a0319559.xsph.ru Open in urlscan Pro
2a0a:2b43:e6:4182:: Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6e...
Submission Tags: @ipnigh
Submission: On July 15 via api (July 15th 2019, 6:06:26 pm UTC) from GB

Summary HTTP 22 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 22 HTTP transactions. The main IP is 2a0a:2b43:e6:4182::, located in Russian Federation and belongs to SPRINTHOST, RU. The main domain is a0319559.xsph.ru.

This is the only time a0319559.xsph.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Suntrust (Banking)

Domain & IP information

	IP Address	AS Autonomous System
14	2a0a:2b43:e6:... 2a0a:2b43:e6:4182::	35278 (SPRINTHOST) (SPRINTHOST)
2	18.196.132.206 18.196.132.206	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
22	3

14 2a0a:2b43:e6:4182:: (Russian Federation)

ASN35278 (SPRINTHOST, RU)

a0319559.xsph.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.196.132.206 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-196-132-206.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	xsph.ru a0319559.xsph.ru	319 KB
2	ensighten.com nexus.ensighten.com	1 KB
0	liveperson.net Failed lptag.liveperson.net Failed
0	suntrust.com Failed somni.suntrust.com Failed onlinebanking.suntrust.com Failed
22	4

	Domain	Requested by
14	a0319559.xsph.ru	a0319559.xsph.ru
2	nexus.ensighten.com	a0319559.xsph.ru
0	lptag.liveperson.net Failed	a0319559.xsph.ru
0	onlinebanking.suntrust.com Failed	a0319559.xsph.ru
0	somni.suntrust.com Failed	a0319559.xsph.ru
22	5

This site contains no links.

Subject Issuer	Validity	Valid
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2018-10-17` - `2020-01-05`	a year	crt.sh
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh

This page contains 1 frames:

Primary Page: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland
Frame ID: 5D9B05BCB92CCF172C6683F41DC82558
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Page Statistics

22
Requests

9 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

320 kB
Transfer

1223 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 1.html Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/	13 KB 5 KB	66ms 33ms	Document text/html	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `cfef5507f7573f5aab1993e2a98032b5ebc8da9b4004b47a7c1bd0dc2c4346ac` Request headers Host a0319559.xsph.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Server openresty Date Mon, 15 Jul 2019 18:05:51 GMT Content-Type text/html Last-Modified Sat, 16 Feb 2019 01:59:42 GMT Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding ETag W/"5c676e8e-3203" Expires Mon, 22 Jul 2019 18:05:51 GMT Cache-Control max-age=604800 Content-Encoding gzip
GET		s72735887657314 somni.suntrust.com/b/ss/suntrustprod/10/JS-1.8.0/	0 0

GET H/1.1	200 OK	c27de289d852dd27cd857fa2ce10cfaf.js Show response nexus.ensighten.com/suntrust/olb/code/	24 B 371 B	149ms 36ms	Script application/javascript	18.196.132.206 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/suntrust/olb/code/c27de289d852dd27cd857fa2ce10cfaf.js?conditionId0=374851 Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.196.132.206 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-196-132-206.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Last-Modified Thu, 05 Apr 2012 12:15:43 GMT Server nginx ETag "4f7d8cef-18" Content-Type application/javascript; charset=utf-8 Cache-Control no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 24 Expires Mon, 15 Jul 2019 18:05:50 GMT
GET H/1.1	200 OK	serverComponent.php Show response nexus.ensighten.com/suntrust/olb/	520 B 757 B	109ms 21ms	Script text/javascript	18.196.132.206 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/suntrust/olb/serverComponent.php?r=8982943741.423117&ClientID=1642&PageID=https%3A%2F%2Fonlinebanking.suntrust.com%2FUI%2Flogin Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.196.132.206 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-196-132-206.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash `5c4e64fc9746cb1c02266a0a1cf33fa96ff6b1a489fb809a0846f2d2671792e5` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Cache-Control no-cache, no-store Expires Mon, 15 Jul 2019 18:05:50 GMT Server nginx Connection keep-alive Content-Length 520 Content-Type text/javascript
GET H/1.1	200 OK	dtagent639__1009.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	37 KB 16 KB	77ms 41ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/dtagent639__1009.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `1bfcd22ace15b7923a78cbdc07f693362644497281f33b3cb704a2c6aa874a3b` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:35:54 GMT Server openresty ETag W/"5a9bbdfa-922b" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET		com-suntrust-olb.min.css onlinebanking.suntrust.com/UI/assetsbuild/css/	0 0

GET H/1.1	200 OK	modernizr.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	11 KB 5 KB	83ms 47ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/modernizr.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `cfe45a1ce7b20627f4bfa65e51ac405bccb051b9a2ba4f1a983b7b21f6216e06` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:35:24 GMT Server openresty ETag W/"5a9bbddc-2bfc" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	2.css a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	315 KB 53 KB	79ms 44ms	Stylesheet text/css	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/2.css Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `efd2cb9e7bae03f20763e3aa257512723cb21d028db3969c2076c1c4a0bdd204` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:43:38 GMT Server openresty ETag W/"5a9bbfca-4eb9a" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET		Bootstrap.js nexus.ensighten.com/suntrust/olb/	0 0

