tor.shalka.pw Open in urlscan Pro
45.80.68.211 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://tor.shalka.pw/W1kywT/
Submission Tags: @ipnigh
Submission: On April 08 via api (April 8th 2020, 12:42:45 am UTC) from GB

Summary HTTP 21 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 21 HTTP transactions. The main IP is 45.80.68.211, located in Russian Federation and belongs to BEGET-AS, RU. The main domain is tor.shalka.pw.

This is the only time tor.shalka.pw was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online) Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	45.80.68.211 45.80.68.211	198610 (BEGET-AS) (BEGET-AS)
14	5.101.152.232 5.101.152.232	198610 (BEGET-AS) (BEGET-AS)
1	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
5	2606:4700:303... 2606:4700:3035::6818:7efb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	4

1 45.80.68.211 (Russian Federation)

ASN198610 (BEGET-AS, RU)

tor.shalka.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 5.101.152.232 (Russian Federation)

ASN198610 (BEGET-AS, RU)
PTR: m2.leela.beget.com

canon.lasell.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3035::6818:7efb (United States)

ASN13335 (CLOUDFLARENET, US)

www.play4winprize.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	lasell.pw canon.lasell.pw	541 KB
5	play4winprize.site www.play4winprize.site
1	googleapis.com ajax.googleapis.com	33 KB
1	shalka.pw tor.shalka.pw	8 KB
21	4

	Domain	Requested by
14	canon.lasell.pw	tor.shalka.pw
5	www.play4winprize.site	tor.shalka.pw
1	ajax.googleapis.com	tor.shalka.pw
1	tor.shalka.pw
21	4

This site contains links to these domains. Also see Links.

Domain
canon.lasell.pw
cdcracker.info

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-11-06` - `2020-10-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://tor.shalka.pw/W1kywT/
Frame ID: AECCE8238C8ECAB5D7C247F08634F7A3
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

21
Requests

29 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

582 kB
Transfer

1101 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://canon.lasell.pw/
Title: OK

Search URL Search Domain Scan URL

URL: https://cdcracker.info/index.php?lp=1
Title: האבתי תגובה

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
tor.shalka.pw/W1kywT/ 29 KB
8 KB 289ms
237ms Document
text/html 45.80.68.211
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://tor.shalka.pw/W1kywT/

Protocol

HTTP/1.1

Server

45.80.68.211 , Russian Federation, ASN198610 (BEGET-AS, RU),

Reverse DNS

Software

nginx /

Resource Hash

6c20dd597aa099b3fa2c23673fdbf91de499fb7fc9c20605afe39e7add86f3e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: tor.shalka.pw
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Wed, 08 Apr 2020 00:42:27 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-cache, no-store, must-revalidate,post-check=0,pre-check=0
Expires: 0
Last-Modified: Wed, 08 Apr 2020 00:42:27 GMT
Pragma: no-cache
Set-Cookie: _subid=2r6d5g4beb780;Expires=Saturday, 09-May-2020 00:42:27 GMT;Max-Age=2678400;Path=/ _token=uuid_2r6d5g4beb780_2r6d5g4beb7805e8d1df35231a0.98683139;Expires=Saturday, 09-May-2020 00:42:27 GMT;Max-Age=2678400;Path=/ 04ea2=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjQ1XCI6MTU4NjMwNjU0N30sXCJjYW1wYWlnbnNcIjp7XCIxOVwiOjE1ODYzMDY1NDd9LFwidGltZVwiOjE1ODYzMDY1NDd9In0.7wlzLtf0NMi7fkHuxixAT0MKot9zMbsqcbH_SvUg1MA;Expires=Saturday, 09-May-2020 00:42:27 GMT;Max-Age=2678400;Path=/
X-Content-Type-Options: nosniff
Content-Encoding: gzip

GET
H/1.1 200
OK index.css
canon.lasell.pw/ 169 KB
13 KB 163ms
112ms Stylesheet
text/css 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://canon.lasell.pw/index.css
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: ccfa7aef633f7ef3fc2e1ff11d4698f85f08201e524f40894e6304ea58e9a174

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 18:09:51 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5e443f6f-2a20c"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Wed, 15 Apr 2020 00:42:27 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.1/ 94 KB
33 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js

Requested by

Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Sat, 04 Apr 2020 04:09:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 333201
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 33434
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 04 Apr 2021 04:09:06 GMT

GET
H/1.1 200
OK custom.css
canon.lasell.pw/ 216 KB
36 KB 168ms
117ms Stylesheet
text/css 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://canon.lasell.pw/custom.css
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 97d2ed32446bb57b7504e813d7a7f96d13171dedd66e4502eccadf3159ec585f

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 18:09:50 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5e443f6e-3612b"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Wed, 15 Apr 2020 00:42:27 GMT

