rostandards.com Open in urlscan Pro
66.147.238.174 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://rostandards.com/
Effective URL:
https://rostandards.com/login.php
Submission: On May 01 via api (May 1st 2024, 10:26:24 pm UTC) from US — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 66.147.238.174, located in United States and belongs to HOSTROCKET, US. The main domain is rostandards.com.
TLS certificate: Issued by R3 on April 27th 2024. Valid for: 3 months.

This is the only time rostandards.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 10	66.147.238.174 66.147.238.174		23535 (HOSTROCKET) (HOSTROCKET)
9	1

10 66.147.238.174 (United States) 1 redirects

ASN23535 (HOSTROCKET, US)
PTR: gladiolus.hostnownow.com

rostandards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	rostandards.com 1 redirects rostandards.com	114 KB
9	1

	Domain	Requested by
10	rostandards.com	1 redirects rostandards.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
rostandards.com R3	`2024-04-27` - `2024-07-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://rostandards.com/login.php
Frame ID: 2244CACE226481E4A218B85EC6C5075F
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home | Ro-standards

Page URL History Show full URLs

http://rostandards.com/ HTTP 307
https://rostandards.com/ HTTP 302
https://rostandards.com/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

113 kB
Transfer

205 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://rostandards.com/ HTTP 307
https://rostandards.com/ HTTP 302
https://rostandards.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response rostandards.com/ Redirect Chain http://rostandards.com/ https://rostandards.com/ https://rostandards.com/login.php	4 KB 1 KB	126ms 126ms	Document text/html	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / PHP/5.6.40 Resource Hash `665fb03aa6c9eb2ee1105f72938277de1007b12795bfaa52f6ed4b89f09693ea` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-encoding br content-length 1327 content-type text/html; charset=UTF-8 date Wed, 01 May 2024 22:26:17 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding x-powered-by PHP/5.6.40 Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Wed, 01 May 2024 22:26:17 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location /login.php pragma no-cache server LiteSpeed x-powered-by PHP/5.6.40
GET H2	200	admin.css rostandards.com/css/	7 KB 1 KB	362ms 361ms	Stylesheet text/css	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/css/admin.css Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `241650dec32e7c3371b7c03a221f0a716fd3324a5b3b620005ce135e4cea0455` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT content-encoding br last-modified Sat, 23 Nov 2019 21:00:54 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 1045 expires Wed, 08 May 2024 22:26:17 GMT
GET H2	200	styles.css rostandards.com/css/	8 KB 825 B	363ms 362ms	Stylesheet text/css	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/css/styles.css Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `9d3c229b4a94a10767f8cc099e4dfef7ef6618676acf450899daa68f7879c7b5` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT content-encoding br last-modified Sat, 23 Nov 2019 21:00:54 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 792 expires Wed, 08 May 2024 22:26:17 GMT
GET H2	200	SpryValidationTextField.css rostandards.com/library/spry/textfieldvalidation/	3 KB 944 B	362ms 361ms	Stylesheet text/css	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/library/spry/textfieldvalidation/SpryValidationTextField.css Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `775795810a39a9ca0d65c24b97ea33ca1a24f13036349e281a5fd0cbabdf9866` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT content-encoding br last-modified Sat, 23 Nov 2019 21:00:52 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 912 expires Wed, 08 May 2024 22:26:17 GMT
GET H2	200	SpryValidationTextField.js Show response rostandards.com/library/spry/textfieldvalidation/	73 KB 16 KB	243ms 242ms	Script application/javascript	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/library/spry/textfieldvalidation/SpryValidationTextField.js Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `96cb9fb9faa9af5b370ecfcee516fc9c1efcddaddc5fd5fd009be3ac7ea0cd8d` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT content-encoding br last-modified Sat, 23 Nov 2019 21:00:52 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 16288 expires Wed, 08 May 2024 22:26:17 GMT
GET H2	200	SpryValidationPassword.css rostandards.com/library/spry/passwordvalidation/	2 KB 782 B	363ms 362ms	Stylesheet text/css	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/library/spry/passwordvalidation/SpryValidationPassword.css Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `65b41d9ab1c132bf89fe89ca464550b60019aebf5aa7d7c479b924921ccda07c` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT content-encoding br last-modified Sat, 23 Nov 2019 21:00:52 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 accept-ranges bytes content-length 749 expires Wed, 08 May 2024 22:26:17 GMT
GET H2	200	SpryValidationPassword.js Show response rostandards.com/library/spry/passwordvalidation/	20 KB 5 KB	244ms 243ms	Script application/javascript	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/library/spry/passwordvalidation/SpryValidationPassword.js Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `13ba894342b76563c80c26d7bbbde0fb9ff93786ed9c1468eedb563d044d1a8e` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT content-encoding br last-modified Sat, 23 Nov 2019 21:00:52 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes content-length 4597 expires Wed, 08 May 2024 22:26:17 GMT
GET H2	200	logo.png rostandards.com/images/	72 KB 72 KB	245ms 244ms	Image image/png	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Show image Full URL https://rostandards.com/images/logo.png Requested by Host: rostandards.com URL: https://rostandards.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `4fca0968ef0c451ca1c07deaff40f8d3318d86a9eb43e68761d8888678722cc3` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT last-modified Mon, 28 Nov 2022 19:27:12 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 73359 expires Wed, 08 May 2024 22:26:17 GMT
GET H3	200	icon.png rostandards.com/images/	16 KB 16 KB	222ms 222ms	Other image/png	66.147.238.174 HOSTROCKET
General Check archive.org Show headers Download Go to Full URL https://rostandards.com/images/icon.png Protocol H3 Security QUIC, , AES_128_GCM Server 66.147.238.174 , United States, ASN23535 (HOSTROCKET, US), Reverse DNS gladiolus.hostnownow.com Software LiteSpeed / Resource Hash `c4a6d6ec68cbbfbcf34f0c98262df1f741dbdb3746be306042091cdbcca9421c` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://rostandards.com/login.php Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 01 May 2024 22:26:17 GMT last-modified Wed, 27 Nov 2019 20:59:20 GMT server LiteSpeed content-type image/png cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 16296 expires Wed, 08 May 2024 22:26:17 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Spry object| sprytextfield1 object| sprypassword1

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			rostandards.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7vj57rsmof6ihvjslvjeptbci2

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://rostandards.com/login.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

rostandards.com
66.147.238.174
13ba894342b76563c80c26d7bbbde0fb9ff93786ed9c1468eedb563d044d1a8e
241650dec32e7c3371b7c03a221f0a716fd3324a5b3b620005ce135e4cea0455
4fca0968ef0c451ca1c07deaff40f8d3318d86a9eb43e68761d8888678722cc3
65b41d9ab1c132bf89fe89ca464550b60019aebf5aa7d7c479b924921ccda07c
665fb03aa6c9eb2ee1105f72938277de1007b12795bfaa52f6ed4b89f09693ea
775795810a39a9ca0d65c24b97ea33ca1a24f13036349e281a5fd0cbabdf9866
96cb9fb9faa9af5b370ecfcee516fc9c1efcddaddc5fd5fd009be3ac7ea0cd8d
9d3c229b4a94a10767f8cc099e4dfef7ef6618676acf450899daa68f7879c7b5
c4a6d6ec68cbbfbcf34f0c98262df1f741dbdb3746be306042091cdbcca9421c

rostandards.com Open in urlscan Pro 66.147.238.174 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

113 kBTransfer

205 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

rostandards.com Open in urlscan Pro
66.147.238.174 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

113 kB
Transfer

205 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!