GET H/1.1	200 OK	rsalibsmin.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	39 KB 13 KB	80ms 44ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/rsalibsmin.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `4ba95f8753ab0101fa04d04eff3d2967d5c3246621b5df4a0f17dbdd1ddec004` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:36:44 GMT Server openresty ETag W/"5a9bbe2c-9abd" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	require.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	15 KB 7 KB	84ms 48ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/require.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `af718460fe963f6f22bfa6642fa5672ed88b1793e15dd52472f5ad6f77b5ef2c` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:37:08 GMT Server openresty ETag W/"5a9bbe44-3b0a" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	Config.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	19 KB 4 KB	81ms 45ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/Config.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `a80bb2d45b2f1a9b901493f8c99dfb277a1a7ef1e16baac28ceedc459e9776a8` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:37:52 GMT Server openresty ETag W/"5a9bbe70-4c3f" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	le2-mtagconfig.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	2 KB 1 KB	122ms 33ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/le2-mtagconfig.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `1107e7d28eedf3ebf1317d120085b6d2fd93f9527a7661c0d6f6bfcb6f9e80d4` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:38:20 GMT Server openresty ETag W/"5a9bbe8c-686" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	LPAttributes.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	4 KB 1 KB	125ms 37ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/LPAttributes.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `dbbd7a3e8bb16eb44b408f3f97041cc5afdedc4d6392edee83abff6cb20872b4` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:38:44 GMT Server openresty ETag W/"5a9bbea4-eae" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	LiveEngageChatSSO.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	300 B 621 B	126ms 37ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/LiveEngageChatSSO.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `f2d46005669657fba83d9aa788c992a1d0f322e489d5a3fcc767c97bad777dfb` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Last-Modified Sun, 04 Mar 2018 09:39:12 GMT Server openresty ETag "5a9bbec0-12c" Content-Type application/x-javascript Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 300 Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	CommonModule.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	520 KB 163 KB	136ms 47ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/CommonModule.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `24e4ec1491b94968cdc7b43027554de2232c23262e1e7b0254d2098b7891d1dc` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:39:56 GMT Server openresty ETag W/"5a9bbeec-820be" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	Main.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	187 KB 30 KB	146ms 37ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/Main.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `e8ef4f6df5ab88980a09002c8fbba9f99914930e30a7cca174eeaa4c18e67786` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:40:22 GMT Server openresty ETag W/"5a9bbf06-2ea73" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET H/1.1	200 OK	jsrsasignmin.js Show response a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/	63 KB 19 KB	176ms 53ms	Script application/x-javascript	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/jsrsasignmin.js Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `62812e916d1dbd0eedd06b8e7f8b3219554c90512825a6b95443fe314ca2344c` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 15 Jul 2019 18:05:51 GMT Content-Encoding gzip Last-Modified Sun, 04 Mar 2018 09:40:50 GMT Server openresty ETag W/"5a9bbf22-fb11" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 22 Jul 2019 18:05:51 GMT
GET		tag.js lptag.liveperson.net/tag/	0 0

GET		.jsonp lptag.liveperson.net/lptag/api/account/65817029/configuration/applications/taglets/	0 0

GET		.jsonp lptag.liveperson.net/lptag/api/account/65817029/configuration/applications/taglets/	0 0

