![](/screenshots/4f3b2055-b436-4bfd-8c5e-bbe6bb9d832f.png)
r.secprf2.com
Open in
urlscan Pro
104.26.0.9
Public Scan
Effective URL: https://r.secprf2.com/v2/go?ai=1f7de918b6ce4777ad3d2c5bdc19d2aa&eu=mtcpo%2Fawiwaka.lwm%2Ft%3A.toh&t=et5p6%3A5%2F9.9r5c...
Submission Tags: @phish_report
Submission: On February 21 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by GTS CA 1P5 on February 7th 2024. Valid for: 3 months.
This is the only time r.secprf2.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 50.28.56.190 50.28.56.190 | 32244 (LIQUIDWEB) (LIQUIDWEB) | |
2 | 54.89.40.3 54.89.40.3 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 3.126.48.135 3.126.48.135 | 16509 (AMAZON-02) (AMAZON-02) | |
1 3 | 104.26.0.9 104.26.0.9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 54.217.96.159 54.217.96.159 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 172.67.72.250 172.67.72.250 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 156.146.33.140 156.146.33.140 | () () | |
11 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-89-40-3.compute-1.amazonaws.com
iuven-ojr.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-48-135.eu-central-1.compute.amazonaws.com
adlutb.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-96-159.eu-west-1.compute.amazonaws.com
c.trackmytarget.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
secprf2.com
1 redirects
r.secprf2.com — Cisco Umbrella Rank: 134655 |
5 KB |
2 |
trackmytarget.com
1 redirects
c.trackmytarget.com — Cisco Umbrella Rank: 759294 cdn.trackmytarget.com |
3 KB |
2 |
adlutb.com
adlutb.com |
5 KB |
2 |
iuven-ojr.com
iuven-ojr.com — Cisco Umbrella Rank: 253902 |
3 KB |
2 |
toropornl.com
toropornl.com |
4 KB |
1 |
kaalimato.com
www.kaalimato.com |
877 B |
11 | 6 |
Domain | Requested by | |
---|---|---|
3 | r.secprf2.com |
1 redirects
r.secprf2.com
|
2 | adlutb.com |
iuven-ojr.com
|
2 | iuven-ojr.com |
toropornl.com
iuven-ojr.com |
2 | toropornl.com |
toropornl.com
|
1 | cdn.trackmytarget.com |
www.kaalimato.com
|
1 | www.kaalimato.com |
r.secprf2.com
cdn.trackmytarget.com |
1 | c.trackmytarget.com | 1 redirects |
11 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.kaalimato.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
iuven-ojr.com Amazon RSA 2048 M03 |
2023-12-22 - 2025-01-19 |
a year | crt.sh |
adlutb.com R3 |
2024-01-27 - 2024-04-26 |
3 months | crt.sh |
secprf2.com GTS CA 1P5 |
