![](/screenshots/0c6eda4f-4511-4670-b0b6-9ad67dda2fa5.png)
l2aggro.ru
Open in
urlscan Pro
185.9.147.4
Malicious Activity!
Public Scan
Effective URL: http://l2aggro.ru/
Submission: On April 09 via automatic, source urlhaus
Summary
This is the only time l2aggro.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Vkontakte (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 185.184.221.86 185.184.221.86 | 38197 (SUNHK-DAT...) (SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited - HongKong Backbone) | |
6 | 185.9.147.4 185.9.147.4 | 56694 (DHUB) (DHUB) | |
6 | 1 |
ASN38197 (SUNHK-DATA-AS-AP Sun Network (Hong Kong) Limited - HongKong Backbone, HK)
www.qzqpm.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
l2aggro.ru
l2aggro.ru |
1 MB |
1 |
qzqpm.com
1 redirects
www.qzqpm.com |
221 B |
6 | 2 |
Domain | Requested by | |
---|---|---|
6 | l2aggro.ru |
l2aggro.ru
|
1 | www.qzqpm.com | 1 redirects |
6 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://l2aggro.ru/
Frame ID: CE33A5F41D9C72CF086F7C3DBCAE4EBE
Requests: 6 HTTP requests in this frame
Screenshot
![](/screenshots/0c6eda4f-4511-4670-b0b6-9ad67dda2fa5.png)
Page URL History Show full URLs
-
http://www.qzqpm.com/
HTTP 302
http://l2aggro.ru/ Page URL
Detected technologies
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.qzqpm.com/
HTTP 302
http://l2aggro.ru/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
l2aggro.ru/ Redirect Chain
|
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_cfmxw.css
l2aggro.ru/ |
732 KB 733 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_yzgt.css
l2aggro.ru/ |
52 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_c.js
l2aggro.ru/ |
455 KB 456 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
l2aggro.ru/ |
342 B 580 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fb_icon.png
l2aggro.ru/ |
165 B 402 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Vkontakte (Social Network)217 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| befall function| $ function| $$ function| clog function| onDOMReady function| cdf function| onBodyScroll function| onBodyResize function| formatTime function| setDocumentDomain function| isUndefined function| isFunction function| isArray function| isObject function| isEmpty function| escapeRE function| htsc function| escapeAttr function| unescapeAttr function| replaceEntities function| escapeStr function| stripTags function| rand function| srand function| utf2win function| isHttpHref function| vkNow function| bind function| intval function| floatval function| qs2obj function| obj2qs function| parseJSON function| lsCheck function| lsSet function| lsGet function| ssCheck function| ssSet function| ssGet function| getValues function| len function| realSubstr function| hashCode function| formatNum function| each function| copy function| addEvent function| removeEvent function| preventEvent function| stopEvent function| cancelEvent function| checkEvent function| onCtrlEnter function| submitBtn function| createIframe function| winToUtf function| shortCurrency function| checkNav function| checkElementNav function| checkTouchHover function| parseCyr function| parseLat function| parseRusKeys function| parseLatKeys function| scrollLeft function| scrollTop function| se function| onBodyScrollForce function| sgFix function| hideUnvisibleItems function| initObjectsHideByScroll function| checkPostsSeen function| initPostsStats function| initAutoScroll function| autoScroll function| scrollToEl function| scrollToHash function| lockButton function| unlockButton function| extend function| ge function| geByClass function| geByClass1 function| gpeByClass function| geByTag function| geByTag1 function| gpeByTag function| geBySel function| geBySel1 function| domNS function| domPS function| append function| before function| after function| replace function| remove function| clone function| reflow function| tag function| outer function| show function| hide function| isVisible function| toggle function| ce function| elfocus function| elblur function| val function| attr function| cssToJs function| getCssPropertyName function| cssValue function| getStyle function| setStyle function| hasClass function| addClass function| removeClass function| toggleClass function| replaceClass function| switchClass function| getXY function| getX function| getY function| getW function| getH function| getCw function| getCh function| evalJs function| alLoadingFix function| getHref function| ajx2q function| indexOf function| langSex function| langNumeric function| langWordNumeric function| langDate function| setNotify function| getNotify function| canUploadFile function| uploadFile function| readFile object| registeredEvents function| trim function| domClosestOverflowHidden function| copyToClipboard function| blinkItem function| domPN function| domCA function| getLang function| domData function| throttle function| scrollGetX function| scrollGetY function| domChildIndex function| domChildren function| jsHandlerCall function| safeGet function| disableFlex function| getCookie function| setCookie function| clearCookie string| _ua object| browser object| mobPlatforms boolean| isTouch boolean| has3d object| geo object| ajax object| mediaUpload object| ownerPhotoUpload object| thover object| page object| nav object| Like object| PhotoLike object| PhotoTag object| PhotoDelete object| Poll object| CopyHistory object| ToggleMenu object| ItemDelete object| FeedIgnore object| FeedIgnoreItem object| FeedIgnoreComments object| Wall object| Photos object| Audios object| FixPost object| ProfileMove object| Notify object| Dialog object| Dialogs object| LoginCheckAuthCodePage object| WallSubscribe object| FeedSubscribe object| ImportedFriends object| pStats object| post object| tooltip object| menu object| mail function| makeUrl function| Scroller object| im object| geoloc object| checkin function| QuickSearch object| qsearch object| zlayer object| photo string| locDomain object| htmlNode object| bodyNode object| scrollNode0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
l2aggro.ru
www.qzqpm.com
185.184.221.86
185.9.147.4
089ec3435720f9b9f8b0dcd1d96a5ae642e8d2578c15bc8e189b36651b29e006
4085629df5cabf4af911b18661d8935570d59362d26b06bd2cd8e85669ee556b
45ae730cf2211365ed0a933916c10cff8adfa1e49addf5c7a3db3aefaf91f28d
5716996c3bf29a2f0f48745e079d83eabfcf6b59c548519177f01fb34817e874
ad1bb4e015946708aada28ad804e645a5ba0e8064a64427db778ccd84df94b12
f6a3d97d87e06ad4d13c8122db714b99adff9b5c69054a2fb5e4acc9415a5668