POST H/1.1	404 Not Found	dynaTraceMonitor Show response a0319559.xsph.ru/UI/	289 B 461 B	34ms 34ms	XHR text/html	2a0a:2b43:e6:4182:: SPRINTHOST
General Check archive.org Show headers Download Go to Full URL http://a0319559.xsph.ru/UI/dynaTraceMonitor Requested by Host: a0319559.xsph.ru URL: http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/T.Goe/dtagent639__1009.js Protocol HTTP/1.1 Security , , Server 2a0a:2b43:e6:4182:: , Russian Federation, ASN35278 (SPRINTHOST, RU), Reverse DNS Software openresty / Resource Hash `cabeb51db5b6491ded215c12abb4730cf09dd6307d6eb21b22a67117e76226fe` Request headers Referer http://a0319559.xsph.ru/SunTrustOnline-Zelle/Online/login/Data/6r2gfb6sfh6b14s6w546bh541tsw64b1hsw/1/1.html?PL=_4cf48b6edc7968f64f8215c627e3d5c4=Poland Origin http://a0319559.xsph.ru User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Mon, 15 Jul 2019 18:06:01 GMT Server openresty Connection keep-alive Content-Length 289 Content-Type text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: somni.suntrust.com
URL: https://somni.suntrust.com/b/ss/suntrustprod/10/JS-1.8.0/s72735887657314?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=17%2F8%2F2017%200%3A6%3A32%200%20-120&cid.&st_adobeanalytics.&id=43426087135501187330235219221809837903&.st_adobeanalytics&.cid&d.&nsid=0&jsonv=1&.d&mid=43426087135501187330235219221809837903&aamlh=6&ce=UTF-8&ns=suntrust&pageName=STcom%7COLB%7CSignOnDedicated&g=https%3A%2F%2Fonlinebanking.suntrust.com%2FUI%2Flogin%23%2F&c.&vidAPICheck=VisitorAPI%20Present&.c&cc=USD&ch=STcom&server=https%3A%2F%2Fonlinebanking.suntrust.com%2Fui%2Flogin%23%2F&aamb=NRX38WO0n5BH8Th-nqAG_A&h1=STcom%7COLB&c7=5%3A06%20PM%7CSaturday&v7=5%3A06%20PM%7CSaturday&v10=D%3Dch&c11=STcom%7COLB&c12=STcom%7COLB&c13=STcom%7COLB&c14=STcom%7COLB&v19=STcom%7COLB%7CSignOnDedicated&c30=STcom%7COLB%7CSignOnDedicated&c31=79&c32=79&c33=794&v39=p&v40=%2B1&c50=SunTrust%20s_code%20v5.8%7COmniture%20Base%20Code%20AM%201.8.0&s=1600x900&c=24&j=1.6&v=N&k=Y&bw=1600&bh=794&AQE=1

Domain: onlinebanking.suntrust.com
URL: https://onlinebanking.suntrust.com/UI/assetsbuild/css/com-suntrust-olb.min.css

Domain: nexus.ensighten.com
URL: http://nexus.ensighten.com/suntrust/olb/Bootstrap.js

Domain: lptag.liveperson.net
URL: https://lptag.liveperson.net/tag/tag.js?site=65817029

Domain: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/65817029/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1

Domain: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/65817029/configuration/applications/taglets/.jsonp?v=2.0&df=0&ct=lpSecureStorage%2Clp_testingTool%2Clp_sdes%2Cscraper%2ClpActivityMonitor%2CrendererStub%2Clp_version_detector%2Clp_monitoringSDK%2ClpTransporter%2ClpUnifiedWindow%2CSMT%2Chooks%2Clp_SMT%2Cauthenticator%2CjsLoader&s=STcom-OLB-SignOnDedicated&b=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Suntrust (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a0319559.xsph.ru
lptag.liveperson.net
nexus.ensighten.com
onlinebanking.suntrust.com
somni.suntrust.com
lptag.liveperson.net
nexus.ensighten.com
onlinebanking.suntrust.com
somni.suntrust.com
18.196.132.206
2a0a:2b43:e6:4182::
1107e7d28eedf3ebf1317d120085b6d2fd93f9527a7661c0d6f6bfcb6f9e80d4
1bfcd22ace15b7923a78cbdc07f693362644497281f33b3cb704a2c6aa874a3b
1eeac0c64e470dee27f5a247a04d72fdc46f8b5e6809fdd865c01dc56a2853a8
24e4ec1491b94968cdc7b43027554de2232c23262e1e7b0254d2098b7891d1dc
4ba95f8753ab0101fa04d04eff3d2967d5c3246621b5df4a0f17dbdd1ddec004
5c4e64fc9746cb1c02266a0a1cf33fa96ff6b1a489fb809a0846f2d2671792e5
62812e916d1dbd0eedd06b8e7f8b3219554c90512825a6b95443fe314ca2344c
a80bb2d45b2f1a9b901493f8c99dfb277a1a7ef1e16baac28ceedc459e9776a8
af718460fe963f6f22bfa6642fa5672ed88b1793e15dd52472f5ad6f77b5ef2c
cabeb51db5b6491ded215c12abb4730cf09dd6307d6eb21b22a67117e76226fe
cfe45a1ce7b20627f4bfa65e51ac405bccb051b9a2ba4f1a983b7b21f6216e06
cfef5507f7573f5aab1993e2a98032b5ebc8da9b4004b47a7c1bd0dc2c4346ac
dbbd7a3e8bb16eb44b408f3f97041cc5afdedc4d6392edee83abff6cb20872b4
e8ef4f6df5ab88980a09002c8fbba9f99914930e30a7cca174eeaa4c18e67786
efd2cb9e7bae03f20763e3aa257512723cb21d028db3969c2076c1c4a0bdd204
f2d46005669657fba83d9aa788c992a1d0f322e489d5a3fcc767c97bad777dfb

a0319559.xsph.ru Open in urlscan Pro 2a0a:2b43:e6:4182:: Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

9 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

3 IPs

2 Countries

320 kBTransfer

1223 kBSize

0 Cookies

0 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

a0319559.xsph.ru Open in urlscan Pro
2a0a:2b43:e6:4182:: Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

9 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

320 kB
Transfer

1223 kB
Size

0
Cookies

22 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!