2024-02-07 - 2024-05-07 |
3 months | crt.sh |
kaalimato.com GTS CA 1P5 |
2024-02-18 - 2024-05-18 |
3 months | crt.sh |
1317597359.rsc.cdn77.org R3 |
2024-01-28 - 2024-04-27 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://r.secprf2.com/v2/go?ai=1f7de918b6ce4777ad3d2c5bdc19d2aa&eu=mtcpo%2Fawiwaka.lwm%2Ft%3A.toh&t=et5p6%3A5%2F9.9r5c3m4t3r8e2.fof%2F7abj1s4x1%260%3D4m3dv5dc_ickli%26%3Dl0f0f0i0l4i4k4%3D7%3F3m9cbtag4a3y9k3a2t4c8%2F9sdt6h&sct=0&ct=1708498206442&cu=4b773f9fb2a84334933529498596d56e&w=4&e=1&ykuid=38eb3cb93b024572a00da846f3b1a15d&sc=1&cs=f91bbbf351608a7f26c68aabb2ba44ca
Frame ID: 6599E3F29C96B31292060BFDBF2A88A8
Requests: 8 HTTP requests in this frame
Frame:
https://www.kaalimato.com/?utm_source=PM&utm_medium=PM&utm_campaign=PM
Frame ID: AE0D2CB6DE7247ABE4188ED0BA76E88F
Requests: 3 HTTP requests in this frame
Screenshot
![](/screenshots/4f3b2055-b436-4bfd-8c5e-bbe6bb9d832f.png)
Page Title
Please waitPage URL History Show full URLs
- http://toropornl.com/ Page URL
- http://toropornl.com/page/bouncy.php?&bpae=GbhGtLcGvUx7NpvvMZzGxX3K0smCZgN4p54qtkjf04D1DpccwejLa8... Page URL
- https://iuven-ojr.com/zclkvisitor/6eec6d04-d085-11ee-bd1c-12749ba9cacb/c48f16c0-a519-11ec-9226-0a7... Page URL
- https://iuven-ojr.com/zclkredirect?visitid=6eec6d04-d085-11ee-bd1c-12749ba9cacb&type=js&browserWid... Page URL
- https://adlutb.com/click?trvid=35671&extid=zr6eec6d04d08511eebd1c12749ba9cacb63c90e44100f42978c... Page URL
- https://adlutb.com/double?t=2&d=eyJVUkwiOiJodHRwczovL3Iuc2VjcHJmMi5jb20vdjEvcmVkaXJlY3Q_dHlwZT1... Page URL
-
https://r.secprf2.com/v1/redirect?type=linkId&id=aa34de72a5ee46aa802297ba6d32b600&api_key=8848fddd...
HTTP 302
https://r.secprf2.com/v2/go?ai=1f7de918b6ce4777ad3d2c5bdc19d2aa&eu=mtcpo%2Fawiwaka.lwm%2Ft%3A.toh&... Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: here
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://toropornl.com/ Page URL
- http://toropornl.com/page/bouncy.php?&bpae=GbhGtLcGvUx7NpvvMZzGxX3K0smCZgN4p54qtkjf04D1DpccwejLa8PvW%2BaTGBXD7d4UXDttPMzGeMwDFif0BMmHzD22YWdmpILDCgQXYKAPcpNEpBlkNCaCe%2BmSHprGL%2FmbMvqcTUcXcsfzkqovgu9z5UJaavjKVRCn1MdTU5glCW1Qmt0ZM6cQ1UQJTmFOJkHmRQcJ3t%2FKUxaTZgcZsDSEHpudKJFW8LJzuAjqeslCUtzZNafx9H1MBj%2BsFQkLWoj9dLMvENiR7OlJyr%2F5565HxU96%2B1RjHY0KRMnU29SA1JCu3EnojnCCxTgPkEMeosahEM9t4ARWDAWLRi7E4hTJqGqwqMdyLEdroSke%2Fme8g4%2FuOvzCwOcBa99ghH2zRHdWSxCGnr7nAuzhm4Kzejc8YEV%2BiFwvp%2BdQIJyslsz9TBp%2FW8GbApXg3QeQ3y5%2BV%2FL79MpqCNa8Ss%2FI%2FK5Zlp9coUVXlB0mGr5tqq8MnBWojwApLbC4U8r9pYXtQpehu2Xr9%2Bkm&redirectType=js&inIframe=false&inPopUp=false Page URL