GET
H/1.1 200
OK logo1.png
canon.lasell.pw/ 56 KB
56 KB 159ms
109ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/logo1.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 857868e002ffafdb9f2f50c228103b90f9749ec4294ac54bdb37808b96a76c71

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:52 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f70-df6c"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 57196
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H2 404 logo1(1).png
www.play4winprize.site/amazonboxv4ipes/index_files/ 0
0 186ms
22ms Image
text/html 2606:4700:3035::6818:7efb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.play4winprize.site/amazonboxv4ipes/index_files/logo1(1).png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7efb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H/1.1 200
OK logo.png
canon.lasell.pw/ 39 KB
39 KB 128ms
114ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/logo.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: fbf6a89c2c9b53977309305e2e5e3cd9b4832671a5c6fb4e0cb38bf576d4bb3b

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:52 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f70-9b4b"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 39755
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H/1.1 200
OK _mark1.png
canon.lasell.pw/ 9 KB
9 KB 61ms
61ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/_mark1.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 11740e5a67328f0da2d2dc81fd76dbdfdfdc8d26a124ecd1f5fe6b07fa661ad4

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:52 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f70-22e0"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 8928
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H/1.1 200
OK loading.gif
canon.lasell.pw/ 1 KB
2 KB 61ms
61ms Image
image/gif 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/loading.gif
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 44a00376f991babaaed24cce51fee1b041d270410788176fe3a8bcb0108a626c

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:52 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f70-5b1"
Content-Type: image/gif
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 1457
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H/1.1 200
OK fb-check.jpg
canon.lasell.pw/ 681 B
1 KB 61ms
60ms Image
image/jpeg 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/fb-check.jpg
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: d44b5fe2a942827e8f72ed857a5f31da3ae30bc11fa13e60c920058b9b566573

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:50 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f6e-2a9"
Content-Type: image/jpeg
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 681
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H2 404 samsung-logo1.png
www.play4winprize.site/amazonboxv4ipes/index_files/ 0
0 26ms
25ms Image
text/html 2606:4700:3035::6818:7efb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.play4winprize.site/amazonboxv4ipes/index_files/samsung-logo1.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7efb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H/1.1 200
OK iphoneprize.png
canon.lasell.pw/ 196 KB
197 KB 61ms
61ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/iphoneprize.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 0c1c190cebee4827af2b9510cc4ea12d386d9455edc53c6628daae94e7523400

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:51 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f6f-3113f"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 201023
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H/1.1 200
OK FB-like.png
canon.lasell.pw/ 2 KB
2 KB 107ms
61ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/FB-like.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 0d69c7364013b145a9c3d07d8df97d44b4bcf0fedb63b576f16658c02fbcb60d

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:50 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f6e-7d9"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 2009
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H/1.1 200
OK jquery.js.download Show response
canon.lasell.pw/ 94 KB
94 KB 66ms
65ms Script
application/javascript 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://canon.lasell.pw/jquery.js.download
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 60dc662df463ede4ecd32c9f99f6adc59713ffc9dc5bb7cf35733557825bf32d

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:52 GMT
Server: nginx-reuseport/1.13.4
ETag: "17826-59e64e0fc1e7d"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 96294

GET
H2 404 gift.gif
www.play4winprize.site/amazonboxv4ipes/index_files/ 0
0 19ms
18ms Image
text/html 2606:4700:3035::6818:7efb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.play4winprize.site/amazonboxv4ipes/index_files/gift.gif
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7efb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H/1.1 200
OK bootstrap.min.css
canon.lasell.pw/ 127 KB
21 KB 132ms
117ms Stylesheet
text/css 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://canon.lasell.pw/bootstrap.min.css
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 16075884dded8f6e8869ca40c8659379223d76b1d427d98945386fcb68e7fe41

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 12 Feb 2020 18:09:50 GMT
Server: nginx-reuseport/1.13.4
ETag: W/"5e443f6e-1fab0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Expires: Wed, 15 Apr 2020 00:42:27 GMT

GET
H/1.1 200
OK bootstrap.js.download Show response
canon.lasell.pw/ 46 KB
46 KB 162ms
148ms Script
application/javascript 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://canon.lasell.pw/bootstrap.js.download
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: c3cd6fd03aa1e90297aa71e94f2c53f8e6e8d85db2cd06ced92d05915fc53375

Request headers

Referer: http://tor.shalka.pw/W1kywT/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:50 GMT
Server: nginx-reuseport/1.13.4
ETag: "b7ad-59e64e0e02507"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 47021

GET
H/1.1 200
OK InternationalCustomerPreferencesNavAssets-icp_sprite-0b528ccc99b2eed18447291de6df851bc2c6fe68._V2_.png
canon.lasell.pw/ 12 KB
13 KB 71ms
60ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/InternationalCustomerPreferencesNavAssets-icp_sprite-0b528ccc99b2eed18447291de6df851bc2c6fe68._V2_.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: 4291f24cfd31872276064368ee11e6787ab0debe8e014a4f78cbe00f71885d82

