srv88780.ht-test.ru - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 78.110.50.127, located in Moscow, Russian Federation and belongs to HT-SYSTEMS-AS Uplinks:, RU. The main domain is srv88780.ht-test.ru.

This is the only time srv88780.ht-test.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 6	78.110.50.127 78.110.50.127	31240 (HT-SYSTEM...) (HT-SYSTEMS-AS Uplinks:)
1	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
6	3

6 78.110.50.127 (Moscow, Russian Federation) 2 redirects

ASN31240 (HT-SYSTEMS-AS Uplinks:, RU)
PTR: cl32-w.ht-systems.ru

srv88780.ht-test.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	ht-test.ru 2 redirects srv88780.ht-test.ru	90 KB
1	google.com www.google.com	1 KB
0	Failed function sub() { [native code] }. Failed
6	3

	Domain	Requested by
6	srv88780.ht-test.ru	2 redirects srv88780.ht-test.ru
1	www.google.com	srv88780.ht-test.ru
0	mail. Failed	srv88780.ht-test.ru
6	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
Frame ID: 53B02DE4534DA85764C8515AE0692092
Requests: 5 HTTP requests in this frame

Frame: http://mail./
Frame ID: 07C6DF804FE0A4B3C6306154B81FD12F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://srv88780.ht-test.ru/tf/yy/stylesedited HTTP 301
http://srv88780.ht-test.ru/tf/yy/stylesedited/ HTTP 302
http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account= Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Red Hat (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Red Hat/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

0 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

90 kB
Transfer

89 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://srv88780.ht-test.ru/tf/yy/stylesedited HTTP 301
http://srv88780.ht-test.ru/tf/yy/stylesedited/ HTTP 302
http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request try.php Show response
srv88780.ht-test.ru/tf/yy/stylesedited/
Redirect Chain

http://srv88780.ht-test.ru/tf/yy/stylesedited
http://srv88780.ht-test.ru/tf/yy/stylesedited/
http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=

5 KB
5 KB

75ms
73ms

Document
text/html

78.110.50.127
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
Protocol: HTTP/1.1
Server: 78.110.50.127 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl32-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20 / PHP/7.2.20
Resource Hash: c53b8be1aaedb927b68f8bc1b8ab5bc79c570526e0ad9ca570384b0667f6af4b

Request headers

Host: srv88780.ht-test.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 17 Jul 2020 15:39:00 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20
X-Powered-By: PHP/7.2.20
Content-Length: 5113
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 17 Jul 2020 15:39:00 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20
X-Powered-By: PHP/7.2.20
Location: try.php?main_domain=mail.&account=
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery-2.js Show response
srv88780.ht-test.ru/tf/yy/stylesedited/try_files/ 82 KB
82 KB 77ms
76ms Script
text/javascript 78.110.50.127
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try_files/jquery-2.js
Requested by: Host: srv88780.ht-test.ru
URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
Protocol: HTTP/1.1
Server: 78.110.50.127 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl32-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20 /
Resource Hash: f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d

Request headers

Referer: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 17 Jul 2020 15:39:01 GMT
X-Cache-Lookup: MISS from hc1.hts.ru:80
Last-Modified: Thu, 16 Jul 2020 11:12:23 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20
ETag: "881a5e8f-1469f-5aa8d1d5d2d85"
X-Cache: MISS from hc1.hts.ru
Content-Type: text/javascript
Accept-Ranges: bytes
Content-Length: 83615

GET
H/1.1 200
OK app.js Show response
srv88780.ht-test.ru/tf/yy/stylesedited/try_files/ 1 KB
2 KB 147ms
134ms Script
text/javascript 78.110.50.127
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to

Full URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try_files/app.js
Requested by: Host: srv88780.ht-test.ru
URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
Protocol: HTTP/1.1
Server: 78.110.50.127 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl32-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20 /
Resource Hash: 9797911ba579201fb3daf4655070486bc4409c39c9b9b7a8fd77bece43dfce73

Request headers

Referer: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 17 Jul 2020 15:39:01 GMT
X-Cache-Lookup: MISS from hc1.hts.ru:80
Last-Modified: Thu, 16 Jul 2020 11:12:23 GMT
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20
ETag: "881620d5-4aa-5aa8d1d5d299d"
X-Cache: MISS from hc1.hts.ru
Content-Type: text/javascript
Accept-Ranges: bytes
Content-Length: 1194

GET
H/1.1 404
Not Found favicon.ico
srv88780.ht-test.ru/tf/yy/stylesedited/mail./ 344 B
344 B 145ms
131ms Image
text/html 78.110.50.127
HT-SYSTEMS-AS Upl...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/mail./favicon.ico
Requested by: Host: srv88780.ht-test.ru
URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
Protocol: HTTP/1.1
Server: 78.110.50.127 Moscow, Russian Federation, ASN31240 (HT-SYSTEMS-AS Uplinks:, RU),
Reverse DNS: cl32-w.ht-systems.ru
Software: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20 /
Resource Hash: 2817e9e9c4050789ca1c9743a5791c09544d1745abb47ccfa6eeb19040b3be7d

Request headers

Referer: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 17 Jul 2020 15:39:01 GMT
X-Cache-Lookup: MISS from hc2.hts.ru:80
Server: Apache/2.2.24 (Red Hat) mod_rpaf/0.6 PHP/7.2.20
Content-Length: 344
X-Cache: MISS from hc2.hts.ru
Content-Type: text/html; charset=iso-8859-1

GET /
mail./ Frame 07C6 0
0

GET
H/1.1 200
OK favicons
www.google.com/s2/ 492 B
1 KB 42ms
36ms Image
image/png 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://www.google.com/s2/favicons?domain=mail.

Requested by

Host: srv88780.ht-test.ru
URL: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=

Protocol

HTTP/1.1

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Qf2UMnMcgxT5Znhh0eiaEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-Qf2UMnMcgxT5Znhh0eiaEg' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://srv88780.ht-test.ru/tf/yy/stylesedited/try.php?main_domain=mail.&account=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 17 Jul 2020 15:39:01 GMT
X-Content-Type-Options: nosniff
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: public, max-age=28800
Transfer-Encoding: chunked
Content-Security-Policy: script-src 'report-sample' 'nonce-Qf2UMnMcgxT5Znhh0eiaEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/FaviconHttp/cspreport;worker-src 'self', script-src 'nonce-Qf2UMnMcgxT5Znhh0eiaEg' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/FaviconHttp/cspreport
X-XSS-Protection: 0
Expires: Fri, 17 Jul 2020 23:39:01 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mail.
URL: http://mail./

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mail.
srv88780.ht-test.ru
www.google.com
mail.
2a00:1450:4001:801::2004
78.110.50.127
2817e9e9c4050789ca1c9743a5791c09544d1745abb47ccfa6eeb19040b3be7d
2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947
9797911ba579201fb3daf4655070486bc4409c39c9b9b7a8fd77bece43dfce73
c53b8be1aaedb927b68f8bc1b8ab5bc79c570526e0ad9ca570384b0667f6af4b
f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d

srv88780.ht-test.ru Open in urlscan Pro 78.110.50.127 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

0 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

90 kBTransfer

89 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

0 Cookies

Indicators

srv88780.ht-test.ru Open in urlscan Pro
78.110.50.127 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

0 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

90 kB
Transfer

89 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!