european-news.org
Open in
urlscan Pro
2606:4700:3037::ac43:c81f
Malicious Activity!
Public Scan
Effective URL: https://european-news.org//news/33years/index.php?lpkey=168824443817140e97&uclick=xonta9d5&uclickhash=xonta9d5-xonta9d5-8w...
Submission: On June 22 via manual from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 17th 2020. Valid for: a year.
This is the only time european-news.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Lion's Den Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.227.226.240 67.227.226.240 | 32244 (LIQUIDWEB) (LIQUIDWEB) | |
1 1 | 198.134.116.18 198.134.116.18 | 27257 (WEBAIR-IN...) (WEBAIR-INTERNET) | |
1 2 | 2a02:b48:207:... 2a02:b48:207:1::3 | 39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS) | |
1 | 185.56.234.205 185.56.234.205 | 39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS) | |
1 1 | 2606:4700:303... 2606:4700:3033::ac43:dae1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
25 | 2606:4700:303... 2606:4700:3037::ac43:c81f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
27 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
25 |
european-news.org
european-news.org |
1 MB |
2 |
tiodmw.com
1 redirects
tiodmw.com |
444 B |
1 |
globenews.org
1 redirects
globenews.org |
891 B |
1 |
ahojer.com
ahojer.com |
12 KB |
1 |
junmediadirect.com
1 redirects
click.junmediadirect.com |
212 B |
1 |
reddittext.com
1 redirects
reddittext.com |
343 B |
27 | 6 |
Domain | Requested by | |
---|---|---|
25 | european-news.org |
ahojer.com
european-news.org |
2 | tiodmw.com |
1 redirects
ahojer.com
|
1 | globenews.org | 1 redirects |
1 | ahojer.com | |
1 | click.junmediadirect.com | 1 redirects |
1 | reddittext.com | 1 redirects |
27 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
globenews.org |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.ahojer.com ZeroSSL RSA Domain Secure Site CA |
2021-03-15 - 2021-06-13 |
3 months | crt.sh |
tiodmw.com R3 |
2021-04-19 - 2021-07-18 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-11-17 - 2021-11-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://european-news.org//news/33years/index.php?lpkey=168824443817140e97&uclick=xonta9d5&uclickhash=xonta9d5-xonta9d5-8wg6-ojb7-3v9l-7v8pwj-7v8pvr-3413b7
Frame ID: F6D81B68E82475721E32A0B6F0954CAA
Requests: 27 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://reddittext.com/
HTTP 302
http://click.junmediadirect.com/click?i=RuARhxB2jG8_0 HTTP 302
https://tiodmw.com/dsp/cu/clc?aid=7510542569625569229&t=1624381196&s=685880&sid=1175 HTTP 302
https://ahojer.com/fp.html?rid=7510542569625569229_2&sd=aHR0cHM6Ly90aW9kbXcuY29t&ru=aHR0cHM6Ly9... Page URL
-
https://globenews.org/go.php?key=tlt5a9sm8cad3c6kvgz9&clickid={clickid}&cpa_cost={cpa_cost}&SOURCE...
HTTP 302
https://european-news.org//news/33years/index.php?lpkey=168824443817140e97&uclick=xonta9d5&uclickhash=... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: NEWS
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://reddittext.com/
HTTP 302
http://click.junmediadirect.com/click?i=RuARhxB2jG8_0 HTTP 302
https://tiodmw.com/dsp/cu/clc?aid=7510542569625569229&t=1624381196&s=685880&sid=1175 HTTP 302
https://ahojer.com/fp.html?rid=7510542569625569229_2&sd=aHR0cHM6Ly90aW9kbXcuY29t&ru=aHR0cHM6Ly9nbG9iZW5ld3Mub3JnL2dvLnBocD9rZXk9dGx0NWE5c204Y2FkM2M2a3ZnejkmY2xpY2tpZD17Y2xpY2tpZH0mY3BhX2Nvc3Q9e2NwYV9jb3N0fSZTT1VSQ0VfSUQ9czExNzVfMjY1NzUzLXJlZGRpdHRleHRjb20mQ0FNUEFJR05fSUQ9Njg1ODgwJkNPVU5UUlk9REUmQlJPV1NFUj1DaHJvbWUmQ1BDPTAmQ1JFQVRJVkVfSUQ9e0NSRUFUSVZFX0lEfQ== Page URL
-
https://globenews.org/go.php?key=tlt5a9sm8cad3c6kvgz9&clickid={clickid}&cpa_cost={cpa_cost}&SOURCE_ID=s1175_265753-reddittextcom&CAMPAIGN_ID=685880&COUNTRY=DE&BROWSER=Chrome&CPC=0&CREATIVE_ID={CREATIVE_ID}
HTTP 302
https://european-news.org//news/33years/index.php?lpkey=168824443817140e97&uclick=xonta9d5&uclickhash=xonta9d5-xonta9d5-8wg6-ojb7-3v9l-7v8pwj-7v8pvr-3413b7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://reddittext.com/ HTTP 302
- http://click.junmediadirect.com/click?i=RuARhxB2jG8_0 HTTP 302
- https://tiodmw.com/dsp/cu/clc?aid=7510542569625569229&t=1624381196&s=685880&sid=1175 HTTP 302
- https://ahojer.com/fp.html?rid=7510542569625569229_2&sd=aHR0cHM6Ly90aW9kbXcuY29t&ru=aHR0cHM6Ly9nbG9iZW5ld3Mub3JnL2dvLnBocD9rZXk9dGx0NWE5c204Y2FkM2M2a3ZnejkmY2xpY2tpZD17Y2xpY2tpZH0mY3BhX2Nvc3Q9e2NwYV9jb3N0fSZTT1VSQ0VfSUQ9czExNzVfMjY1NzUzLXJlZGRpdHRleHRjb20mQ0FNUEFJR05fSUQ9Njg1ODgwJkNPVU5UUlk9REUmQlJPV1NFUj1DaHJvbWUmQ1BDPTAmQ1JFQVRJVkVfSUQ9e0NSRUFUSVZFX0lEfQ==
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
fp.html
ahojer.com/ Redirect Chain
|
30 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sfd
tiodmw.com/ |
0 72 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
