urlscan.io logo urlscan.io
SecurityTrails logo

u497192gfy.ha003.t.justns.ru Open in urlscan Pro
2a00:b700::29  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u2656126.ct.sendgrid.net/wf/click?upn=ntmYJfFW06TN9cIUHJnt-2B9tusDU0M2czyHUe7hIoWHckiWU7dCOkvCZ0SkHaRIpnLsZHy6i-2BLRwZBio...
Effective URL: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Submission Tags: phishing malicious Search All
Submission: On October 25 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 5 countries across 6 domains to perform 6 HTTP transactions. The main IP is 2a00:b700::29, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u497192gfy.ha003.t.justns.ru.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 21st 2019. Valid for: 3 months.
This is the only time u497192gfy.ha003.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.35 11377 (SENDGRID)
1 1 104.111.228.170 16625 (AKAMAI-AS)
1 1 67.199.248.10 396982 (GOOGLE-PR...)
1 1 103.40.152.94 132742 (GGL-AS-AP...)
1 1 43.241.252.216 132742 (GGL-AS-AP...)
1 7 2a00:b700::29 51659 (ASBAXET)
6 1
1    167.89.118.35 (United States)

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789118x35.outbound-mail.sendgrid.net
u2656126.ct.sendgrid.net
1    104.111.228.170 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-228-170.deploy.static.akamaitechnologies.com
us20.mailchimp.com
1    67.199.248.10 (United States)

ASN396982 (GOOGLE-PRIVATE-CLOUD - Google LLC, US)
PTR: bit.ly
bit.ly
1    103.40.152.94 (Hong Kong)

ASN132742 (GGL-AS-AP Guochao Group limited, HK)
xurl.vip
1    43.241.252.216 (China)

ASN132742 (GGL-AS-AP Guochao Group limited, HK)
iurl.vip
7    2a00:b700::29 (Russian Federation)

ASN51659 (ASBAXET, RU)
u497192gfy.ha003.t.justns.ru
Apex Domain
Subdomains		 Transfer
7 justns.ru
u497192gfy.ha003.t.justns.ru
55 KB
1 iurl.vip
iurl.vip
268 B
1 xurl.vip
xurl.vip
237 B
1 bit.ly
bit.ly
264 B
1 mailchimp.com
us20.mailchimp.com
617 B
1 sendgrid.net
u2656126.ct.sendgrid.net
327 B
6 6
Domain Requested by
7 u497192gfy.ha003.t.justns.ru 1 redirects u497192gfy.ha003.t.justns.ru
1 iurl.vip 1 redirects
1 xurl.vip 1 redirects
1 bit.ly 1 redirects
1 us20.mailchimp.com 1 redirects
1 u2656126.ct.sendgrid.net 1 redirects
6 6

This site contains no links.

Subject Issuer Validity Valid
u497192gfy.ha003.t.justns.ru
Let's Encrypt Authority X3		 2019-10-21 -
2020-01-19		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Frame ID: 4A257BC6415BB7F643436C9B62DFA4F7
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://u2656126.ct.sendgrid.net/wf/click?upn=ntmYJfFW06TN9cIUHJnt-2B9tusDU0M2czyHUe7hIoWHckiWU7dCOkvCZ0SkHaR... HTTP 302
    https://us20.mailchimp.com/mctx/click?url=https%3A%2F%2Fbit.ly%2F2N7xVpf&xid=70a18ee76f&uid=126440626&p... HTTP 302
    https://bit.ly/2N7xVpf HTTP 301
    http://xurl.vip/cikf0 HTTP 301
    http://iurl.vip/g5zn5 HTTP 301
    https://u497192gfy.ha003.t.justns.ru/suivrecidessous HTTP 301
    https://u497192gfy.ha003.t.justns.ru/suivrecidessous/ Page URL
  2. https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

