u941335665.ha004.t.justns.ru
Open in
urlscan Pro
2a00:b700::39
Malicious Activity!
Public Scan
Submitted URL: http://agricomsrvonline.com/
Effective URL: http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/0314cf369eb0181/region.php?AUTH=03...
Submission: On November 26 via api from DE
Effective URL: http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/0314cf369eb0181/region.php?AUTH=03...
Submission: On November 26 via api from DE
Summary
This website contacted 3 IPs
in 3 countries
across 4 domains to perform 17 HTTP transactions.
The main IP is 2a00:b700::39, located in
Russian Federation and
belongs to ASBAXET, RU.
The main domain is u941335665.ha004.t.justns.ru.
This is the only time u941335665.ha004.t.justns.ru was scanned on urlscan.io!
This is the only time u941335665.ha004.t.justns.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Credit Agricole (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 2001:4860:480... 2001:4860:4802:32::15 | 15169 (GOOGLE) (GOOGLE) | |
| 2 14 | 2a00:b700::39 2a00:b700::39 | 51659 (ASBAXET) (ASBAXET) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 4 | 2a00:1450:400... 2a00:1450:4001:814::2003 | 15169 (GOOGLE) (GOOGLE) | |
| 17 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
justns.ru
2 redirects
u941335665.ha004.t.justns.ru |
705 KB |
| 4 |
gstatic.com
fonts.gstatic.com |
37 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
1 KB |
| 1 |
agricomsrvonline.com
1 redirects
agricomsrvonline.com |
292 B |
| 17 | 4 |
| Domain | Requested by | |
|---|---|---|
| 14 | u941335665.ha004.t.justns.ru |
2 redirects
u941335665.ha004.t.justns.ru
|
| 4 | fonts.gstatic.com |
fonts.googleapis.com
|
| 1 | fonts.googleapis.com |
u941335665.ha004.t.justns.ru
|
| 1 | agricomsrvonline.com | 1 redirects |
| 17 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| upload.video.google.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
| *.gstatic.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/0314cf369eb0181/region.php?AUTH=0314cf369eb0181
Frame ID: 1926287C9ED4651CCC98E7A000451F2F
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://agricomsrvonline.com/
HTTP 302
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC HTTP 301
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/ HTTP 302
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/0314cf369eb018... Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
LiteSpeed
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://agricomsrvonline.com/
HTTP 302
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC HTTP 301
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/ HTTP 302
http://u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/0314cf369eb0181/region.php?AUTH=0314cf369eb0181 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
region.php
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/0314cf369eb0181/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/css/ |
138 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
helpers.css
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/css/ |
40 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fonts.css
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/css/ |
1 KB 668 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.css
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
calogo.png
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/images/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/js/ |
86 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
popper.min.js
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/js/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/js/ |
58 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fontawesome.js
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/js/ |
1 MB 415 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
main.js
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/js/ |
4 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
css
fonts.googleapis.com/ |
19 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
particuliers.jpg
u941335665.ha004.t.justns.ru/clientagrienligneOIYTGFFDEZYTRFGHFDHGGF/HGKJDFKYRUGHVBHTFGGFC/assets/images/ |
167 KB 167 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-Q050 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-Q050 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3-Q050 |
mem6YaGs126MiZpBA-UFUK0Zdc1GAK6b.woff2
fonts.gstatic.com/s/opensans/v18/ |
10 KB 10 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Credit Agricole (Banking)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome boolean| isShift string| seperator string| dash function| cc_date function| date_of_birth0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
agricomsrvonline.com
fonts.googleapis.com
fonts.gstatic.com
u941335665.ha004.t.justns.ru
2001:4860:4802:32::15
2a00:1450:4001:808::200a
2a00:1450:4001:814::2003
2a00:b700::39
16e8f08eb363930ccc9f0e91f33ded7905fed943045a040078196294db8a9b17
29afa9ae5f254ebab486b606c22e263e2a7963ae6f97a89a320e3fb1e017c991
2a6536dfb04e99526ca10907b63b77bd89acf583d1e0a5351a64983b65a860ab
306ab8dd287ef041231a510b7e4c027a11e28b20c3408a9185d895c091dc72a4
40eebb3469219ff9cea327b5f7ae1f68ba59a52d539e4a07303cdd8c8cbfc7cb
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
4ccf50f6950276db53db1d5e6af5185dba4d20e04b96210b0fc94243e896783d
51c3824424a3e9d147e4df46697aecfb10606cc20905d505a5bc7cf779312989
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
8965eaf1598037b1a608ede6ff9633e6944b70039d631f80f635e25c79030da8
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
d2b9f29ea1f42a60a8beb1c04f76868287f2a48d6ec50fb39d6b888584a03c49
eed9c49bc6e5549ac28f35b9fbe11afc330bb61ac61828a9f1ec9482a4db00bc
f8e9befa13e3ff93d974729ae3c727461555d582bb63bb388a4bd497619ef20b
ffcde34efda55a63cb66dbec4bf10acb531014d581e2d8e511836b84e08c2305