colletsskins2k20.cf Open in urlscan Pro
95.111.242.214  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response colletsskins2k20.cf/login/google/	2 KB 1 KB	100ms 70ms	Document text/html	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Full URL http://colletsskins2k20.cf/login/google/ Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash e7971673709b388e0700978595594d8e43cafd0bcff76d4242dbf8904527c5a1 Request headers Host colletsskins2k20.cf Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Content-Length 975 Content-Encoding gzip Vary Accept-Encoding Date Tue, 15 Dec 2020 14:48:24 GMT Server LiteSpeed
GET H/1.1	200 OK	google.css colletsskins2k20.cf/login/google/css/	3 KB 1 KB	34ms 33ms	Stylesheet text/css	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Full URL http://colletsskins2k20.cf/login/google/css/google.css Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash 1de6bfe4b9629ec80c393fce4c759093b46922d5818960b742a2d5a5b842c0cc Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 14:48:24 GMT Content-Encoding gzip Last-Modified Thu, 20 Aug 2020 20:09:38 GMT Server LiteSpeed Vary Accept-Encoding Content-Type text/css Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 887 Expires Tue, 22 Dec 2020 14:48:24 GMT
GET H2	200	material-design-iconic-font.min.css cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/	69 KB 6 KB	17ms 16ms	Stylesheet text/css	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/material-design-iconic-font/2.2.0/css/material-design-iconic-font.min.css Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 15 Dec 2020 14:48:24 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 475742 cross-origin-resource-policy cross-origin vary Accept-Encoding content-length 5845 cf-request-id 070878c8620000bf053184b000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:12:09 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ed9-1149f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2ZWueM3YHNrI%2FqakasD9ROVnfM16sgTGhu6Uqar4UWw%2BbHw%2FqoymxGakpjm%2FG8ykDVSLgshtfnLH%2BQ1woezqwN%2BtCHhn37QE85UUnmy6kCQTrph2zUhsEJEJXslA95HsHQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6020f7209dd9bf05-FRA expires Sun, 05 Dec 2021 14:48:24 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.1.3/	82 KB 29 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:803::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 15 Dec 2020 13:45:54 GMT content-encoding gzip x-content-type-options nosniff age 3750 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29707 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 15 Dec 2021 13:45:54 GMT
GET H/1.1	200 OK	google.png colletsskins2k20.cf/login/google/img/	89 KB 89 KB	65ms 46ms	Image image/png	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Show image Full URL http://colletsskins2k20.cf/login/google/img/google.png Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash 6cc9251169424138ed12f531a4c3fe629549ef8b65ad8137a9bb8ca964f775c3 Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 14:48:24 GMT Last-Modified Thu, 20 Aug 2020 20:09:38 GMT Server LiteSpeed Content-Type image/png Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 90917 Expires Tue, 22 Dec 2020 14:48:24 GMT
GET H/1.1	200 OK	proses.js Show response colletsskins2k20.cf/login/google/js/	426 B 631 B	61ms 47ms	Script application/javascript	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Full URL http://colletsskins2k20.cf/login/google/js/proses.js Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash 8746d8f1ddea23f148b2861981cb3e40258ab622d19914bb8d36561365242512 Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 14:48:24 GMT Content-Encoding gzip Last-Modified Thu, 20 Aug 2020 20:09:38 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 279 Expires Tue, 22 Dec 2020 14:48:24 GMT
GET H/1.1	200 OK	content.js Show response colletsskins2k20.cf/login/google/js/	2 KB 1003 B	30ms 30ms	Script application/javascript	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Full URL http://colletsskins2k20.cf/login/google/js/content.js Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash 6f87f4b557f62e5330fb914bf04a91e7b27bc7f3e39c6495f29cf31bbb14dc00 Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 14:48:24 GMT Content-Encoding gzip Last-Modified Thu, 20 Aug 2020 20:09:38 GMT Server LiteSpeed Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 651 Expires Tue, 22 Dec 2020 14:48:24 GMT
GET H/1.1	200 OK	counter.js Show response colletsskins2k20.cf/login/google/js/	177 B 482 B	63ms 48ms	Script application/javascript	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Full URL http://colletsskins2k20.cf/login/google/js/counter.js Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash b718921ce7a84d65aeda5be80f48f4d8aa42e8cc8b128915ce7438adafac3335 Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 14:48:24 GMT Last-Modified Thu, 20 Aug 2020 20:09:38 GMT Server LiteSpeed Content-Type application/javascript Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 177 Expires Tue, 22 Dec 2020 14:48:24 GMT
GET H3-Q050	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.1.1/	82 KB 29 KB	35ms 20ms	Script text/javascript	2a00:1450:4001:803::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/ Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer http://colletsskins2k20.cf/login/google/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 11 Dec 2020 12:29:34 GMT content-encoding gzip x-content-type-options nosniff age 353930 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29671 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 11 Dec 2021 12:29:34 GMT
GET H/1.1	200 OK	google.ttf colletsskins2k20.cf/login/google/fonts/	40 KB 17 KB	54ms 44ms	Font font/ttf	95.111.242.214 CONTABO
General Check archive.org Show headers Download Go to Full URL http://colletsskins2k20.cf/login/google/fonts/google.ttf Requested by Host: colletsskins2k20.cf URL: http://colletsskins2k20.cf/login/google/css/google.css Protocol HTTP/1.1 Server 95.111.242.214 , Ukraine, ASN51167 (CONTABO, DE), Reverse DNS vmi479620.contaboserver.net Software LiteSpeed / Resource Hash b34cbb71d75b84eb4925f51e050249f65fb3e3550133aba0a4c161c6820aec82 Request headers Origin http://colletsskins2k20.cf Referer http://colletsskins2k20.cf/login/google/css/google.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 15 Dec 2020 14:48:24 GMT Content-Encoding gzip Last-Modified Thu, 20 Aug 2020 20:09:38 GMT Server LiteSpeed Vary Accept-Encoding Content-Type font/ttf Cache-Control public, max-age=604800 Connection Keep-Alive Accept-Ranges bytes Content-Length 17520 Expires Tue, 22 Dec 2020 14:48:24 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| kirim function| showloading function| hideloading function| buka function| showpage2 function| post function| result

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
colletsskins2k20.cf
2606:4700::6810:125e
2a00:1450:4001:803::200a
95.111.242.214
1de6bfe4b9629ec80c393fce4c759093b46922d5818960b742a2d5a5b842c0cc
6cc9251169424138ed12f531a4c3fe629549ef8b65ad8137a9bb8ca964f775c3
6f87f4b557f62e5330fb914bf04a91e7b27bc7f3e39c6495f29cf31bbb14dc00
8746d8f1ddea23f148b2861981cb3e40258ab622d19914bb8d36561365242512
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
b34cbb71d75b84eb4925f51e050249f65fb3e3550133aba0a4c161c6820aec82
b718921ce7a84d65aeda5be80f48f4d8aa42e8cc8b128915ce7438adafac3335
dec3e9f0190a504ed0c8f4a5e957c107206ba106cac4a1bbb6cbac6369a16d56
e7971673709b388e0700978595594d8e43cafd0bcff76d4242dbf8904527c5a1