- https://iuven-ojr.com/zclkvisitor/6eec6d04-d085-11ee-bd1c-12749ba9cacb/c48f16c0-a519-11ec-9226-0a76dcc61f13?campaignid=e990b610-94e9-11ee-b3de-0a4ababc2193 Page URL
- https://iuven-ojr.com/zclkredirect?visitid=6eec6d04-d085-11ee-bd1c-12749ba9cacb&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected%20%20%20%20%20%20%20%20=false&usingEventListener=true Page URL
- https://adlutb.com/click?trvid=35671&extid=zr6eec6d04d08511eebd1c12749ba9cacb63c90e44100f42978c6421e8e81e3d870801180730488c0259&cost=0.009990&campid=2288063&targid=delta-hot-vqperr77d4&keywrd=toropornl.com&contry=FI&trftyp=DOMAIN&vistyp=ADULT&tarurl= Page URL
- https://adlutb.com/double?t=2&d=eyJVUkwiOiJodHRwczovL3Iuc2VjcHJmMi5jb20vdjEvcmVkaXJlY3Q_dHlwZT1saW5rSWRcdTAwMjZpZD1hYTM0ZGU3MmE1ZWU0NmFhODAyMjk3YmE2ZDMyYjYwMFx1MDAyNmFwaV9rZXk9ODg0OGZkZGRlYWMyZjFhYjVkMzg3MWUxYTMzMGQxMDFcdTAwMjZzaXRlX2lkPTc0MDRhZTBmNWJmNDQ4YmRhODg5MTdhOThlYzQyMDQ3XHUwMDI2ZGNoPWZlZWRcdTAwMjZhZF90PWFkdmVydGlzZXJcdTAwMjZ5a190YWc9MkJZZm9zM0QwYmt1IiwiUmVkaXJlY3RXb3JkaW5nIjoiICIsIlJlZGlyZWN0VGl0bGUiOiJSZWRpcmVjdGlvbi4uLiIsIlJlZGlyZWN0TGlua1RleHQiOiIgIiwiSW5zdGFsbElkIjoyMDAxfQ== Page URL
-
https://r.secprf2.com/v1/redirect?type=linkId&id=aa34de72a5ee46aa802297ba6d32b600&api_key=8848fdddeac2f1ab5d3871e1a330d101&site_id=7404ae0f5bf448bda88917a98ec42047&dch=feed&ad_t=advertiser&yk_tag=2BYfos3D0bku
HTTP 302
https://r.secprf2.com/v2/go?ai=1f7de918b6ce4777ad3d2c5bdc19d2aa&eu=mtcpo%2Fawiwaka.lwm%2Ft%3A.toh&t=et5p6%3A5%2F9.9r5c3m4t3r8e2.fof%2F7abj1s4x1%260%3D4m3dv5dc_ickli%26%3Dl0f0f0i0l4i4k4%3D7%3F3m9cbtag4a3y9k3a2t4c8%2F9sdt6h&sct=0&ct=1708498206442&cu=4b773f9fb2a84334933529498596d56e&w=4&e=1&ykuid=38eb3cb93b024572a00da846f3b1a15d&sc=1&cs=f91bbbf351608a7f26c68aabb2ba44ca Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://c.trackmytarget.com/?a=jksixl&i=fmfdl5&click_id=v0304000144414b773f9fb2a84334933529498596d56e HTTP 301
- https://www.kaalimato.com/pm.html?offer_sid=p94047&tmt_data=261d802e-f5ec-4f23-b67f-1aa5a8290c35&r=https%3A%2F%2Fwww.kaalimato.com%3Futm_source%3DPM%26utm_medium%3DPM%26utm_campaign%3DPM&tmt_ufp=7e9ec7cc296b8f605fe81419cf0bde1e9fcc50ebfa0fa8776b206949a94a3ec5
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
toropornl.com/ |
