u6189935j5.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.minervenfutbolclub.com/oslo
Effective URL:
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Submission: On February 25 via api (February 25th 2020, 6:42:28 pm UTC) from BE

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 20 HTTP transactions. The main IP is 2a00:b700::26, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u6189935j5.ha004.t.justns.ru.

This is the only time u6189935j5.ha004.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Credit Agricole (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:303... 2606:4700:3031::681b:961f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.70.82.195 13.70.82.195	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 20	2a00:b700::26 2a00:b700::26	51659 (ASBAXET) (ASBAXET)
20	3

2 2606:4700:3031::681b:961f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.minervenfutbolclub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.70.82.195 (Sydney, Australia)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.oxfordlawyers.com.au	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:b700::26 (Russian Federation) 2 redirects

ASN51659 (ASBAXET, RU)

u6189935j5.ha004.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	justns.ru 2 redirects u6189935j5.ha004.t.justns.ru	141 KB
2	minervenfutbolclub.com 1 redirects www.minervenfutbolclub.com	848 B
1	oxfordlawyers.com.au www.oxfordlawyers.com.au	650 B
20	3

	Domain	Requested by
20	u6189935j5.ha004.t.justns.ru	2 redirects www.oxfordlawyers.com.au u6189935j5.ha004.t.justns.ru
2	www.minervenfutbolclub.com	1 redirects
1	www.oxfordlawyers.com.au	www.minervenfutbolclub.com
20	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Frame ID: D5919C222968EAC89EE41DC35D223E81
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.minervenfutbolclub.com/oslo HTTP 301
http://www.minervenfutbolclub.com/oslo/ Page URL
http://www.oxfordlawyers.com.au/wp-content/_/att/ Page URL
http://u6189935j5.ha004.t.justns.ru/pf/ HTTP 302
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215 HTTP 301
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

20
Requests

0 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

142 kB
Transfer

272 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.minervenfutbolclub.com/oslo HTTP 301
http://www.minervenfutbolclub.com/oslo/ Page URL
http://www.oxfordlawyers.com.au/wp-content/_/att/ Page URL
http://u6189935j5.ha004.t.justns.ru/pf/ HTTP 302
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215 HTTP 301
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.minervenfutbolclub.com/oslo HTTP 301
http://www.minervenfutbolclub.com/oslo/

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
www.minervenfutbolclub.com/oslo/
Redirect Chain

http://www.minervenfutbolclub.com/oslo
http://www.minervenfutbolclub.com/oslo/

119 B
406 B

104ms
103ms

Document
text/html

2606:4700:3031::681b:961f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.minervenfutbolclub.com/oslo/
Protocol: HTTP/1.1
Server: 2606:4700:3031::681b:961f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b464139d70857ff4282ecd48f13987a2e31b9664e4ac67261b6c52a50b4b3dd

Request headers

Host: www.minervenfutbolclub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: __cfduid=dc3771e6c9f3891d895cd27376f6597ab1582656124
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 56abd1292f33dfb1-FRA
Content-Encoding: gzip

Redirect headers

Date: Tue, 25 Feb 2020 18:42:04 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dc3771e6c9f3891d895cd27376f6597ab1582656124; expires=Thu, 26-Mar-20 18:42:04 GMT; path=/; domain=.minervenfutbolclub.com; HttpOnly; SameSite=Lax
Location: http://www.minervenfutbolclub.com/oslo/
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 56abd1286d2cdfb1-FRA

GET
H/1.1 200
OK / Show response
www.oxfordlawyers.com.au/wp-content/_/att/ 109 B
650 B 556ms
509ms Document
text/html 13.70.82.195
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

http://www.oxfordlawyers.com.au/wp-content/_/att/

Requested by

Host: www.minervenfutbolclub.com
URL: http://www.minervenfutbolclub.com/oslo/

Protocol

HTTP/1.1

Server

13.70.82.195 Sydney, Australia, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Apache /

Resource Hash

1922fb33c2d9e3526c54ed07a46ec9162cd79394ee70d736c51038f7eba23659

Security Headers

Name	Value
Content-Security-Policy	default-src http: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options	nosniff
X-Frame-Options	sameorigin
X-Xss-Protection	1; mode=block

Request headers

Host: www.oxfordlawyers.com.au
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.minervenfutbolclub.com/oslo/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.minervenfutbolclub.com/oslo/

Response headers

Date: Tue, 25 Feb 2020 18:42:04 GMT
Server: Apache
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Feature-Policy: vibrate 'self'; sync-xhr 'self' http://oxfordlawyers.com.au
Content-Security-Policy: default-src http: data: 'unsafe-inline' 'unsafe-eval'
Vary: Accept-Encoding
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Length: 117
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

