185.196.10.78 Open in urlscan Pro
185.196.10.78 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://thegardensalc.com/kvtoto-10/
Effective URL:
http://185.196.10.78/
Submission Tags: @phish_report
Submission: On August 07 via api (August 7th 2024, 6:18:00 am UTC) from FI — Scanned from FI

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 18 HTTP transactions. The main IP is 185.196.10.78, located in United Kingdom and belongs to SWISSNETWORK02, SC. The main domain is 185.196.10.78.

This is the only time 185.196.10.78 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 6	172.67.203.86 172.67.203.86	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	172.67.141.4 172.67.141.4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	185.196.10.78 185.196.10.78	42624 (SWISSNETW...) (SWISSNETWORK02)
1	2606:4700::68... 2606:4700::6812:bb1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
18	4

6 172.67.203.86 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

thegardensalc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.141.4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

77rabbitz.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 185.196.10.78 (United Kingdom)

ASN42624 (SWISSNETWORK02, SC)

185.196.10.78	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bb1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	thegardensalc.com 1 redirects thegardensalc.com	41 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 410	30 KB
1	77rabbitz.top 1 redirects 77rabbitz.top	442 B
0	cloudflareinsights.com Failed static.cloudflareinsights.com Failed
18	4

	Domain	Requested by
6	thegardensalc.com	1 redirects thegardensalc.com
1	cdn.jsdelivr.net	185.196.10.78
1	77rabbitz.top	1 redirects
0	static.cloudflareinsights.com Failed	thegardensalc.com
18	4

This site contains no links.

Subject Issuer	Validity	Valid
thegardensalc.com WE1	`2024-08-02` - `2024-10-31`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://185.196.10.78/
Frame ID: 56F9F5A0A1DF08DF810064A0E340BB1B
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

77rabbit - Mesin slot online paling terkemuka di Indonesia, perusahaan taruhan olahraga

Page URL History Show full URLs

https://thegardensalc.com/kvtoto-10/ Page URL
https://thegardensalc.com/cdn-cgi/phish-bypass?atok=SoljYRiu7sy8hZFMTmCRaQ1Ir6X1LEb_NYUm3F512x0-172301... HTTP 301
https://thegardensalc.com/kvtoto-10/ Page URL
https://77rabbitz.top/register?id=4427 HTTP 301
http://185.196.10.78/ HTTP 307
https://185.196.10.78/ HTTP 307
http://185.196.10.78/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Clipboard.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

clipboard(?:-([\d.]+))?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

18
Requests

33 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

772 kB
Transfer

1116 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://thegardensalc.com/kvtoto-10/ Page URL
https://thegardensalc.com/cdn-cgi/phish-bypass?atok=SoljYRiu7sy8hZFMTmCRaQ1Ir6X1LEb_NYUm3F512x0-1723011469-0.0.1.1-%2Fkvtoto-10%2F HTTP 301
https://thegardensalc.com/kvtoto-10/ Page URL
https://77rabbitz.top/register?id=4427 HTTP 301
http://185.196.10.78/ HTTP 307
https://185.196.10.78/ HTTP 307
http://185.196.10.78/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://thegardensalc.com/cdn-cgi/phish-bypass?atok=SoljYRiu7sy8hZFMTmCRaQ1Ir6X1LEb_NYUm3F512x0-1723011469-0.0.1.1-%2Fkvtoto-10%2F HTTP 301
https://thegardensalc.com/kvtoto-10/

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
thegardensalc.com/kvtoto-10/ 4 KB
2 KB 133ms
71ms Document
text/html 172.67.203.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thegardensalc.com/kvtoto-10/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.203.86 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6284aaa458ddb76ccd7202781a95862815750b4387db99cf6097d8fd3757afe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

cf-ray: 8af525538dd53837-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 07 Aug 2024 06:17:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RG5kbPovYmfVoay%2Fg8mcNbiMF%2FvQ%2FLtqA4kJZIevHZlNngVuxWPXGW9BJ67lb04YzNReZOqPBITYRf%2Bj3lexMXF5Hmb%2B%2Fs%2FvjGvIREeU51LkfNVIpnKJNogcWQj6elpH7s7LHA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
thegardensalc.com/cdn-cgi/styles/ 23 KB
5 KB 59ms
58ms Stylesheet
text/css 172.67.203.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thegardensalc.com/cdn-cgi/styles/cf.errors.css

