feu.ugtu.net Open in urlscan Pro
195.22.104.20 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/oJCodnHq90
Effective URL:
http://feu.ugtu.net/--/Caixa2/es/
Submission: On May 03 via manual (May 3rd 2018, 7:34:45 am UTC) from ES

Summary HTTP 19 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 19 HTTP transactions. The main IP is 195.22.104.20, located in Ukhta, Russian Federation and belongs to CENTRLAN-AS, UA. The main domain is feu.ugtu.net.

This is the only time feu.ugtu.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Caixabank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER - Twitter Inc.)
1 19	195.22.104.20 195.22.104.20	42104 (CENTRLAN-AS) (CENTRLAN-AS)
19	2

1 104.244.42.133 (San Francisco, United States)

ASN13414 (TWITTER - Twitter Inc., US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 195.22.104.20 (Ukhta, Russian Federation) 1 redirects

ASN42104 (CENTRLAN-AS, UA)
PTR: www.ugtu.net

wiki.ugtu.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
feu.ugtu.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	ugtu.net 1 redirects wiki.ugtu.net feu.ugtu.net	219 KB
1	t.co t.co	356 B
19	2

	Domain	Requested by
18	feu.ugtu.net	feu.ugtu.net
1	wiki.ugtu.net	1 redirects
1	t.co
19	3

This site contains links to these domains. Also see Links.

Domain
loc3.lacaixa.es
portal.lacaixa.es
www.caixabank.es

Subject Issuer	Validity	Valid
t.co DigiCert SHA2 Extended Validation Server CA	`2017-07-25` - `2018-11-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://feu.ugtu.net/--/Caixa2/es/
Frame ID: D6AAECAD88460B3972DF2437E4E8F6C7
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://t.co/oJCodnHq90 Page URL
http://wiki.ugtu.net/vic.php HTTP 302
http://feu.ugtu.net/--/Caixa2/es/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
script /jquery-ui(?:-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery-ui(?:-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery-ui.*\.js/i

Page Statistics

19
Requests

5 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

219 kB
Transfer

238 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://loc3.lacaixa.es/GPeticiones;WebLogicSession=BE07Xlo6alr3oghoYG_R_eB_Yn55UhUJRfNylA_R22GmmTB9MZ20!784677410!1274593010
Title: #

Search URL Search Domain Scan URL

URL: http://portal.lacaixa.es/bancadistancia/comodarsedealta_es.html
Title: Alta en Línea Abierta

Search URL Search Domain Scan URL

URL: http://www.caixabank.es/
Title: Volver

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/oJCodnHq90 Page URL
http://wiki.ugtu.net/vic.php HTTP 302
http://feu.ugtu.net/--/Caixa2/es/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 oJCodnHq90 Show response
t.co/ 278 B
356 B 119ms
119ms Document
text/html 104.244.42.133
Twitter Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/oJCodnHq90

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 San Francisco, United States, ASN13414 (TWITTER - Twitter Inc., US),

Reverse DNS

Software

tsa_o /

Resource Hash

54bfab30bf8082941293bb6b18fe0475d8f79c32a46831e9457496f31801e681

Security Headers

Name	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Request headers

:path: /oJCodnHq90
pragma: no-cache
accept-encoding: gzip, deflate
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
cache-control: no-cache
:authority: t.co
:scheme: https
:method: GET
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

content-security-policy: referrer always;
content-encoding: gzip
status: 200
x-connection-hash: 09cf34f00942e22bf0c0083578e06916
strict-transport-security: max-age=0
content-length: 193
x-xss-protection: 1; mode=block; report=https://twitter.com/i/xss_report
x-response-time: 112
referrer-policy: unsafe-url
server: tsa_o
date: Thu, 03 May 2018 07:34:34 GMT
vary: Origin
content-type: text/html; charset=utf-8
cache-control: private,max-age=300
set-cookie: muc=4f36da06-f3b6-4620-9214-ca822e8cfbee; Expires=Sat, 02 May 2020 07:34:34 UTC; Domain=t.co
expires: Thu, 03 May 2018 07:39:34 GMT

