kujawiacy.com Open in urlscan Pro
2606:4700:3036::681c:e30 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://kujawiacy.com/login
Effective URL:
http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd...
Submission: On February 25 via manual (February 25th 2020, 5:40:52 pm UTC) from US

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3036::681c:e30, located in United States and belongs to CLOUDFLARENET, US. The main domain is kujawiacy.com.

This is the only time kujawiacy.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 3	2606:4700:303... 2606:4700:3036::681c:e30	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b	63949 (LINODE-AP...) (LINODE-AP Linode)
4	4

3 2606:4700:3036::681c:e30 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

kujawiacy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:3c01::f03c:91ff:fe79:43b (United States)

ASN63949 (LINODE-AP Linode, LLC, US)

jsonip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	kujawiacy.com 2 redirects kujawiacy.com	197 KB
2	cloudflare.com ajax.cloudflare.com cdnjs.cloudflare.com	77 KB
1	jsonip.com jsonip.com	452 B
4	3

	Domain	Requested by
3	kujawiacy.com	2 redirects
1	jsonip.com	cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	ajax.cloudflare.com
1	ajax.cloudflare.com	kujawiacy.com
4	4

This site contains no links.

Subject Issuer	Validity	Valid
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
jsonip.com Let's Encrypt Authority X3	`2019-12-21` - `2020-03-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
Frame ID: F4F59E5D9A6624B4624D64F7766D23E5
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://kujawiacy.com/login HTTP 301
http://kujawiacy.com/login/ HTTP 303
http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c2246... Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

4
Requests

75 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

274 kB
Transfer

744 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://kujawiacy.com/login HTTP 301
http://kujawiacy.com/login/ HTTP 303
http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
kujawiacy.com/login/s/
Redirect Chain

https://kujawiacy.com/login
http://kujawiacy.com/login/
http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6

273 KB
197 KB

380ms
380ms

Document
text/html

2606:4700:3036::681c:e30
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
Protocol: HTTP/1.1
Server: 2606:4700:3036::681c:e30 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1a537a609bbec03a5788f38adf8ac5a20622eb89e267f73bd25e146dc4ef47d6

Request headers

Host: kujawiacy.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: __cfduid=dabc57fbb88416b2099541682c2ce6c681582652433; PHPSESSID=73fa1905e7e1845ee98201bb3b0426d7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Tue, 25 Feb 2020 17:40:34 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 56ab771149131762-FRA
Content-Encoding: gzip

Redirect headers

Date: Tue, 25 Feb 2020 17:40:34 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=73fa1905e7e1845ee98201bb3b0426d7; path=/
LOCATION: ./s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 56ab770dee0a1762-FRA

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
4 KB 15ms
14ms Script
application/javascript 2606:4700::6811:4004
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: kujawiacy.com
URL: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 25 Feb 2020 17:40:34 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:15:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5e4d0ade-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=172800, public
strict-transport-security: max-age=15780000; includeSubDomains
cf-ray: 56ab771639cc178a-FRA
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
expires: Thu, 27 Feb 2020 17:40:34 GMT

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6ca0547266bf562419381a77dfee5636befbef916bf97a61b4f26bd05d007eef

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 694b6ea9d725b0ac54867f1433d2ed6dd9888feb60fd15c0d3522537f6df05c7

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 182 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c74a1f66b0c82921640e51654f0ec8e27dee8b1dec38b0fa8b2df26c8138889f

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 06c4b41c1985235279eddf54a513f3ffb3eb92df446d12128790bc48a804d418

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ 257 KB
73 KB 17ms
16ms Script
application/javascript 2606:4700::6811:4004
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 25 Feb 2020 17:40:34 GMT
content-encoding: br
cf-cache-status: HIT
age: 1527698
cf-ray: 56ab77165a41178a-FRA
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
last-modified: Thu, 17 May 2018 09:21:00 GMT
server: cloudflare
etag: W/"5afd497c-40464"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Sun, 14 Feb 2021 17:40:34 GMT
cache-control: public, max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.004

GET
H/1.1 200
OK / Show response
jsonip.com/ 151 B
452 B 470ms
155ms Script
application/json 2600:3c01::f03c:91ff:fe79:43b
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://jsonip.com/?callback=jQuery3000229964578991791_1582652434974&_=1582652434975

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:3c01::f03c:91ff:fe79:43b , United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx/1.16.1 /

Resource Hash

a00e0c2972f5389e35ed0fa38ebb0cfdcad02b4735089a974da74bb1d5d126bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Referer: http://kujawiacy.com/login/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=f55a9981cbd8b98c2c22465b80e45adee5d611dfbd8ecb93893bce0ea5736e854ed380e6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Tue, 25 Feb 2020 17:40:35 GMT
Server: nginx/1.16.1
Strict-Transport-Security: max-age=31536000;
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			kujawiacy.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 73fa1905e7e1845ee98201bb3b0426d7
			.kujawiacy.com/	1970-01-19 08:20:44	Name: __cfduid Value: dabc57fbb88416b2099541682c2ce6c681582652433

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
cdnjs.cloudflare.com
jsonip.com
kujawiacy.com
2600:3c01::f03c:91ff:fe79:43b
2606:4700:3036::681c:e30
2606:4700::6811:4004
06c4b41c1985235279eddf54a513f3ffb3eb92df446d12128790bc48a804d418
1a537a609bbec03a5788f38adf8ac5a20622eb89e267f73bd25e146dc4ef47d6
694b6ea9d725b0ac54867f1433d2ed6dd9888feb60fd15c0d3522537f6df05c7
6ca0547266bf562419381a77dfee5636befbef916bf97a61b4f26bd05d007eef
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
a00e0c2972f5389e35ed0fa38ebb0cfdcad02b4735089a974da74bb1d5d126bf
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
c74a1f66b0c82921640e51654f0ec8e27dee8b1dec38b0fa8b2df26c8138889f

kujawiacy.com Open in urlscan Pro 2606:4700:3036::681c:e30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

100 %IPv6

3 Domains

4 Subdomains

4 IPs

1 Countries

274 kBTransfer

744 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

2 Cookies

Indicators

kujawiacy.com Open in urlscan Pro
2606:4700:3036::681c:e30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

274 kB
Transfer

744 kB
Size

2
Cookies

4 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!