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bouncy.php
toropornl.com/page/ |
991 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c48f16c0-a519-11ec-9226-0a76dcc61f13
iuven-ojr.com/zclkvisitor/6eec6d04-d085-11ee-bd1c-12749ba9cacb/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zclkredirect
iuven-ojr.com/ |
682 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
click
adlutb.com/ |
1 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
double
adlutb.com/ |
980 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
go
r.secprf2.com/v2/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajax-loader.gif
r.secprf2.com/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pm.html
www.kaalimato.com/ Frame AE0D Redirect Chain
|
239 B 877 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
entrypoint.min.js
cdn.trackmytarget.com/tracking/s/ Frame AE0D |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
www.kaalimato.com/ Frame AE0D |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.kaalimato.com
- URL
- https://www.kaalimato.com/?utm_source=PM&utm_medium=PM&utm_campaign=PM
Verdicts & Comments Add Verdict or Comment
1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 05 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
adlutb.com/ | Name: ClickDataNG Value: H4sIAAAAAAAA_7RU3Y7bNhN9FWOuEkCRSYmSKAVC4Ox--WpknRbIboMCBRYUObJZy6JKUso6P-9e0NJutkVve0XNmaMZzszhfIUJrdOmhwpoTGICEfjzgFCRCNzY3D5-S9NPaD0qqFrROYxAdloetwoqSN7-1hqXXpPmOEIESniEihaEs5InJItAitMg9L4P7DTLCxqBdle_bJ5iWeOF1-ZCKLOER2DHDoNFIrCotEXpd-gPRkGVReDMaOXFzyLoRK90v1_Yi3VnO6gAIjBtizb4aJplJILGil4eFvLFOVMP3g-uWq9t7FAOtk1iaU7ria4f078Jfak73R-36veRkCTXqhYiZQqLRGSILBeCkyQpi0bkKk2anJCZKAZ9f8RzzTnjrVIKhUxaKppMpbygSEWaEkUJndlOe7zXqi4YYQJJmzUtY7xRgvOSFqLkKFlCWDGzlTzULeJyJaHufS1UGJV2aGfwfLz3Yl__Y0zSOA8ViQkNLZ6wH-dJD-JsRv-jPVejtdjLM1Rw9_EaIhitftYvobrRN5dmXRTxxttJq_oy5jk9Pnit6i82R5S5IkwRnlGK2CgqaVKwshGlFLLJU1kSZIwS0rKkLLjMWUKRI6eYKl4QTijlpEgJ41ySJCvn-KGQmsSElGW5NDwITqs6STgneTpjXti9VrXCzotXB-NfTX8OaG1RKDYTjnj-bFXtjTWDsX0XanrM0Ht7rt9tl0i29eehvv55t9l-mKFJuwBtru9ubp_SjbarIQI9bJSy6BxUUNKYZjymOQnnc2c-y3V0aDd77D1UsDNfdNeJdRaT1YtPulfms1t9uF1REpPXq0-6z9nr1UPOXq42w9DhJ2zea7_O0iJO89WL9z_d7m6iVaePuPo_yqN5ubo6WHPCNU3CU89pXsSUs9VH0Qqrl_8giKFFixYq0OOE_Svzhw2tCC8bJy3xaSeYUNFyr_DS3K8_dklYJI01n90l0Jz4KcJbK3o11zsDO6Owew58ECecbTmngyvRdLi-_ngTmuYGqOB_nXbiIuQxjAcqeLe9XH8_3-Hd9tu3u9Hpk7iwtD8v4E440QVsEBZ7fxVkuywLq_e6vxmeQd6K3gk5bycHVT92XQRydN6coPq6PCN41B9EgA8ebS-6y278L2QPEUwk7N1Z3sGkUMG_KTv4Eqjgb6IOYDpXNzGoYBZysLIFXcQ4FcvJl7MM5_fvfwUAAP__QXQR1jYGAAA= |
