f0482698.xsph.ru Open in urlscan Pro
2a0a:2b43:1:4d4d::  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response f0482698.xsph.ru/etwagzdxhfedrfcgyjxhfdszxfgnhvbdwefsrxdgyj/	4 KB 1 KB	75ms 34ms	Document text/html	2a0a:2b43:1:4d4d:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://f0482698.xsph.ru/etwagzdxhfedrfcgyjxhfdszxfgnhvbdwefsrxdgyj/ Protocol HTTP/1.1 Server 2a0a:2b43:1:4d4d:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash 07e86ec46d9b19840922ae287d6bd2e370168a7de677a6038fa7bd0c57c4a67a Request headers Host f0482698.xsph.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server openresty Date Sat, 28 Nov 2020 07:42:27 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Content-Encoding gzip
GET H2	200	paypal.png i.ibb.co/09CXQmD/	5 KB 5 KB	103ms 34ms	Image image/png	145.239.131.51 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/09CXQmD/paypal.png Requested by Host: f0482698.xsph.ru URL: http://f0482698.xsph.ru/etwagzdxhfedrfcgyjxhfdszxfgnhvbdwefsrxdgyj/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.239.131.51 , France, ASN16276 (OVH, FR), Reverse DNS ns3081762.ip-145-239-131.eu Software openresty / Resource Hash 95cead1587e681bc53aa78204fae40ed82b5e914790c7bb4d09e6945fab2c0b3 Request headers Referer http://f0482698.xsph.ru/etwagzdxhfedrfcgyjxhfdszxfgnhvbdwefsrxdgyj/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 28 Nov 2020 07:42:27 GMT last-modified Wed, 25 Nov 2020 18:27:18 GMT server openresty access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 4928 expires Thu, 31 Dec 2037 23:55:55 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

f0482698.xsph.ru
i.ibb.co
145.239.131.51
2a0a:2b43:1:4d4d::
07e86ec46d9b19840922ae287d6bd2e370168a7de677a6038fa7bd0c57c4a67a
95cead1587e681bc53aa78204fae40ed82b5e914790c7bb4d09e6945fab2c0b3