Primary Request / Show response
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Redirect Chain

http://u6189935j5.ha004.t.justns.ru/pf/
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215
http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/

16 KB
5 KB

42ms
41ms

Document
text/html

2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Requested by: Host: www.oxfordlawyers.com.au
URL: http://www.oxfordlawyers.com.au/wp-content/_/att/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: e6ebd97ad66c3f6d4d2e43ffa5f601d8d8b3a4b110b4d359c3524a3403f31290

Request headers

Host: u6189935j5.ha004.t.justns.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://www.oxfordlawyers.com.au/wp-content/_/att/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.oxfordlawyers.com.au/wp-content/_/att/

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 4800
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Date: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed

Redirect headers

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Location: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Vary: User-Agent

GET
H/1.1 200
OK antiquus.css
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 26 KB
4 KB 44ms
40ms Stylesheet
text/css 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/antiquus.css
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 7b2736d09d34494af3490ed5a4c14776f2c9f1c72e58f9c2ea692d17c1eb5311

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "6969-5e556a7e-38c289f122fbb1c6;gz"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: public, max-age=604800
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK styles.css
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 83 KB
16 KB 83ms
40ms Stylesheet
text/css 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles.css
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 93c14a18bf17e789c6ff56c7058ff4c3442803c533cf3384be0a352a54fac0ee

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "14cf3-5e556a7e-a67750ac10b30901;gz"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: public, max-age=604800
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK styles-mod.css
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 15 KB
4 KB 90ms
47ms Stylesheet
text/css 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles-mod.css
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: af03fd5bbea38498f45dade415005c9bc1b63261411b5e6a2f4e83ed52c0c55e

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "3aba-5e556a7e-dec958dfeb9c3a9;gz"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: public, max-age=604800
Transfer-Encoding: chunked
Connection: Keep-Alive
Accept-Ranges: bytes
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK 2.PNG
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 10 KB
10 KB 90ms
47ms Image
image/png 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/2.PNG
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 2683fba7cb1a08e283ce4e36c30da6b0fb637805500ce1fbdc273e3dc6aa31e7

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "26d8-5e556a7e-455b6eb4a677b2a3;;;"
Vary: User-Agent
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 9944
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK 4.PNG
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 80 KB
80 KB 83ms
40ms Image
image/png 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/4.PNG
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: a5c171953807186c09c88facb9fa374b3b3b7464802bab6ce14c3568c3850efc

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "13ea1-5e556a7e-21bf78d148254e22;;;"
Vary: User-Agent
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 81569
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK 1.PNG
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 5 KB
5 KB 41ms
40ms Image
image/png 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/1.PNG
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: dbfbcbafd2d82f705eb25d811a858ffe6affa7aced9d4c0e0fb826637c8c0e3d

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "147d-5e556a7e-6377cb98058a07fa;;;"
Vary: User-Agent
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 5245
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK point_transp.gif
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 87 B
437 B 41ms
40ms Image
image/gif 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/point_transp.gif
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 7a1a0dc539a9129f3ce1a26e7598a54217d8c8c0291f1a267976dcdad89bbe57

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "57-5e556a7e-814179d97bef1f6e;;;"
Vary: User-Agent
Content-Type: image/gif
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 87
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK 3.PNG
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 3 KB
3 KB 41ms
40ms Image
image/png 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/3.PNG
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 981fc6bc288f27176dfd0511a1ca0e867bf6f63e6e04c076afbb9fe4fdf180af

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Last-Modified: Tue, 25 Feb 2020 18:42:06 GMT
Server: LiteSpeed
Etag: "c26-5e556a7e-b2ba8f012c8a58bf;;;"
Vary: User-Agent
Content-Type: image/png
Cache-Control: public, max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3110
Expires: Tue, 03 Mar 2020 18:42:06 GMT

GET
H/1.1 200
OK /
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/ 16 KB
5 KB 86ms
44ms Stylesheet
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: e6ebd97ad66c3f6d4d2e43ffa5f601d8d8b3a4b110b4d359c3524a3403f31290

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 4800
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK / Show response
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/ 16 KB
5 KB 84ms
43ms Script
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: e6ebd97ad66c3f6d4d2e43ffa5f601d8d8b3a4b110b4d359c3524a3403f31290

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 4800
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found main_repeat.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 396 B
396 B 42ms
42ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/main_repeat.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 60cbdc290dc0d99e836448c535283deeba5902895e7c159ef33f720929752706