GET
H/1.1

200
OK

Primary Request / Show response
feu.ugtu.net/--/Caixa2/es/
Redirect Chain

http://wiki.ugtu.net/vic.php
http://feu.ugtu.net/--/Caixa2/es/

30 KB
8 KB

128ms
65ms

Document
text/html

195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: d7bf125ee306d5d609ac09e4872f989293550a670185bd354396d70ec112db5f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://t.co/oJCodnHq90
Connection: keep-alive
Cache-Control: no-cache
Referer: https://t.co/oJCodnHq90
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Location: http://feu.ugtu.net/--/Caixa2/es/
Date: Thu, 03 May 2018 06:54:35 GMT
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK fil.css
feu.ugtu.net/--/Caixa2/es/css/ 12 KB
12 KB 72ms
72ms Stylesheet
text/css 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 /
Resource Hash: d873a975b423cc220df4f6a13378ba7b5a6cccc18f7bd524902de16057ac6c52

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Last-Modified: Thu, 26 Apr 2018 11:06:34 GMT
Server: nginx/1.13.12
ETag: "5ae1b2ba-2f99"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 12185

GET
H/1.1 200
OK over.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 124ms
62ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/over.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery-1.8.3.min.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 128ms
65ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/jquery-1.8.3.min.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.tools.min.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 128ms
65ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/jquery.tools.min.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery.metadata.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 131ms
66ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/jquery.metadata.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery-ui-1.9.2.custom.min.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 131ms
66ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/jquery-ui-1.9.2.custom.min.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK validacionURLs.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 136ms
64ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/validacionURLs.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK EloLgnB011000.js.t%C3%A9l%C3%A9chargement Show response
feu.ugtu.net/--/Caixa2/es/css/ 21 B
273 B 183ms
62ms Script
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/EloLgnB011000.js.t%C3%A9l%C3%A9chargement
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK logo_caixabank_40.png
feu.ugtu.net/--/Caixa2/es/css/ 4 KB
4 KB 85ms
85ms Image
image/png 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/logo_caixabank_40.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 /
Resource Hash: 243e7d9077b620eb71838d4b489c0aa63b453912cfa2ca71b5f68a08c69959e1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Last-Modified: Thu, 26 Apr 2018 11:06:38 GMT
Server: nginx/1.13.12
ETag: "5ae1b2be-f1f"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3871

GET
H/1.1 200
OK candado.png
feu.ugtu.net/--/Caixa2/es/css/ 2 KB
2 KB 64ms
64ms Image
image/png 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/candado.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 /
Resource Hash: 9723a6d5f5ea669e43fd75e6af8770704573ebc065e148c13c78c334654f9007

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Last-Modified: Thu, 26 Apr 2018 11:06:38 GMT
Server: nginx/1.13.12
ETag: "5ae1b2be-6a2"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1698

GET
H/1.1 200
OK icon_tornartit.png
feu.ugtu.net/--/Caixa2/imatge/ 21 B
21 B 67ms
66ms Image
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/imatge/icon_tornartit.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ico_check.png
feu.ugtu.net/--/Caixa2/imatge/lolopo/ 21 B
21 B 66ms
66ms Image
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/imatge/lolopo/ico_check.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK OpenSans-Semibold-webfont.woff
feu.ugtu.net/--/Caixa2/es/css/fonts/ 96 KB
96 KB 77ms
76ms Font
application/octet-stream 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/fonts/OpenSans-Semibold-webfont.woff
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 /
Resource Hash: ab823b2f6201651b4f8d0fc7afa16f0808ff92a96bd5a73273239151bf0e10d0

Request headers

Pragma: no-cache
Origin: http://feu.ugtu.net
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Origin: http://feu.ugtu.net

