energy.dewe.ru
Open in
urlscan Pro
81.177.141.253
Malicious Activity!
Public Scan
Effective URL: http://energy.dewe.ru/wp-content/z/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxL...
Submission: On February 26 via automatic, source phishtank
Summary
This is the only time energy.dewe.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 63.250.38.74 63.250.38.74 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 51.15.22.18 51.15.22.18 | 12876 (Online SAS) (Online SAS) | |
5 | 81.177.141.253 81.177.141.253 | 8342 (RTCOMM-AS) (RTCOMM-AS) | |
8 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium92-4.web-hosting.com
jaankijaansk.club |
ASN8342 (RTCOMM-AS, RU)
PTR: srv117-p-st.jino.ru
energy.dewe.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
dewe.ru
energy.dewe.ru |
42 KB |
2 |
jaankijaansk.club
jaankijaansk.club |
755 B |
1 |
ibb.co
i.ibb.co |
2 KB |
8 | 3 |
Domain | Requested by | |
---|---|---|
5 | energy.dewe.ru |
energy.dewe.ru
|
2 | jaankijaansk.club |
jaankijaansk.club
|
1 | i.ibb.co |
jaankijaansk.club
|
8 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ibb.co Let's Encrypt Authority X3 |
2020-01-28 - 2020-04-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://energy.dewe.ru/wp-content/z/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=bm9ib2R5QG15Y3JhZnRtYWlsLmNvbQ==&.rand=13InboxLight.aspx?n=1774256418&fid=4
Frame ID: 9C6CA10ED1A7CAB58E462BB3DDBB88E6
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://jaankijaansk.club/qq/?email=nobody@mycraftmail.com Page URL
- http://energy.dewe.ru/wp-content/z/index.php?email=nobody@mycraftmail.com Page URL
- http://energy.dewe.ru/wp-content/z/index.php?email=nobody@mycraftmail.com Page URL
- http://energy.dewe.ru/wp-content/z/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://jaankijaansk.club/qq/?email=nobody@mycraftmail.com Page URL
- http://energy.dewe.ru/wp-content/z/index.php?email=nobody@mycraftmail.com Page URL
- http://energy.dewe.ru/wp-content/z/index.php?email=nobody@mycraftmail.com Page URL
- http://energy.dewe.ru/wp-content/z/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=bm9ib2R5QG15Y3JhZnRtYWlsLmNvbQ==&.rand=13InboxLight.aspx?n=1774256418&fid=4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
jaankijaansk.club/qq/ |
733 B 598 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sendspace.css
jaankijaansk.club/qq/asset/ |
0 157 B |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
load.gif
i.ibb.co/zN3pfMY/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.php
energy.dewe.ru/wp-content/z/ |
204 B 410 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.php
energy.dewe.ru/wp-content/z/ |
287 B 491 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
en.php
energy.dewe.ru/wp-content/z/ |
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mail.png
energy.dewe.ru/wp-content/z/files/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id.png
energy.dewe.ru/wp-content/z/files/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| count1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
energy.dewe.ru/ | Name: bpc Value: 4f80b52869f7b7b6b03997e3837ee6e0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
energy.dewe.ru
i.ibb.co
jaankijaansk.club
51.15.22.18
63.250.38.74
81.177.141.253
272c9a8ee9faf4bb46b70403cda777ce98f24fd48b2083ee133478461261d5dd
78524276b6d7c00c2b07bb89898c3506c0f94b977bcca8d443adba90eb633591
cfb365099ae602f8e7994580e16d7cdc2349275b0b7e70fd283bf21905813b00
d2f0ddb2f3ed918aea4eaf8df188e9a6787bc9f9b3033f0a4835b5f60d34746c
e11a6773a10302f1d4a38c34b58395884c4ad628ff0f7842aa03fba5e8e50ab1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e83a061371577136723476ace4674988770266bec75c4164f64b58a2e0db6f53