mein.advanzia.com.u1014505k9k.ha004.t.justns.ru
Open in
urlscan Pro
2a00:b700::39
Malicious Activity!
Public Scan
Effective URL: https://mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/index.php
Submission: On February 21 via api from IE
Summary
TLS certificate: Issued by R3 on February 13th 2021. Valid for: 3 months.
This is the only time mein.advanzia.com.u1014505k9k.ha004.t.justns.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Advanzia (Financial)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a00:1450:400... 2a00:1450:4001:803::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82a::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 2a01:e0c:1:15... 2a01:e0c:1:1599::29 | 12322 (PROXAD) (PROXAD) | |
1 1 | 2606:4700:303... 2606:4700:3034::6815:3989 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
18 | 2a00:b700::39 2a00:b700::39 | 51659 (ASBAXET) (ASBAXET) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
23 | 4 |
ASN15169 (GOOGLE, US)
essentialdesignday.blogspot.be |
ASN15169 (GOOGLE, US)
essentialdesignday.blogspot.com |
ASN51659 (ASBAXET, RU)
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
justns.ru
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru |
712 KB |
3 |
gstatic.com
fonts.gstatic.com |
27 KB |
1 |
googleapis.com
fonts.googleapis.com |
849 B |
1 |
kisa.link
1 redirects
www.kisa.link |
748 B |
1 |
free.fr
1 redirects
s.free.fr |
207 B |
1 |
blogspot.com
essentialdesignday.blogspot.com |
15 KB |
1 |
blogspot.be
1 redirects
essentialdesignday.blogspot.be |
405 B |
23 | 7 |
Domain | Requested by | |
---|---|---|
18 | mein.advanzia.com.u1014505k9k.ha004.t.justns.ru |
essentialdesignday.blogspot.com
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru |
3 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru
|
1 | www.kisa.link | 1 redirects |
1 | s.free.fr | 1 redirects |
1 | essentialdesignday.blogspot.com | |
1 | essentialdesignday.blogspot.be | 1 redirects |
23 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
misc-sni.blogspot.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru R3 |
2021-02-13 - 2021-05-14 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/index.php
Frame ID: CAF6802E0CE815BF9EC7C409D353DCCA
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://essentialdesignday.blogspot.be/?id=30095335&m=1
HTTP 302
https://essentialdesignday.blogspot.com/?id=30095335&m=1 Page URL
-
https://s.free.fr/6U6G7VXy
HTTP 301
https://www.kisa.link/Oy3z HTTP 301
https://mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/index.php Page URL
Detected technologies
Java (Programming Languages) ExpandDetected patterns
- headers server /GSE/i
Bootstrap (Web Frameworks) Expand
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
OpenGSE (Web Servers) Expand
Detected patterns
- headers server /GSE/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://essentialdesignday.blogspot.be/?id=30095335&m=1
HTTP 302
https://essentialdesignday.blogspot.com/?id=30095335&m=1 Page URL
-
https://s.free.fr/6U6G7VXy
HTTP 301
https://www.kisa.link/Oy3z HTTP 301
https://mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/index.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://essentialdesignday.blogspot.be/?id=30095335&m=1 HTTP 302
- https://essentialdesignday.blogspot.com/?id=30095335&m=1
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
essentialdesignday.blogspot.com/ Redirect Chain
|
70 KB 15 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.php
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/ Redirect Chain
|
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/css/ |
138 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/css/ |
41 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SpryValidationTextField.css
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/SpryAssets/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SpryValidationPassword.css
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/SpryAssets/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
one__main.css
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/css/ |
552 B 373 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SpryValidationTextField.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/SpryAssets/ |
76 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SpryValidationPassword.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/SpryAssets/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-text.png
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/images/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
card1.jpg
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/images/ |
77 KB 77 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
card2.jpg
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/images/ |
27 KB 27 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/js/ |
68 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/js/ |
20 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/js/ |
50 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome.min.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/js/ |
1 MB 452 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru/de/assets/js/ |
37 B 122 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
9 KB 849 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN_r8OUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Advanzia (Financial)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| Spry function| $ function| jQuery function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome object| sprytextfield1 object| sprypassword10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
essentialdesignday.blogspot.be
essentialdesignday.blogspot.com
fonts.googleapis.com
fonts.gstatic.com
mein.advanzia.com.u1014505k9k.ha004.t.justns.ru
s.free.fr
www.kisa.link
2606:4700:3034::6815:3989
2a00:1450:4001:803::2001
2a00:1450:4001:812::200a
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2001
2a00:b700::39
2a01:e0c:1:1599::29
0ce2e294a77981e7101f7fb710d2fc65102ddc41c2eed87f68ef29acdd8b5485
0ead0d15ac45461b3dd346f5aae8c9d5966350ddf72d18973d450257565946b5
21bd54c766f0a1385f24f0b9a074e83881d82288d9d31bab0e3076721121f52e
315ac5479007d2e864a4b51f505fd0785ebbbe931a6b511467fa49504a082c58
3b589b05c6cf8d582700ad1acaec1201640cf58cda008ca53c0d1a905ad1ffc5
3df1b7719a1aa90d70ae337b76b6253b01ede9afa038b290498c3abf4ab54027
4071e7a5be4e554e532fc93b2daa39fb65cb93a0a40bc690c378663985a501f3
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
5e261f7e11c39ff6f4c8fe884e5c9de2fa15f29085a1adefdd36603ef2e23c00
69e875128adeedbc8aa1221b7ebffb20b484685964f4ab9a9772ce2146e52d48
7112621540dbb2b85887f7da8b7389002f7360358177147f80e5b6683dd5aade
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
7a869daf59fc818e8ee10bb52b9fbd1cc4dc82b70fb36be9a6a763bf6b9bd36b
8915c75ba9f601b8139e33acb78f45d22abfec7e912f8aa390b460c27deb8422
8b09a907df270b94e3382fec0383af440eec50743e8c14697caf209350f910dc
90b1062e67696dc253d20e324ed0dd5f953b39c069cf82e8c6fc14eb9f2f62d6
a5de5107e951e99bd49ff98677ec1fbd04948982af7d6ecaa6f471389b2270b9
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
e8a13de05dde173363fd6e9bcfdc0991aadd0c1124b05398b5c6d9d85924e7b7
f5784d47d1185c89e4c49762d8a5c3a3114546e91ce321834e10a276a688566f
f839760d1621714efedeb3eb08b25e619812dcc33d77aceb0daf405ac727a765