1
IPs

5
Countries

55 kB
Transfer

124 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u2656126.ct.sendgrid.net/wf/click?upn=ntmYJfFW06TN9cIUHJnt-2B9tusDU0M2czyHUe7hIoWHckiWU7dCOkvCZ0SkHaRIpnLsZHy6i-2BLRwZBio9caTijgeBIa5aoz4on54F3ztQCsj-2F7u3mmeCFfvrY07vkqukV6DG-2BUXdsNgtGZkGRk5iGXSgKRaxDFzFWL938oroa8hA-3D_6dDQcjj3wZqKDJ6HMe-2BA-2F5XbSFGdSub4debtBT0xT0NSmLIPU3Xsx7zo-2BgSuw0PQ3DfKYtMNM-2FZ6PXcTtxJsLRRMzjr2X1H-2B2UxM0S-2Bo27PGgZPduV-2F5pKSHOfRiqKdMAIMiX5cS-2B13uqKkos9Gc-2BtndjOKPujQUc4a3gvrk4-2FCaRvx3ma56Xf9UDQV5xJL7F2Shfmu9KpiIwbNWqc4k7PrCJcCcsv9JcbBQhNnTh84-3D HTTP 302
    https://us20.mailchimp.com/mctx/click?url=https%3A%2F%2Fbit.ly%2F2N7xVpf&xid=70a18ee76f&uid=126440626&pool=&subject= HTTP 302
    https://bit.ly/2N7xVpf HTTP 301
    http://xurl.vip/cikf0 HTTP 301
    http://iurl.vip/g5zn5 HTTP 301
    https://u497192gfy.ha003.t.justns.ru/suivrecidessous HTTP 301
    https://u497192gfy.ha003.t.justns.ru/suivrecidessous/ Page URL
  2. https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://u2656126.ct.sendgrid.net/wf/click?upn=ntmYJfFW06TN9cIUHJnt-2B9tusDU0M2czyHUe7hIoWHckiWU7dCOkvCZ0SkHaRIpnLsZHy6i-2BLRwZBio9caTijgeBIa5aoz4on54F3ztQCsj-2F7u3mmeCFfvrY07vkqukV6DG-2BUXdsNgtGZkGRk5iGXSgKRaxDFzFWL938oroa8hA-3D_6dDQcjj3wZqKDJ6HMe-2BA-2F5XbSFGdSub4debtBT0xT0NSmLIPU3Xsx7zo-2BgSuw0PQ3DfKYtMNM-2FZ6PXcTtxJsLRRMzjr2X1H-2B2UxM0S-2Bo27PGgZPduV-2F5pKSHOfRiqKdMAIMiX5cS-2B13uqKkos9Gc-2BtndjOKPujQUc4a3gvrk4-2FCaRvx3ma56Xf9UDQV5xJL7F2Shfmu9KpiIwbNWqc4k7PrCJcCcsv9JcbBQhNnTh84-3D HTTP 302
  • https://us20.mailchimp.com/mctx/click?url=https%3A%2F%2Fbit.ly%2F2N7xVpf&xid=70a18ee76f&uid=126440626&pool=&subject= HTTP 302
  • https://bit.ly/2N7xVpf HTTP 301
  • http://xurl.vip/cikf0 HTTP 301
  • http://iurl.vip/g5zn5 HTTP 301
  • https://u497192gfy.ha003.t.justns.ru/suivrecidessous HTTP 301
  • https://u497192gfy.ha003.t.justns.ru/suivrecidessous/

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
u497192gfy.ha003.t.justns.ru/suivrecidessous/
Redirect Chain
  • https://u2656126.ct.sendgrid.net/wf/click?upn=ntmYJfFW06TN9cIUHJnt-2B9tusDU0M2czyHUe7hIoWHckiWU7dCOkvCZ0SkHaRIpnLsZHy6i-2BLRwZBio9caTijgeBIa5aoz4on54F3ztQCsj-2F7u3mmeCFfvrY07vkqukV6DG-2BUXdsNgtGZkG...
  • https://us20.mailchimp.com/mctx/click?url=https%3A%2F%2Fbit.ly%2F2N7xVpf&xid=70a18ee76f&uid=126440626&pool=&subject=
  • https://bit.ly/2N7xVpf
  • http://xurl.vip/cikf0
  • http://iurl.vip/g5zn5
  • https://u497192gfy.ha003.t.justns.ru/suivrecidessous
  • https://u497192gfy.ha003.t.justns.ru/suivrecidessous/
217 B
407 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash

