u581082y36.ha003.t.justns.ru Open in urlscan Pro
2a00:b700::28  Malicious Activity! Public Scan

Submitted URL: https://billetclub.com//Adapter/r.php
Effective URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Submission: On January 22 via manual from CA

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 20 HTTP transactions. The main IP is 2a00:b700::28, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u581082y36.ha003.t.justns.ru.
This is the only time u581082y36.ha003.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 213.186.33.40 16276 (OVH)
1 46.105.201.240 16276 (OVH)
1 158.69.248.123 16276 (OVH)
1 16 2a00:b700::28 51659 (ASBAXET)
2 23.111.9.35 33438 (HIGHWINDS2)
20 5
Domain Requested by
16 u581082y36.ha003.t.justns.ru 1 redirects u581082y36.ha003.t.justns.ru
2 use.fontawesome.com u581082y36.ha003.t.justns.ru
1 s4.histats.com s10.histats.com
1 s10.histats.com billetclub.com
1 billetclub.com
20 5

This site contains no links.

Subject Issuer Validity Valid
billetclub.com
Let's Encrypt Authority X3
2020-01-14 -
2020-04-13
3 months crt.sh
histats.com
Let's Encrypt Authority X3
2019-12-27 -
2020-03-26
3 months crt.sh
*.fontawesome.com
DigiCert SHA2 Secure Server CA
2019-10-28 -
2020-12-23
a year crt.sh

This page contains 1 frames:

Primary Page: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Frame ID: E60847FEA603DC6D6C8BEE81B09B65FC
Requests: 20 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://billetclub.com//Adapter/r.php Page URL
  2. http://u581082y36.ha003.t.justns.ru/postt/post HTTP 301
    http://u581082y36.ha003.t.justns.ru/postt/post/ Page URL
  3. http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
  • html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

20
Requests

25 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

202 kB
Transfer

347 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://billetclub.com//Adapter/r.php Page URL
  2. http://u581082y36.ha003.t.justns.ru/postt/post HTTP 301
    http://u581082y36.ha003.t.justns.ru/postt/post/ Page URL
  3. http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • http://u581082y36.ha003.t.justns.ru/postt/post HTTP 301
  • http://u581082y36.ha003.t.justns.ru/postt/post/

20 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
r.php
billetclub.com//Adapter/
764 B
674 B
Document
General
Full URL
https://billetclub.com//Adapter/r.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.186.33.40 Quesnoy-sur-Deule, France, ASN16276 (OVH, FR),
Reverse DNS
cluster011.ovh.net
Software
Apache / PHP/7.2
Resource Hash
19f6174577c95cbcc392143e13498c42caeaa11433f6aece5a8fa9d7a7ba6508

Request headers

:method
GET
:authority
billetclub.com
:scheme
https
:path
//Adapter/r.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user
?1
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User
?1

Response headers

status
200
date
Wed, 22 Jan 2020 23:26:29 GMT
content-type
text/html; charset=UTF-8
server
Apache
x-powered-by
PHP/7.2
vary
Accept-Encoding
content-encoding
gzip
x-iplb-instance
29708
set-cookie
SERVERID104280=112123|XijaK|XijaK; path=/
js15_as.js
s10.histats.com/
11 KB
4 KB
Script
General
Full URL
https://s10.histats.com/js15_as.js
Requested by
Host: billetclub.com
URL: https://billetclub.com//Adapter/r.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668

Request headers

Referer
https://billetclub.com//Adapter/r.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date
Wed, 22 Jan 2020 23:19:56 GMT
content-encoding
br
last-modified
Thu, 06 Dec 2018 14:12:12 GMT
x-cdn-pop-ip
51.254.41.128/26
etag
"-139234964"
x-cacheable
Matched cache
content-type
text/javascript
status
200
x-cdn-pop
rbx1
accept-ranges
bytes
content-length
4333
x-request-id
316639385
0.php
s4.histats.com/stats/
49 B
320 B
Script
General
Full URL
https://s4.histats.com/stats/0.php?4131264&@f16&@g1&@h1&@i1&@j1579735589284&@k0&@l1&@m&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:-114459695&@b3:1579735589&@b4:js15_as.js&@b5:60&@a-_0.2.1&@vhttps%3A%2F%2Fbilletclub.com%2F%2FAdapter%2Fr.php&@w
Requested by
Host: s10.histats.com
URL: https://s10.histats.com/js15_as.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
158.69.248.123 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS
ns542881.ip-158-69-248.net
Software
/
Resource Hash
58f46f6afc034792a96283c648d0e3737cffdf539229fc515638ce39d3f6a4c9

Request headers

Referer
https://billetclub.com//Adapter/r.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:29 GMT
Connection
close
Content-Length
49
Content-Type
text/html;charset=UTF-8
Cookie set /
u581082y36.ha003.t.justns.ru/postt/post/
Redirect Chain
  • http://u581082y36.ha003.t.justns.ru/postt/post
  • http://u581082y36.ha003.t.justns.ru/postt/post/
218 B
589 B
Document
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
e0a5b04b74d68ad6148a4795128c4c6ed1c18dbf79d4524073b31a5626fb9c06