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 376
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

GET
H/1.1 404
Not Found entete_light.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 397 B
397 B 41ms
40ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/entete_light.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 27dbe757eb9dad948a44ee4b2706ae82c3e50d9f6c15f4baaa9900f046fb2d42

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles-mod.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 377
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

GET
H/1.1 404
Not Found main_haut.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 394 B
394 B 76ms
41ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/main_haut.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 1aa38a641f1a7be96c3e9e91497f0873add2262d97370b57d20b284309b96332

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 374
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

GET
H/1.1 404
Not Found bloc_arrond_bas.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 400 B
400 B 43ms
40ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/bloc_arrond_bas.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 732cb3a68800f9bc80aecc767843b213923bc469bff6e86e2e0a031d47894d70

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 380
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

GET
H/1.1 404
Not Found bloc_arrond_haut.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 401 B
401 B 75ms
40ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/bloc_arrond_haut.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 0b81f8016f9f7f3ac55dd43e61414045428128188ee6965ff19b75990fa7b697

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 380
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

GET
H/1.1 404
Not Found bg_form.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 392 B
392 B 72ms
40ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/bg_form.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 14777595e18fc1cd0d3fa9873f31f8a57a7f62ce6e6502d92de5046c416f11de

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 372
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

GET
H/1.1 404
Not Found thead.png
u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/ 390 B
390 B 69ms
40ms Image
text/html 2a00:b700::26
ASBAXET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/thead.png
Requested by: Host: u6189935j5.ha004.t.justns.ru
URL: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/
Protocol: HTTP/1.1
Server: 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ea8cf9da01ba7cda0a5e6a9378ecfdb85fab13afb109aa31b49e3c78a5fef224

Request headers

Referer: http://u6189935j5.ha004.t.justns.ru/pf/5ac840d9ce52d1902eb0456cf92ff215/img/styles-mod.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 25 Feb 2020 18:42:06 GMT
Content-Encoding: gzip
Server: LiteSpeed
Connection: Keep-Alive
Content-Length: 370
Vary: Accept-Encoding,User-Agent
Content-Type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Credit Agricole (Banking)

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

u6189935j5.ha004.t.justns.ru
www.minervenfutbolclub.com
www.oxfordlawyers.com.au
13.70.82.195
2606:4700:3031::681b:961f
2a00:b700::26
0b81f8016f9f7f3ac55dd43e61414045428128188ee6965ff19b75990fa7b697
14777595e18fc1cd0d3fa9873f31f8a57a7f62ce6e6502d92de5046c416f11de
1922fb33c2d9e3526c54ed07a46ec9162cd79394ee70d736c51038f7eba23659
1aa38a641f1a7be96c3e9e91497f0873add2262d97370b57d20b284309b96332
2683fba7cb1a08e283ce4e36c30da6b0fb637805500ce1fbdc273e3dc6aa31e7
27dbe757eb9dad948a44ee4b2706ae82c3e50d9f6c15f4baaa9900f046fb2d42
4b464139d70857ff4282ecd48f13987a2e31b9664e4ac67261b6c52a50b4b3dd
60cbdc290dc0d99e836448c535283deeba5902895e7c159ef33f720929752706
732cb3a68800f9bc80aecc767843b213923bc469bff6e86e2e0a031d47894d70
7a1a0dc539a9129f3ce1a26e7598a54217d8c8c0291f1a267976dcdad89bbe57
7b2736d09d34494af3490ed5a4c14776f2c9f1c72e58f9c2ea692d17c1eb5311
93c14a18bf17e789c6ff56c7058ff4c3442803c533cf3384be0a352a54fac0ee
981fc6bc288f27176dfd0511a1ca0e867bf6f63e6e04c076afbb9fe4fdf180af
a5c171953807186c09c88facb9fa374b3b3b7464802bab6ce14c3568c3850efc
af03fd5bbea38498f45dade415005c9bc1b63261411b5e6a2f4e83ed52c0c55e
dbfbcbafd2d82f705eb25d811a858ffe6affa7aced9d4c0e0fb826637c8c0e3d
e6ebd97ad66c3f6d4d2e43ffa5f601d8d8b3a4b110b4d359c3524a3403f31290
ea8cf9da01ba7cda0a5e6a9378ecfdb85fab13afb109aa31b49e3c78a5fef224

u6189935j5.ha004.t.justns.ru Open in urlscan Pro 2a00:b700::26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

0 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

142 kBTransfer

272 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

47 JavaScript Global Variables

0 Cookies

Indicators

u6189935j5.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

0 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

142 kB
Transfer

272 kB
Size

0
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!