%C3%A9l%C3%A9chargement
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logoING.svg
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
33 KB 12 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
norton-logo.png
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
LogoDNIE-trazado.svg
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
13 KB 5 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest5.html
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ Frame 3A92 |
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
banner-login_1164x300.jpg
ing.ingdirect.es/genoma_transactional/cms_files/posglobal/images/login/ |
87 KB 87 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
transactional.css
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/index_files/ |
3 MB 400 KB |
Font
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icono_twyp.svg
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/assets/images/ |
2 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icons-typography.woff
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/styles/icons-typography/assets/fonts/ |
209 KB 210 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-direct-icons.woff
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/assets/icon-font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-direct-icons.ttf
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/assets/icon-font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ing-direct-icons.woff
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/assets/icon-font/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
INGMeWeb-Regular.ttf
u0674082.cp.regruhosting.ru/Service32/infos/INFOS56568956/3175605d8379ed110e0f5450d3652b30/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: ING Group (Banking)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask string| locationHref object| loginReleaseVersion undefined| parentURL undefined| urlsAllowed object| s_4_Integrate_Eyeblaster_ACM_get_00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | referrer always; |
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 1; mode=block; report=https://twitter.com/i/xss_report |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
blog.xaoyo.net
ing.ingdirect.es
t.co
u0674082.cp.regruhosting.ru
www.bac.co.th
104.244.42.5
193.41.234.21
203.107.232.3
31.31.198.12
47.52.132.253
06d777a08d4a929416222ae3efc2aac3448e42e148546b6272186b3ae34e2840
0c7cb491aa1516c16026e2ddcb8662110085f3cb5cb64d0270b69c62b39343ec
2f2c0872cf8bde37e0afb4ca5b7ca8015375e0ae8a4f83ccdbf879aca84f14d7
3a54d887d8aa316d9dfbcb3d4f15fa0a5cd6d46efcfbdcb1bd6ee10ce987cb83
51d245c03264bfeafda684039b197f12cc46c285d003189d155923f6a101b204
546f7d8b5ad8e3f1382d3654cdd5c99b2596dd3c5f756bedba1b4e1b9d6826ee
6605adf4d7b49f3777d874c58cae56a5a40fd3a456cf1f10ebc2e7067300482e
7137101d85e846dd1abafecf053d03a381bbf63d59ee9a10b92a96b06d7f6d7c
8b78f53b779dcd1267215eeb90c5e48ad32603e397da0e0f96573c3909d91827
9333473effc6bced92f7eb03baefe1cfb2075e28298c0c0ce930c8fe915365b0
a5c74ae990d5d2b575b740de198718c44c9126a1b06358cc2833dce69c655b4b
b1eea92de29b507fdaec41b96d3139e30a089512a920e3c96820a3fc34b8acfd
bfd211309ec9d200dbd1340a4c655d6119146af3dc6d4a3c04a5f61be569d4d3