index.php
european-news.org//news/33years/ Redirect Chain
|
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
ouibounce.css
european-news.org//news/33years/index_files/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
bootstrap.css
european-news.org//news/33years/index_files/ |
111 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
font-awesome.css
european-news.org//news/33years/index_files/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
style.css
european-news.org//news/33years/index_files/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
jquery.min.js
european-news.org// |
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
css.html
european-news.org//news/33years/index_files/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
main.png
european-news.org//news/33years/index_files/ |
230 KB 231 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
tvuk1.jpg
european-news.org//news/33years/index_files/ |
99 KB 100 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
tvuk2.jpg
european-news.org//news/33years/index_files/ |
202 KB 203 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
bittrader-step3.png
european-news.org//news/33years/index_files/ |
114 KB 115 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
_bitcointrader.jpg
european-news.org//news/33years/index_files/ |
80 KB 80 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
bittrader-step2.png
european-news.org//news/33years/index_files/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side1.png
european-news.org//news/33years/index_files/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side2.png
european-news.org//news/33years/index_files/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side3.png
european-news.org//news/33years/index_files/ |
38 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side4.png
european-news.org//news/33years/index_files/ |
24 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side5.png
european-news.org//news/33years/index_files/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side6.png
european-news.org//news/33years/index_files/ |
33 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
side7.png
european-news.org//news/33years/index_files/ |
29 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
checkmark.png
european-news.org//news/33years/index_files/ |
335 B 946 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
bitcointrader-side-step1.png
european-news.org//news/33years/index_files/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
bitcointrader-side-step2.png
european-news.org//news/33years/index_files/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
css.html
european-news.org//news/33years/index_files/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
opensans-bold.html
european-news.org//news/33years/index_files/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Lion's Den Scam (Online)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| dayNames object| monthNames object| now number| dayOfTheWeek0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ahojer.com
click.junmediadirect.com
european-news.org
globenews.org
reddittext.com
tiodmw.com
185.56.234.205
198.134.116.18
2606:4700:3033::ac43:dae1
2606:4700:3037::ac43:c81f
2a02:b48:207:1::3
67.227.226.240
00c74a2e7797a7563510ea8dd080102120184490919b5f471568412be7c0640e
03d782d12b09ab0b8ae38ac3021aeba8e7cdd3dc7cec8c57b702e07a4b775ba3
2939f75d630d66cd5c52bc293de7687781c3b159b48ab28f291a40fa23d1db0d
30a8f07f2ea6c2399274fbe4ed4f8509d52f73226e4517b478b62a5138bddce9
34bd971856380c5d69de0f7dad46e96521a589e320bf74088285365c081eeb9c
4edebe5fd1684f64fc39b79678e7b70fe4eebcb3e6c8615909f49a01b8220069
52d75a1fefb3b1098d7a06179f7ff163cb7f54269d8907753d226cb60a57f96c
53dac3e79d8a6c3d6a3fe85acbde0478174a5d87ecaf632de9d617951c70750e
565544502dd1a931efdafde430d38d6c30d3a37417da5d2039c8c906f7597d4c
61ac745b0e6490d8f96d018a4c9dd6155d2afdb27ba6779bcc2a81b23bee2d85
6445016c6fbdadfaa046e3ec872d19c9fd81497f958b2e94ddec0d82c7afea3e
70cfdb0254e9462a93412be9c61e613d7e3aca9ab0dbb4ed296ad694eef2ef4d
77d7de14ed48dd2add4c13cbc0ed8b5a2cb385265a87e36ba13d8d570e68fd63
7f43b2cdbffe1a745a9cb45bd974ba3f9570560499789d92a301e6a622572ba7
91b562443e3c800b9698ca46e7f74d0e9662a9486547fb4f748c7f8cfa6f1e17
a141d2b31b1e5df349d00825e5b146be341f292dd38bd5f541083454b1c5a884
b665efd8d11fbdd1661772df9b2adae781005d8167ea07af95ba585ce3978331
c60628ada1d8d2d684593e5730f1909d44102ec2e848c174072b0c1ee2293eae
d916c48a5e1f2c512bef6e7f86310c16dc424adb591dfa336041228762c4cef6
e72deb81f681c21f484cc171bb5f839a7d7342de5bb9f984031e83aee9d75aa8
eecb6f8523fe60c024b3bc105d8928de114e9a6f79fcce7948069461f28ce940
f0500b8d9df26637ae8a58cd22983ba09e1c6e10cfbde03b66cb46745a7f7eaf