Request headers

Host
u581082y36.ha003.t.justns.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Connection
Keep-Alive
Set-Cookie
PHPSESSID=7e6236fbfeb136b88c01c1055053cd72; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Content-Type
text/html; charset-UTF-8;charset=UTF-8
Content-Length
183
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Date
Wed, 22 Jan 2020 23:26:30 GMT
Server
LiteSpeed

Redirect headers

Connection
Keep-Alive
Content-Type
text/html
Content-Length
705
Date
Wed, 22 Jan 2020 23:26:30 GMT
Server
LiteSpeed
Location
http://u581082y36.ha003.t.justns.ru/postt/post/
Vary
User-Agent
Primary Request authen.php
u581082y36.ha003.t.justns.ru/postt/post/
6 KB
2 KB
Document
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
353434a2c6459e0146f4ed81097aea4ec31f285cf147d5d8c9eaae0cd444ee3f

Request headers

Host
u581082y36.ha003.t.justns.ru
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
http://u581082y36.ha003.t.justns.ru/postt/post/
Accept-Encoding
gzip, deflate
Cookie
PHPSESSID=7e6236fbfeb136b88c01c1055053cd72
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
http://u581082y36.ha003.t.justns.ru/postt/post/

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Content-Length
2333
Content-Encoding
gzip
Vary
Accept-Encoding,User-Agent
Date
Wed, 22 Jan 2020 23:26:30 GMT
Server
LiteSpeed
jquery-latest.min.js
u581082y36.ha003.t.justns.ru/postt/post/lib/js/
94 KB
37 KB
Script
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/js/jquery-latest.min.js
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"1762a-5e28499f-567a08b7a6c33f37;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
37500
Expires
Wed, 29 Jan 2020 23:26:30 GMT
jquery.mask.min.js
u581082y36.ha003.t.justns.ru/postt/post/lib/js/
8 KB
4 KB
Script
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/js/jquery.mask.min.js
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"1ff9-5e28499f-f3582c647ac4b8e3;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
3609
Expires
Wed, 29 Jan 2020 23:26:30 GMT
Acc_Carding.js
u581082y36.ha003.t.justns.ru/postt/post/lib/js/
1 KB
826 B
Script
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/js/Acc_Carding.js
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
8ae2198685862aa7223d6992148994c2b2f5f812746c2b0cb661163e0ffd2e06

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"5b0-5e28499f-bc289d486e88f625;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
421
Expires
Wed, 29 Jan 2020 23:26:30 GMT
chronopost.css
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
2 KB
1 KB
Stylesheet
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/chronopost.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
8f43a9f3e13f3e6e4037387a79d9df3a705d27b808fb4d346209a7a18062c011

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"78f-5e28499f-ae720d82327388b4;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
748
Expires
Wed, 29 Jan 2020 23:26:30 GMT
loading.css
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
482 B
670 B
Stylesheet
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/loading.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
be77f65264e66598326119e42d38a363c12311df7aa5b15d98717d46e098d546

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"1e2-5e28499f-94cf2199a702abaf;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
279
Expires
Wed, 29 Jan 2020 23:26:30 GMT
style.css
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
3 KB
1 KB
Stylesheet
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/style.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3302f8bc164c287ddd6b68e127f573416bce177f16f4364b04a77d3de4bd4eed

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"a92-5e28499f-144eb816aab4ffd6;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
887
Expires
Wed, 29 Jan 2020 23:26:30 GMT
stylee.css
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
7 KB
2 KB
Stylesheet
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/stylee.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"1b59-5e28499f-fb3fedf9946f74d0;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
1957
Expires
Wed, 29 Jan 2020 23:26:30 GMT
css_1.css
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
0
347 B
Stylesheet
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/css_1.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"0-5e28499f-dfc63c93efa275b1;;;"
Vary
User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
0
Expires
Wed, 29 Jan 2020 23:26:30 GMT
font-awesome.min.css
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
30 KB
8 KB
Stylesheet
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/font-awesome.min.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"7918-5e28499f-e91b7e8f14e83ab2;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
7749
Expires
Wed, 29 Jan 2020 23:26:30 GMT
all.css
use.fontawesome.com/releases/v5.1.0/css/
45 KB
11 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.1.0/css/all.css
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Origin
http://u581082y36.ha003.t.justns.ru

Response headers

date
Wed, 22 Jan 2020 23:26:30 GMT
content-encoding
gzip
last-modified
Wed, 20 Jun 2018 20:19:16 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
etag
W/"826c57385f3d35cfed5478ba7b1f5c03"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
status
200
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
canada-post.svg
u581082y36.ha003.t.justns.ru/postt/post/lib/img/
8 KB
3 KB
Image
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/img/canada-post.svg
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
7f0672c2b4104ffcb7aae218d58536ea2067f08f2c980177f1010ba7d761d11f