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Last-Modified: Thu, 26 Apr 2018 11:06:40 GMT
Server: nginx/1.13.12
ETag: "5ae1b2c0-180a0"
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 98464

GET
H/1.1 200
OK ico_world.png
feu.ugtu.net/--/Caixa2/imatge/lolopo/ 21 B
21 B 64ms
64ms Image
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/imatge/lolopo/ico_world.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK OpenSans-Regular-webfont.woff
feu.ugtu.net/--/Caixa2/es/css/fonts/ 94 KB
94 KB 94ms
65ms Font
application/octet-stream 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://feu.ugtu.net/--/Caixa2/es/css/fonts/OpenSans-Regular-webfont.woff
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 /
Resource Hash: 3c669add48bf3a45fa266a020fcaac2e6da0fc72d1dd95ba78ac9b77e0afba32

Request headers

Pragma: no-cache
Origin: http://feu.ugtu.net
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: */*
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Origin: http://feu.ugtu.net

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Last-Modified: Thu, 26 Apr 2018 11:06:40 GMT
Server: nginx/1.13.12
ETag: "5ae1b2c0-17774"
Content-Type: application/octet-stream
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 96116

GET
H/1.1 200
OK ico_down.png
feu.ugtu.net/--/Caixa2/imatge/lolopo/ 21 B
21 B 116ms
63ms Image
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/imatge/lolopo/ico_down.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ico_teclado.png
feu.ugtu.net/--/Caixa2/imatge/lolopo/ 21 B
21 B 124ms
67ms Image
text/html 195.22.104.20
CENTRLAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://feu.ugtu.net/--/Caixa2/imatge/lolopo/ico_teclado.png
Requested by: Host: feu.ugtu.net
URL: http://feu.ugtu.net/--/Caixa2/es/
Protocol: HTTP/1.1
Server: 195.22.104.20 Ukhta, Russian Federation, ASN42104 (CENTRLAN-AS, UA),
Reverse DNS: www.ugtu.net
Software: nginx/1.13.12 / PHP/5.6.36
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: feu.ugtu.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
Connection: keep-alive
Cache-Control: no-cache
Referer: http://feu.ugtu.net/--/Caixa2/es/css/fil.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/65.0.3325.181 Safari/537.36

Response headers

Date: Thu, 03 May 2018 06:54:35 GMT
Content-Encoding: gzip
Server: nginx/1.13.12
Connection: keep-alive
X-Powered-By: PHP/5.6.36
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Caixabank (Banking)

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	referrer always;
Strict-Transport-Security	max-age=0
X-Xss-Protection	1; mode=block; report=https://twitter.com/i/xss_report

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

feu.ugtu.net
t.co
wiki.ugtu.net
104.244.42.133
195.22.104.20
243e7d9077b620eb71838d4b489c0aa63b453912cfa2ca71b5f68a08c69959e1
3c669add48bf3a45fa266a020fcaac2e6da0fc72d1dd95ba78ac9b77e0afba32
54bfab30bf8082941293bb6b18fe0475d8f79c32a46831e9457496f31801e681
9723a6d5f5ea669e43fd75e6af8770704573ebc065e148c13c78c334654f9007
ab823b2f6201651b4f8d0fc7afa16f0808ff92a96bd5a73273239151bf0e10d0
d7bf125ee306d5d609ac09e4872f989293550a670185bd354396d70ec112db5f
d873a975b423cc220df4f6a13378ba7b5a6cccc18f7bd524902de16057ac6c52
df0b6409ca739a6e1e8c5b0c3d99599895b82ee5e68927c28e4afe9e0b477191
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

feu.ugtu.net Open in urlscan Pro 195.22.104.20 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

5 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

219 kBTransfer

238 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

42 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

feu.ugtu.net Open in urlscan Pro
195.22.104.20 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

5 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

219 kB
Transfer

238 kB
Size

0
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!