Requested by

Host: thegardensalc.com
URL: https://thegardensalc.com/kvtoto-10/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.203.86 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://thegardensalc.com/kvtoto-10/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Wed, 07 Aug 2024 06:17:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 30 Jul 2024 21:55:42 GMT
server: cloudflare
etag: W/"66a9615e-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8af52553fe543837-FRA
expires: Wed, 07 Aug 2024 08:17:49 GMT

GET
H3 200 icon-exclamation.png
thegardensalc.com/cdn-cgi/images/ 452 B
634 B 58ms
57ms Image
image/png 172.67.203.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thegardensalc.com/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: thegardensalc.com
URL: https://thegardensalc.com/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.203.86 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://thegardensalc.com/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Wed, 07 Aug 2024 06:17:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 30 Jul 2024 21:55:42 GMT
server: cloudflare
etag: "66a9615e-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8af525546eaf3837-FRA
content-length: 452
expires: Wed, 07 Aug 2024 08:17:49 GMT

GET
H3 200 favicon.ico
thegardensalc.com/ 32 KB
32 KB 76ms
75ms Other
image/x-icon 172.67.203.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thegardensalc.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.203.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f5df11db42901379fb6811239d7e0d0f5c698a57f65ae51fa991eabe3b81b17

Request headers

Referer: https://thegardensalc.com/kvtoto-10/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Wed, 07 Aug 2024 06:17:49 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 16 Jul 2024 08:43:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 2825
etag: W/"669632c8-7e46"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ACyt36RwZYk%2F9WaXhMjGIPsuMBMp1SGR38GmM9VW00nOCnJ7MY6O%2FadGdXjup07II7UFh%2F%2BQexEEhl9vYbOuqSa1f%2F4YAYWUNI5KNI9FHZmlNm0fpBVplaKwDD9aZZ%2FTwvNLbg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: max-age=14400
cf-ray: 8af52554cf323837-FRA
alt-svc: h3=":443"; ma=86400
priority: u=1,i

GET
H3

200

/
thegardensalc.com/kvtoto-10/
Redirect Chain

https://thegardensalc.com/cdn-cgi/phish-bypass?atok=SoljYRiu7sy8hZFMTmCRaQ1Ir6X1LEb_NYUm3F512x0-1723011469-0.0.1.1-%2Fkvtoto-10%2F
https://thegardensalc.com/kvtoto-10/

2 KB
1 KB

371ms
370ms

Document
text/html

172.67.203.86
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://thegardensalc.com/kvtoto-10/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.203.86 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://thegardensalc.com/kvtoto-10/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8af5256c8b343837-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 07 Aug 2024 06:17:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=np4Jbij1gdh0rrHXJZGCo%2Bb6s5LdbOEOdQAvjKK0NtBdn9Xx6%2BCGiJrXMxjGnkJvi5BJll84WQsYLzAy53j%2BykzmUXsU4vVRBIoQICTIW0mjF7gZWgThR1GgOG5KMjBtEUSbhQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8af5256bda0e3837-FRA
content-length: 167
content-type: text/html
date: Wed, 07 Aug 2024 06:17:53 GMT
location: https://thegardensalc.com/kvtoto-10/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/ 0
0

GET
H/1.1

200
OK

Primary Request / Show response
185.196.10.78/
Redirect Chain

https://77rabbitz.top/register?id=4427
http://185.196.10.78/
https://185.196.10.78/
http://185.196.10.78/

2 KB
1 KB

170ms
86ms

Document
text/html

185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/
Requested by: Host: thegardensalc.com
URL: https://thegardensalc.com/kvtoto-10/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 688cb414b563ec9aa0c8e34576f8f4b6e1c22cf368b59523b5dac751394915ad