Request headers

Referer: http://canon.lasell.pw/custom.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:51 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f6f-319b"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 12699
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H/1.1 200
OK amazon_sprite.png
canon.lasell.pw/ 11 KB
11 KB 92ms
61ms Image
image/png 5.101.152.232
BEGET-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://canon.lasell.pw/amazon_sprite.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: HTTP/1.1
Server: 5.101.152.232 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: m2.leela.beget.com
Software: nginx-reuseport/1.13.4 /
Resource Hash: fb688bd3a4c6531f4fa7a72dc0321c8f3bb1f7f3fdc5b03b7c2a8c485ef07d0e

Request headers

Referer: http://canon.lasell.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 08 Apr 2020 00:42:27 GMT
Last-Modified: Wed, 12 Feb 2020 18:09:50 GMT
Server: nginx-reuseport/1.13.4
ETag: "5e443f6e-2bab"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=30
Content-Length: 11179
Expires: Fri, 08 May 2020 00:42:27 GMT

GET
H2 404 avatar2-sprites.jpg
www.play4winprize.site/amazonboxv4ipes/img/ 0
0 18ms
17ms Image
text/html 2606:4700:3035::6818:7efb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.play4winprize.site/amazonboxv4ipes/img/avatar2-sprites.jpg
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7efb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://canon.lasell.pw/index.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

GET
H2 404 bg-new.png
www.play4winprize.site/amazonboxv4ipes/index_files/ 0
0 15ms
14ms Image
text/html 2606:4700:3035::6818:7efb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.play4winprize.site/amazonboxv4ipes/index_files/bg-new.png
Requested by: Host: tor.shalka.pw
URL: http://tor.shalka.pw/W1kywT/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6818:7efb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://canon.lasell.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online) Amazon (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
tor.shalka.pw/	1970-01-19 09:23:04	Name: 04ea2 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjQ1XCI6MTU4NjMwNjU0N30sXCJjYW1wYWlnbnNcIjp7XCIxOVwiOjE1ODYzMDY1NDd9LFwidGltZVwiOjE1ODYzMDY1NDd9In0.7wlzLtf0NMi7fkHuxixAT0MKot9zMbsqcbH_SvUg1MA
tor.shalka.pw/	1970-01-19 09:23:04	Name: _token Value: uuid_2r6d5g4beb780_2r6d5g4beb7805e8d1df35231a0.98683139
tor.shalka.pw/	1970-01-19 09:23:04	Name: _subid Value: 2r6d5g4beb780

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
canon.lasell.pw
tor.shalka.pw
www.play4winprize.site
2606:4700:3035::6818:7efb
2a00:1450:4001:820::200a
45.80.68.211
5.101.152.232
0c1c190cebee4827af2b9510cc4ea12d386d9455edc53c6628daae94e7523400
0d69c7364013b145a9c3d07d8df97d44b4bcf0fedb63b576f16658c02fbcb60d
11740e5a67328f0da2d2dc81fd76dbdfdfdc8d26a124ecd1f5fe6b07fa661ad4
16075884dded8f6e8869ca40c8659379223d76b1d427d98945386fcb68e7fe41
4291f24cfd31872276064368ee11e6787ab0debe8e014a4f78cbe00f71885d82
44a00376f991babaaed24cce51fee1b041d270410788176fe3a8bcb0108a626c
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
60dc662df463ede4ecd32c9f99f6adc59713ffc9dc5bb7cf35733557825bf32d
6c20dd597aa099b3fa2c23673fdbf91de499fb7fc9c20605afe39e7add86f3e4
857868e002ffafdb9f2f50c228103b90f9749ec4294ac54bdb37808b96a76c71
97d2ed32446bb57b7504e813d7a7f96d13171dedd66e4502eccadf3159ec585f
c3cd6fd03aa1e90297aa71e94f2c53f8e6e8d85db2cd06ced92d05915fc53375
ccfa7aef633f7ef3fc2e1ff11d4698f85f08201e524f40894e6304ea58e9a174
d44b5fe2a942827e8f72ed857a5f31da3ae30bc11fa13e60c920058b9b566573
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb688bd3a4c6531f4fa7a72dc0321c8f3bb1f7f3fdc5b03b7c2a8c485ef07d0e
fbf6a89c2c9b53977309305e2e5e3cd9b4832671a5c6fb4e0cb38bf576d4bb3b

tor.shalka.pw Open in urlscan Pro 45.80.68.211 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

21 Requests

29 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

582 kBTransfer

1101 kBSize

3 Cookies

2 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

3 Cookies

Security Headers

Indicators

tor.shalka.pw Open in urlscan Pro
45.80.68.211 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

29 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

582 kB
Transfer

1101 kB
Size

3
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!