a0692366.xsph.ru
Open in
urlscan Pro
2a0a:2b43:f:10c::
Malicious Activity!
Public Scan
Submission Tags: 7574892
Submission: On July 02 via api from DE — Scanned from JP
Summary
This is the only time a0692366.xsph.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ficohsa (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 2a0a:2b43:f:1... 2a0a:2b43:f:10c:: | 35278 (SPRINTHOST) (SPRINTHOST) | |
6 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
xsph.ru
a0692366.xsph.ru |
608 KB |
6 | 1 |
Domain | Requested by | |
---|---|---|
6 | a0692366.xsph.ru |
a0692366.xsph.ru
|
6 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://a0692366.xsph.ru/
Frame ID: 81909D6EA02F01D5A92C4E805453432A
Requests: 8 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
a0692366.xsph.ru/ |
777 KB 89 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.b1d6cdcc40a888de1051.bundle.css
a0692366.xsph.ru/css/ |
149 KB 48 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prismaWeb.css
a0692366.xsph.ru/css/ |
123 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
13f6ebd6-3a21-4455-8ac2-f131aaf35295.jpg
a0692366.xsph.ru/img/ |
26 KB 26 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
prisma_fonts.css
a0692366.xsph.ru/css/ |
24 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 10 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
streamline.8d9b0fde522024284eb5.woff
a0692366.xsph.ru/css/ |
423 KB 423 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ficohsa (Banking)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a0692366.xsph.ru
2a0a:2b43:f:10c::
3ab8f399348f08f5fd8aba748a849a778e3afe5332bbaae4e33eb835bbf22fad
49b83aaaba5f3a0885f4393b65353c1ab0e344769850e19f678fa8b452679b9e
72ca6a1a823786bda7f07f866791b2467fd4099002c119bbf059e087c0a41042
9ac971fbbe2dde752a128d71df0b2a7372590132c5a0b0de92afee22ba8795f0
b4b73366217f915ce371320f923955fe4cfc69f362312903d1f3bb51e0895abd
de41fd1bbdb12fd1666428a4167365f835bac86c20c3da566eeec891105cfab1
de92addf1d219707113509bb73a873421db6d02c74f254b0223e9689671ab1a6
fa10e688206d34d4b293b1524cc091415c551daae4b73e3cc68d7398408edf62