![](/screenshots/1b70bae8-f324-4ffa-8cf8-ba66f3002d5f.png)
blog.mylottokenya.co.ke
Open in
urlscan Pro
192.254.237.126
Malicious Activity!
Public Scan
Effective URL: https://blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/
Submission: On May 02 via api from US
Summary
TLS certificate: Issued by R3 on March 30th 2021. Valid for: 3 months.
This is the only time blog.mylottokenya.co.ke was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Register.it (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 162.214.80.70 162.214.80.70 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
6 | 192.254.237.126 192.254.237.126 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
12 | 2a00:1450:400... 2a00:1450:4001:828::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: sh028.webhostingservices.com
zeroappz.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
gstatic.com
fonts.gstatic.com |
182 KB |
6 |
mylottokenya.co.ke
blog.mylottokenya.co.ke |
124 KB |
2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
7 KB |
1 |
zeroappz.com
zeroappz.com |
560 B |
21 | 4 |
Domain | Requested by | |
---|---|---|
12 | fonts.gstatic.com |
fonts.googleapis.com
|
6 | blog.mylottokenya.co.ke |
zeroappz.com
blog.mylottokenya.co.ke |
1 | fonts.googleapis.com |
ajax.googleapis.com
|
1 | ajax.googleapis.com |
blog.mylottokenya.co.ke
|
1 | zeroappz.com | |
21 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
blog.mylottokenya.co.ke R3 |
2021-03-30 - 2021-06-28 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/
Frame ID: D3B04AE9260F4B7A6123F85227052BFB
Requests: 21 HTTP requests in this frame
Screenshot
![](/screenshots/1b70bae8-f324-4ffa-8cf8-ba66f3002d5f.png)
Page URL History Show full URLs
- http://zeroappz.com/amen.html Page URL
- https://blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/ Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
- script /googleapis\.com\/.+webfont/i
Webflow () Expand
Detected patterns
- meta generator /Webflow/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://zeroappz.com/amen.html Page URL
- https://blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
amen.html
zeroappz.com/ |
291 B 560 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
serve.css
blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/css/ |
39 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webfont.js
ajax.googleapis.com/ajax/libs/webfont/1.6.26/ |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
26 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icons.png
blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
welcome.jpg
blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/img/ |
65 KB 65 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Captussre.png
blog.mylottokenya.co.ke/wp-content/themes/twentysixteen/css/js/amen/img/ |
39 KB 39 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDI.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZYokSds18Q.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
14 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18Q.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZY4lCds18Q.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18Q.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZklyds18Q.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Register.it (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| WebFont0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
blog.mylottokenya.co.ke
fonts.googleapis.com
fonts.gstatic.com
zeroappz.com
162.214.80.70
192.254.237.126
2a00:1450:4001:827::200a
2a00:1450:4001:828::2003
2a00:1450:4001:829::200a
1f7a0936b6088ba92724552532f25bc5265a9683af16678aecfe3a7f67423004
24f7e397faec79e62c37ff2f00b170f6dc1557fb46ac169f9f1897a9d641dd03
29b561a8a01edc4acf52d1c4c763aa21a1b540bc020b92f8bbfaf656b53a02b0
338bdf9c4446455369ed41fbcbee7cdb1944b938225e7b5600cd79d689b4e167
4134d2c847bc0f81a4a7bb116823f450831c667b6b48f46709cd91a051d6c132
4ba0f48573cc9e7e9c073582fa327ed9682680e5e00a667c138881cc5709739d
553f5fabc75321590278e798830472879642e5baaaea952dd109e8a1f4b63a72
73c8180d1998460b559dee08da2ff6e3acf7a093090cc30bd43d8446006cfac6
79bc22da2b019b874b6b929eabfc299b3743ad6f2eb72935afb68dbf5723ed84
81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee
9de39dd2ce2cf89c254563ac20152eae0229f69e67de29e360fc94478fc4ffd3
a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199
bf4cc0685fe955c38f2302c23bfd581072fac2a13eb584874350c76cc015174a
c8829f057b5d19eebad210cb21bc404029c9feff9455643a5de58b234ae1b224
cd11ae1d6bf851cce3eae81f953954438faec264132d0dab72a5a52c1b7517e1
d3559c816af640e8382b29d02d4fbd8c7225fcf0302cf244d8b2d7cf5db2fdd1
d7df980df05c068e60d8b6f556d45766e1dd0ab533b465887e59e44ee30cbc34
e6584f14d4039a010b9e2b3d1ec27c6dbf47ee65d9eea3412f4146d64e1b5f93
efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309
f3d7092e6eb6f3aa0c572e52e061a59cc88a3e9eff581c95c4bd7456800904d0