|
adlutb.com/ | Name: ClickDataNgFall Value: H4sIAAAAAAAA_7RU3Y7bNhN9FWOuEkCRSYmSKAVC4Ox--WpknRbIboMCBRYUObJZy6JKUso6P-9e0NJutkVve0XNmaMZzszhfIUJrdOmhwpoTGICEfjzgFCRCNzY3D5-S9NPaD0qqFrROYxAdloetwoqSN7-1hqXXpPmOEIESniEihaEs5InJItAitMg9L4P7DTLCxqBdle_bJ5iWeOF1-ZCKLOER2DHDoNFIrCotEXpd-gPRkGVReDMaOXFzyLoRK90v1_Yi3VnO6gAIjBtizb4aJplJILGil4eFvLFOVMP3g-uWq9t7FAOtk1iaU7ria4f078Jfak73R-36veRkCTXqhYiZQqLRGSILBeCkyQpi0bkKk2anJCZKAZ9f8RzzTnjrVIKhUxaKppMpbygSEWaEkUJndlOe7zXqi4YYQJJmzUtY7xRgvOSFqLkKFlCWDGzlTzULeJyJaHufS1UGJV2aGfwfLz3Yl__Y0zSOA8ViQkNLZ6wH-dJD-JsRv-jPVejtdjLM1Rw9_EaIhitftYvobrRN5dmXRTxxttJq_oy5jk9Pnit6i82R5S5IkwRnlGK2CgqaVKwshGlFLLJU1kSZIwS0rKkLLjMWUKRI6eYKl4QTijlpEgJ41ySJCvn-KGQmsSElGW5NDwITqs6STgneTpjXti9VrXCzotXB-NfTX8OaG1RKDYTjnj-bFXtjTWDsX0XanrM0Ht7rt9tl0i29eehvv55t9l-mKFJuwBtru9ubp_SjbarIQI9bJSy6BxUUNKYZjymOQnnc2c-y3V0aDd77D1UsDNfdNeJdRaT1YtPulfms1t9uF1REpPXq0-6z9nr1UPOXq42w9DhJ2zea7_O0iJO89WL9z_d7m6iVaePuPo_yqN5ubo6WHPCNU3CU89pXsSUs9VH0Qqrl_8giKFFixYq0OOE_Svzhw2tCC8bJy3xaSeYUNFyr_DS3K8_dklYJI01n90l0Jz4KcJbK3o11zsDO6Owew58ECecbTmngyvRdLi-_ngTmuYGqOB_nXbiIuQxjAcqeLe9XH8_3-Hd9tu3u9Hpk7iwtD8v4E440QVsEBZ7fxVkuywLq_e6vxmeQd6K3gk5bycHVT92XQRydN6coPq6PCN41B9EgA8ebS-6y278L2QPEUwk7N1Z3sGkUMG_KTv4Eqjgb6IOYDpXNzGoYBZysLIFXcQ4FcvJl7MM5_fvfwUAAP__QXQR1jYGAAA= |
|
.secprf2.com/ | Name: ykuid Value: 38eb3cb93b024572a00da846f3b1a15d |
|
.trackmytarget.com/ | Name: p94047 Value: jksixl-fmfdl5_261d802e-f5ec-4f23-b67f-1aa5a8290c35_1708498207 |
|
.trackmytarget.com/ | Name: ufp Value: 7e9ec7cc296b8f605fe81419cf0bde1e9fcc50ebfa0fa8776b206949a94a3ec5 |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adlutb.com
c.trackmytarget.com
cdn.trackmytarget.com
iuven-ojr.com
r.secprf2.com
toropornl.com
www.kaalimato.com
www.kaalimato.com
104.26.0.9
156.146.33.140
172.67.72.250
3.126.48.135
50.28.56.190
54.217.96.159
54.89.40.3
39e8b559752b159bc6c3d836258b672ca10edb9806bc6273188d4420678f8347
716d0c2da3fdde8c4c4ff12fd2a746b0d1f29cfabfd4c40e10f9b39035d6422a
aebc793d0064383ee6b1625bf3bb32532ec30a5c12bf9117066107d412119123
bc92d71eb1b84bb8ccc88b92c46ee06a6215390538593b7703bd43916acbc98e
bdc8c577d4bda3ddca8d9b376bb27f535e27147cf894cac9437378d9fa17d0f0
d4767f2c1c6c9e19ed76b26240dd4f133b49e76672266aa03a6b9c7871e9dc62
fae4fca0f645a6e2859d9f4227174d0f34f6880561f67f868dd4aee85e2cb5b2