Request headers

Referer: https://thegardensalc.com/kvtoto-10/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 07 Aug 2024 06:17:54 GMT
ETag: W/"66aa07b3-931"
Last-Modified: Wed, 31 Jul 2024 09:45:23 GMT
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

Location: http://185.196.10.78/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ 190 KB
30 KB 118ms
42ms Stylesheet
text/css 2606:4700::6812:bb1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css

Requested by

Host: 185.196.10.78
URL: http://185.196.10.78/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://185.196.10.78/
Origin: http://185.196.10.78
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

date: Wed, 07 Aug 2024 06:17:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 8042114
x-jsd-version: 5.2.3
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 30336
x-served-by: cache-fra-eddf8230122-FRA, cache-lga21930-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S9IQghkAGzJwFJ6JSlGh32CLfzIK4oys2jD5aYij0JDJ6q%2BmJCqJtbWDOUNDn%2B6NTB6%2BUzHroY%2FRJiM%2B%2BPdFzUc4LVRda5WadQvsrj8SBV1ypssxEkxs5ax47quHSJdWd0jkkU%2BmVEFzsW38dv8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8af52572a9ff8d6b-HEL

GET
H/1.1 200
OK style.css
185.196.10.78/css/ 800 B
1 KB 88ms
86ms Stylesheet
text/css 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/css/style.css
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 682098f1b55e96e59f6bde5d8a6664ef62c9039c7506d175a5c7055b13b74d46

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Last-Modified: Sun, 07 Jul 2024 14:39:29 GMT
Server: nginx
ETag: "668aa8a1-320"
Content-Type: text/css
Cache-Control: max-age=43200
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 800
Expires: Wed, 07 Aug 2024 18:17:54 GMT

GET
H/1.1 200
OK jquery.min.js Show response
185.196.10.78/js/ 95 KB
37 KB 174ms
92ms Script
application/javascript 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/js/jquery.min.js
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Content-Encoding: gzip
Last-Modified: Sun, 07 Jul 2024 14:39:30 GMT
Server: nginx
ETag: W/"668aa8a2-17b90"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200
Connection: keep-alive
Expires: Wed, 07 Aug 2024 18:17:54 GMT

GET
H/1.1 200
OK clipboard.min.js Show response
185.196.10.78/js/ 10 KB
4 KB 170ms
88ms Script
application/javascript 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/js/clipboard.min.js
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: e13c416d636e63fe34bb68ff15694645a79b4ae6be1d74890fca98956ca7fb68

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Content-Encoding: gzip
Last-Modified: Sun, 07 Jul 2024 14:39:30 GMT
Server: nginx
ETag: W/"668aa8a2-29ba"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200
Connection: keep-alive
Expires: Wed, 07 Aug 2024 18:17:54 GMT

GET
H/1.1 200
OK swiper-bundle.min.js Show response
185.196.10.78/js/ 143 KB
45 KB 175ms
93ms Script
application/javascript 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/js/swiper-bundle.min.js
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 9a50081ded4faf8b4b18ff05f2ca6f60ec81624d4e7a153a4b3f0f9ebcb9f668

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Content-Encoding: gzip
Last-Modified: Sun, 07 Jul 2024 14:39:30 GMT
Server: nginx
ETag: W/"668aa8a2-23bef"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200
Connection: keep-alive
Expires: Wed, 07 Aug 2024 18:17:54 GMT

GET
H/1.1 200
OK full-responsive.js Show response
185.196.10.78/js/ 1 KB
883 B 173ms
89ms Script
application/javascript 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/js/full-responsive.js
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 0cef7a818890b47c43975d679a8d1bfb7a2dbf7c7162a514c1b3000b7dd8fcdd

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Content-Encoding: gzip
Last-Modified: Sun, 07 Jul 2024 14:39:30 GMT
Server: nginx
ETag: W/"668aa8a2-4b9"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200
Connection: keep-alive
Expires: Wed, 07 Aug 2024 18:17:54 GMT

GET
H/1.1 200
OK jump.js Show response
185.196.10.78/js/ 1 KB
793 B 174ms
90ms Script
application/javascript 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to