Request headers

:method
GET
:authority
u497192gfy.ha003.t.justns.ru
:scheme
https
:path
/suivrecidessous/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

status
200
set-cookie
PHPSESSID=1bb2788314568d99d733f175bced87c6; path=/
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-type
text/html; charset-UTF-8;charset=UTF-8
content-length
188
content-encoding
br
vary
Accept-Encoding,User-Agent
date
Fri, 25 Oct 2019 20:47:41 GMT
server
LiteSpeed

Redirect headers

status
301
content-type
text/html
content-length
705
date
Fri, 25 Oct 2019 20:47:40 GMT
server
LiteSpeed
location
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/
vary
User-Agent
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-23=":443"; ma=2592000
Primary Request signin.php
u497192gfy.ha003.t.justns.ru/suivrecidessous/ 		3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Requested by
Host: u497192gfy.ha003.t.justns.ru
URL: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
ff694f9b446c020be42d75c5d402c8ac99c1cffc367e41bc0f76aad8ce8aef32

Request headers

:method
GET
:authority
u497192gfy.ha003.t.justns.ru
:scheme
https
:path
/suivrecidessous/signin.php?id=7774357
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=1bb2788314568d99d733f175bced87c6
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Referer
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/

Response headers

status
200
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-type
text/html; charset-UTF-8;charset=UTF-8
content-length
1425
content-encoding
br
vary
Accept-Encoding,User-Agent
date
Fri, 25 Oct 2019 20:47:41 GMT
server
LiteSpeed
bootstrap.css
u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/css/ 		22 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/css/bootstrap.css
Requested by
Host: u497192gfy.ha003.t.justns.ru
URL: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
201f1d03e5534c2081d503a0050c9140ca96c13405d9818110b8e2e884753321

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 25 Oct 2019 20:47:41 GMT
content-encoding
br
last-modified
Sat, 18 May 2019 15:54:20 GMT
server
LiteSpeed
etag
"57ba-5ce02aac-5c67e3a6a1da5f5f;br"
vary
Accept-Encoding,User-Agent
content-type
text/css
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
7118
expires
Fri, 01 Nov 2019 20:47:41 GMT
jquery.1.11.1.min.js
u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/js/ 		94 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/js/jquery.1.11.1.min.js
Requested by
Host: u497192gfy.ha003.t.justns.ru
URL: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 25 Oct 2019 20:47:41 GMT
content-encoding
br
last-modified
Sat, 18 May 2019 15:54:20 GMT
server
LiteSpeed
etag
"1762a-5ce02aac-8a81a9da665fe4d5;br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
44097
expires
Fri, 01 Nov 2019 20:47:41 GMT
login.js
u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/js/ 		817 B
442 B 		Script
General
Check archive.org
Download Go to
Full URL
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/js/login.js
Requested by
Host: u497192gfy.ha003.t.justns.ru
URL: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
91555248b245023c08f525948e72f388c4d17f29cc34a34d2fca28e36835c9a9

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 25 Oct 2019 20:47:41 GMT
content-encoding
br
last-modified
Sat, 18 May 2019 15:54:20 GMT
server
LiteSpeed
etag
"331-5ce02aac-d10514ef3c959fee;br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
363
expires
Fri, 01 Nov 2019 20:47:41 GMT
logo.svg
u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/css/img/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/css/img/logo.svg
Requested by
Host: u497192gfy.ha003.t.justns.ru
URL: https://u497192gfy.ha003.t.justns.ru/suivrecidessous/signin.php?id=7774357
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:b700::29 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://u497192gfy.ha003.t.justns.ru/suivrecidessous/lib/css/bootstrap.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 25 Oct 2019 20:47:41 GMT
content-encoding
br
last-modified
Sat, 18 May 2019 15:54:20 GMT
server
LiteSpeed
etag
"1351-5ce02aac-99b1b33aaaf1a03d;br"
vary
Accept-Encoding,User-Agent
content-type
image/svg+xml
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
2130
expires
Fri, 01 Nov 2019 20:47:41 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies