vaillant-uhta.ru Open in urlscan Pro
159.253.21.137 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://vaillant-uhta.ru/seif.php
Submission: On February 20 via automatic, source openphish (February 20th 2017, 1:47:16 am UTC)

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 159.253.21.137, located in Estonia and belongs to FASTNET , EE. The main domain is vaillant-uhta.ru.

This is the only time vaillant-uhta.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	159.253.21.137 159.253.21.137	198068 (FASTNET ) (FASTNET )
9	37.140.192.229 37.140.192.229	39134 (UNITEDNET ) (UNITEDNET )
12	3

2 159.253.21.137 (Estonia)

ASN198068 (FASTNET , EE)
PTR: vkpapa.ru

vaillant-uhta.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 37.140.192.229 (Russian Federation)

ASN39134 (UNITEDNET , RU)
PTR: server127.hosting.reg.ru

kartongp.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	kartongp.ru kartongp.ru Failed	48 KB
2	vaillant-uhta.ru vaillant-uhta.ru	506 B
12	2

	Domain	Requested by
9	kartongp.ru	kartongp.ru vaillant-uhta.ru
2	vaillant-uhta.ru
12	2

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Frame: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1
Frame ID: 14654.1
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

49 kB
Transfer

170 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request 0

http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/
http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request seif.php Show response vaillant-uhta.ru/	91 B 108 B	165ms 42ms	Document text/html	159.253.21.137 FASTNET
General Check archive.org Show headers Download Go to Full URL http://vaillant-uhta.ru/seif.php Protocol HTTP/1.1 Server 159.253.21.137 , Estonia, ASN198068 (FASTNET , EE), Reverse DNS vkpapa.ru Software nginx/1.2.1 / PHP/5.4.41-0+deb7u1 Resource Hash `f3859544d6cd2abd14687d769000666526f76007295fc799d93277eb4b83b631` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host vaillant-uhta.ru Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:09 GMT Content-Encoding gzip Server nginx/1.2.1 X-Powered-By PHP/5.4.41-0+deb7u1 Vary Accept-Encoding Content-Type text/html Connection keep-alive Content-Length 108
GET		Amazon.com%20-%20Sign%20In.php kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/ Redirect Chain http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/ http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1	0 0

GET H/1.1	200 OK	Cookie set favicon.ico vaillant-uhta.ru/	1 KB 398 B	161ms 161ms	Other text/html	159.253.21.137 FASTNET
General Check archive.org Show headers Download Go to Full URL http://vaillant-uhta.ru/favicon.ico Protocol HTTP/1.1 Server 159.253.21.137 , Estonia, ASN198068 (FASTNET , EE), Reverse DNS vkpapa.ru Software nginx/1.2.1 / PHP/5.4.41-0+deb7u1 Resource Hash `01a39c734e8af12daf64a3cb912d74e8876d9124694f9968b0d8fa0e5d38e2a1` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host vaillant-uhta.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://vaillant-uhta.ru/seif.php Connection keep-alive Cache-Control no-cache Referer http://vaillant-uhta.ru/seif.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:09 GMT Content-Encoding gzip Server nginx/1.2.1 X-Powered-By PHP/5.4.41-0+deb7u1 Vary Accept-Encoding Content-Type text/html Set-Cookie 7f89ae7f5fd193b5bcc4f19eb11422ed=89qaktf6cc4m9ll7rk3rn80a36; path=/ Cache-Control no-cache, no-store, must-revalidate Connection keep-alive Content-Length 398
GET H/1.1	200 OK	Amazon.com%20-%20Sign%20In.php Show response kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/ Frame 1468	20 KB 6 KB	59ms 59ms	Document text/html	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / PHP/5.3.28 Resource Hash `37aca898faf535e5de5ee30d008233597b69d796320d720022c4769929fb56b5` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Referer http://vaillant-uhta.ru/seif.php Connection keep-alive Cache-Control no-cache Upgrade-Insecure-Requests 1 Referer http://vaillant-uhta.ru/seif.php User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Content-Encoding gzip Vary Accept-Encoding Server nginx X-Powered-By PHP/5.3.28 Transfer-Encoding chunked Content-Type text/html Connection keep-alive
GET H/1.1	200 OK	ap-flex-.css kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	44 KB 7 KB	46ms 46ms	Stylesheet text/css	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ap-flex-.css Requested by Host: kartongp.ru URL: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `63911a84df2815c7111b762c36e9baf0566d834f1c3833be4ead541dc8fe17bf` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Content-Encoding gzip Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag W/"58aa4a9d-b0c7" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 27 Feb 2017 01:47:10 GMT
GET H/1.1	200 OK	sign-in-.gif kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	3 KB 3 KB	91ms 44ms	Image image/gif	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Show image Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/sign-in-.gif Requested by Host: kartongp.ru URL: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `605f462159b4e3b5352c949d60bf5c3bc109f79d3507f07e9e9b9275c53e2532` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag "58aa4a9d-b48" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 2888 Expires Mon, 27 Feb 2017 01:47:10 GMT
GET H/1.1	200 OK	amazon_l.png kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	1 KB 1 KB	92ms 46ms	Image image/png	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Show image Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/amazon_l.png Requested by Host: kartongp.ru URL: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag "58aa4a9d-5d3" Content-Type image/png Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 1491 Expires Mon, 27 Feb 2017 01:47:10 GMT
GET H/1.1	200 OK	ap-flex-.js Show response kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	84 KB 24 KB	64ms 58ms	Script application/javascript	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ap-flex-.js Requested by Host: kartongp.ru URL: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `0bc4cb5ce0155e27a7227a1440360c34f989e8c735a2abbb5ec5887207453d7f` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Content-Encoding gzip Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag W/"58aa4a9d-15095" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 27 Feb 2017 01:47:10 GMT
GET H/1.1	200 OK	fwcim000.js Show response kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	13 KB 5 KB	87ms 45ms	Script application/javascript	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/fwcim000.js Requested by Host: kartongp.ru URL: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `6ef60999c89187ad68dbc173ad1ae59f3281b0d667ed02a5d67291403ceadaee` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept / Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Content-Encoding gzip Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag W/"58aa4a9d-320a" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=604800 Transfer-Encoding chunked Connection keep-alive Expires Mon, 27 Feb 2017 01:47:10 GMT
GET H/1.1	404 Not Found	uedata kartongp.ru/ap/ Frame 1468	3 KB 1 KB	71ms 70ms	Image text/html	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Show image Full URL http://kartongp.ru/ap/uedata?ld&v=20&id=19PGC4VVCXM3N0NVQ4DQ&sw=1600&sh=1200&vw=1598&vh=1132&m=1&sc=19PGC4VVCXM3N0NVQ4DQ&ue=1&bb=45&af=53&cf=89&be=174&pc=181&tc=-21&na_=-21&fe_=-7&lk_=-7&_lk=-7&co_=-7&_co=-7&rq_=-80&rs_=-21&_rs=-6&dl_=-6&di_=174&de_=174&_de=180&_dc=180&ld_=180&ty=0&rc=0&ld=182&t=1487555230333&ctb=1 Requested by Host: vaillant-uhta.ru URL: http://vaillant-uhta.ru/seif.php Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `425fb249ae716a54e9c4af0fcf64bebd0c8bb2a79937e80e2d79855384f6ddff` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Content-Encoding gzip Transfer-Encoding chunked Server nginx Connection keep-alive Vary Accept-Encoding Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	favicon.gif kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	353 B 353 B	46ms 46ms	Other image/gif	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/favicon.gif Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `d416844fb634bb5e8dcbc71685a29213eb905451584b5a7d647f960ce753f757` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag "58aa4a9d-161" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 353 Expires Mon, 27 Feb 2017 01:47:10 GMT
GET H/1.1	200 OK	favicon.gif kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/ Frame 1468	353 B 353 B	46ms 46ms	Other image/gif	37.140.192.229 UNITEDNET
General Check archive.org Show headers Download Go to Full URL http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/files/favicon.gif Protocol HTTP/1.1 Server 37.140.192.229 , Russian Federation, ASN39134 (UNITEDNET , RU), Reverse DNS server127.hosting.reg.ru Software nginx / Resource Hash `d416844fb634bb5e8dcbc71685a29213eb905451584b5a7d647f960ce753f757` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host kartongp.ru Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 Connection keep-alive Cache-Control no-cache Referer http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Response headers Date Mon, 20 Feb 2017 01:47:10 GMT Last-Modified Mon, 20 Feb 2017 01:47:09 GMT Server nginx ETag "58aa4a9d-161" Content-Type image/gif Cache-Control max-age=604800 Connection keep-alive Accept-Ranges bytes Content-Length 353 Expires Mon, 27 Feb 2017 01:47:10 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: kartongp.ru
URL: http://kartongp.ru/Wwlogin/fe1540d855b071e7bd8116e252de6613/Amazon.com%20-%20Sign%20In.php?encoding=2Fidentifier_selectopenid.identity26useRedirectOnSuccess%3D1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

kartongp.ru
vaillant-uhta.ru
kartongp.ru
159.253.21.137
37.140.192.229
01a39c734e8af12daf64a3cb912d74e8876d9124694f9968b0d8fa0e5d38e2a1
0bc4cb5ce0155e27a7227a1440360c34f989e8c735a2abbb5ec5887207453d7f
37aca898faf535e5de5ee30d008233597b69d796320d720022c4769929fb56b5
425fb249ae716a54e9c4af0fcf64bebd0c8bb2a79937e80e2d79855384f6ddff
605f462159b4e3b5352c949d60bf5c3bc109f79d3507f07e9e9b9275c53e2532
63911a84df2815c7111b762c36e9baf0566d834f1c3833be4ead541dc8fe17bf
6ef60999c89187ad68dbc173ad1ae59f3281b0d667ed02a5d67291403ceadaee
765dd2ecce31f4944b9a329ac0bb16014e0d006a1aa3e4bb7e8d1d2ac4eb1b80
d416844fb634bb5e8dcbc71685a29213eb905451584b5a7d647f960ce753f757
f3859544d6cd2abd14687d769000666526f76007295fc799d93277eb4b83b631

vaillant-uhta.ru Open in urlscan Pro 159.253.21.137 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

12 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

49 kBTransfer

170 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

vaillant-uhta.ru Open in urlscan Pro
159.253.21.137 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

49 kB
Transfer

170 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!