![](/screenshots/1cb57b9e-9c94-49b5-9004-da271e2746d9.png)
update.v5lwd8wd5tmz.top
Open in
urlscan Pro
194.63.143.96
Malicious Activity!
Public Scan
Submission: On July 21 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R10 on July 2nd 2024. Valid for: 3 months.
This is the only time update.v5lwd8wd5tmz.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Fake Flash UpdateDomain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 194.63.143.96 194.63.143.96 | 50113 (SUPERSERV...) (SUPERSERVERSDATACENTER) | |
7 | 1 |
ASN50113 (SUPERSERVERSDATACENTER, CZ)
PTR: teach-compare.scenegermany.com
update.v5lwd8wd5tmz.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
v5lwd8wd5tmz.top
update.v5lwd8wd5tmz.top |
155 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
7 | update.v5lwd8wd5tmz.top |
update.v5lwd8wd5tmz.top
|
7 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
offerxflow.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
v5lwd8wd5tmz.top R10 |
2024-07-02 - 2024-09-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://update.v5lwd8wd5tmz.top/software/operagx/win/index.html?c=6617&u=28&p1=https%3A%2F%2Fofferxflow.com%2Fclick%3Fkey%3D15247f768f2461784925%26subid_short%3D3e6cdb5c110df820c1a2796afeb7e75b%26cost%3D%26place%3D20437092%26campaign%3D1082105%26bannerid%3D3023247
Frame ID: 618B44A5DC5CADF6972A27049AF5E95E
Requests: 7 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Klicken Sie hier, um fortzufahren.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
update.v5lwd8wd5tmz.top/software/operagx/win/ |
63 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
update.v5lwd8wd5tmz.top/software/operagx/win/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
update.v5lwd8wd5tmz.top/software/operagx/win/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
apple.png
update.v5lwd8wd5tmz.top/software/operagx/win/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Chrome.png
update.v5lwd8wd5tmz.top/software/operagx/win/img/ |
51 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flash.png
update.v5lwd8wd5tmz.top/software/operagx/win/img/ |
51 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sale3.png
update.v5lwd8wd5tmz.top/software/operagx/win/img/ |
29 KB 29 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Fake Flash Update18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| prelandId string| adUnitId function| getURLParameter function| checkReferer function| realImpression function| prelandAction function| brAction function| befUnlFunc string| fin_link object| links number| j object| translation function| replace_text function| alert_string function| translation_available function| detect_language function| translate string| strAlert0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
update.v5lwd8wd5tmz.top
194.63.143.96
085099b4f0ee9de6ba4328da221912365afa49a22907c8efaf9ec0b86cdf8a09
189e7d1cc3cb9e251aecfd081bb5d43fa0dbd0ae86f0c5c1d75ff993ee57dedd
3896a7ec6a48483089ad330851c05426dd1ffa1112ef086397b1aa300f78554f
c37e601f763103d0868fc2e517489457277034a535df1634aa7db51a72c0d8ed
f32fcdc2c152df13186e0592493286d155458a8f812229e7c597e1a828fed085