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"2198-5e28499f-d8e56a2092940da9;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
2920
Expires
Wed, 29 Jan 2020 23:26:30 GMT
gov-canada-logo.svg
u581082y36.ha003.t.justns.ru/postt/post/lib/img/
14 KB
6 KB
Image
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/img/gov-canada-logo.svg
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Content-Encoding
gzip
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"37b3-5e28499f-f85a3532d385d657;gz"
Vary
Accept-Encoding,User-Agent
Content-Type
image/svg+xml
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
5613
Expires
Wed, 29 Jan 2020 23:26:30 GMT
Acc_mask.js
u581082y36.ha003.t.justns.ru/postt/post/lib/js/
128 B
492 B
Script
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/js/Acc_mask.js
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
15efc3fdcbaccb10adfeef693861db381e4422e739a20cd544aacdcda2b78595

Request headers

Referer
http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"80-5e28499f-cace866b58437021;;;"
Vary
User-Agent
Content-Type
application/javascript
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
128
Expires
Wed, 29 Jan 2020 23:26:30 GMT
PlutoSansDPDRegular-Web.woff
u581082y36.ha003.t.justns.ru/postt/post/lib/css/
59 KB
59 KB
Font
General
Full URL
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/PlutoSansDPDRegular-Web.woff
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
HTTP/1.1
Server
2a00:b700::28 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
http://u581082y36.ha003.t.justns.ru/postt/post/lib/css/chronopost.css
Origin
http://u581082y36.ha003.t.justns.ru

Response headers

Date
Wed, 22 Jan 2020 23:26:30 GMT
Last-Modified
Wed, 22 Jan 2020 13:09:51 GMT
Server
LiteSpeed
Etag
"ea8a-5e28499f-50f5941441f04cfa;;;"
Vary
User-Agent
Content-Type
application/x-font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
60042
fa-solid-900.woff2
use.fontawesome.com/releases/v5.1.0/webfonts/
58 KB
59 KB
Font
General
Full URL
https://use.fontawesome.com/releases/v5.1.0/webfonts/fa-solid-900.woff2
Requested by
Host: u581082y36.ha003.t.justns.ru
URL: http://u581082y36.ha003.t.justns.ru/postt/post/authen.php?id=83410680
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer
https://use.fontawesome.com/releases/v5.1.0/css/all.css
Origin
http://u581082y36.ha003.t.justns.ru

Response headers

date
Wed, 22 Jan 2020 23:26:30 GMT
last-modified
Wed, 20 Jun 2018 20:19:36 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
etag
"18d2347ab2a9f40ca2247cdb03303d84"
vary
Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
font/woff2
status
200
access-control-max-age
3000
cache-control
max-age=31556926
x-cache
HIT
accept-ranges
bytes
content-length
59572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery object| $jscomp function| myFunction

1 Cookies

Domain/Path Name / Value
u581082y36.ha003.t.justns.ru/ Name: PHPSESSID
Value: 7e6236fbfeb136b88c01c1055053cd72

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billetclub.com
s10.histats.com
s4.histats.com
u581082y36.ha003.t.justns.ru
use.fontawesome.com
158.69.248.123
213.186.33.40
23.111.9.35
2a00:b700::28
46.105.201.240
15efc3fdcbaccb10adfeef693861db381e4422e739a20cd544aacdcda2b78595
19f6174577c95cbcc392143e13498c42caeaa11433f6aece5a8fa9d7a7ba6508
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668
3302f8bc164c287ddd6b68e127f573416bce177f16f4364b04a77d3de4bd4eed
353434a2c6459e0146f4ed81097aea4ec31f285cf147d5d8c9eaae0cd444ee3f
523d91274c32a5399be88a42dd6a2258fde7f7ff388fe2b440df5cf092a2ba27
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
58f46f6afc034792a96283c648d0e3737cffdf539229fc515638ce39d3f6a4c9
6a50626ef34e5da6014662089f0775c6187d23e5c22379da71203848eac50ee3
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f0672c2b4104ffcb7aae218d58536ea2067f08f2c980177f1010ba7d761d11f
8ae2198685862aa7223d6992148994c2b2f5f812746c2b0cb661163e0ffd2e06
8f43a9f3e13f3e6e4037387a79d9df3a705d27b808fb4d346209a7a18062c011
a83079124373d924ad1402fbc08d2e24d0043234d4c26565f1c368745f55f5d9
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
be77f65264e66598326119e42d38a363c12311df7aa5b15d98717d46e098d546
c99d0b5a290e48d4e4cbb86c29dd12436f465696702a81ded130a411f1e98cd3
ce91e2144ea27f82292ef2c87c5d9e1d0b9994df63836130293865aca18fc550
e0a5b04b74d68ad6148a4795128c4c6ed1c18dbf79d4524073b31a5626fb9c06
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855