Full URL: http://185.196.10.78/js/jump.js
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 11c979f47b7a8bf883010df00598cb2ddc24ae6086c668c11e16864ebd37221d

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 07 Aug 2024 05:52:03 GMT
Server: nginx
ETag: W/"66b30b83-4a4"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=43200
Connection: keep-alive
Expires: Wed, 07 Aug 2024 18:17:54 GMT

GET
H/1.1 200
OK bg.webp
185.196.10.78/image/ 288 KB
288 KB 88ms
87ms Image
image/webp 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://185.196.10.78/image/bg.webp
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: e2c81f62640949d1ff9aec0b804dbe4c7a58b460f022e43a32081c6aadc20d14

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Last-Modified: Thu, 01 Aug 2024 05:19:55 GMT
Server: nginx
ETag: "66ab1afb-47f06"
Content-Type: image/webp
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 294662

GET
H/1.1 200
OK bg.webp
185.196.10.78/image/m/ 275 KB
275 KB 85ms
85ms Image
image/webp 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://185.196.10.78/image/m/bg.webp
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 7af802cb9aecd2bc227dfc385bf78d34005f7ad8ea06ceeeea352ebcd7c8ce51

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Last-Modified: Wed, 31 Jul 2024 09:31:56 GMT
Server: nginx
ETag: "66aa048c-44c5b"
Content-Type: image/webp
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 281691

GET
H/1.1 200
OK btn1.webp
185.196.10.78/image/ 24 KB
24 KB 85ms
85ms Image
image/webp 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://185.196.10.78/image/btn1.webp
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: 85253548a360b17799e57150acf83f73787554dc09172b92b3b44bbd39c08030

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Last-Modified: Wed, 31 Jul 2024 09:17:46 GMT
Server: nginx
ETag: "66aa013a-5e69"
Content-Type: image/webp
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24169

GET
H/1.1 200
OK btn2.webp
185.196.10.78/image/ 24 KB
24 KB 83ms
83ms Image
image/webp 185.196.10.78
SWISSNETWORK02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://185.196.10.78/image/btn2.webp
Requested by: Host: 185.196.10.78
URL: http://185.196.10.78/
Protocol: HTTP/1.1
Server: 185.196.10.78 , United Kingdom, ASN42624 (SWISSNETWORK02, SC),
Reverse DNS
Software: nginx /
Resource Hash: ef359e60ab0537fe4fdf26b992838eef0ea71d7bb4d7023538104def9aef6980

Request headers

Referer: http://185.196.10.78/
User-Agent: Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36

Response headers

Date: Wed, 07 Aug 2024 06:17:54 GMT
Last-Modified: Wed, 31 Jul 2024 09:17:47 GMT
Server: nginx
ETag: "66aa013b-5fa3"
Content-Type: image/webp
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24483

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.thegardensalc.com/	1970-01-20 22:38:17	Name: __cf_mw_byp Value: SoljYRiu7sy8hZFMTmCRaQ1Ir6X1LEb_NYUm3F512x0-1723011469-0.0.1.1-/kvtoto-10/

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: http://185.196.10.78/(Line 5) Message: The key "77rabbit" is not recognized and ignored.
rendering	warning	URL: http://185.196.10.78/(Line 8) Message: Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

77rabbitz.top
cdn.jsdelivr.net
static.cloudflareinsights.com
thegardensalc.com
static.cloudflareinsights.com
172.67.141.4
172.67.203.86
185.196.10.78
2606:4700::6812:bb1f
0cef7a818890b47c43975d679a8d1bfb7a2dbf7c7162a514c1b3000b7dd8fcdd
11c979f47b7a8bf883010df00598cb2ddc24ae6086c668c11e16864ebd37221d
27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe
682098f1b55e96e59f6bde5d8a6664ef62c9039c7506d175a5c7055b13b74d46
688cb414b563ec9aa0c8e34576f8f4b6e1c22cf368b59523b5dac751394915ad
6f5df11db42901379fb6811239d7e0d0f5c698a57f65ae51fa991eabe3b81b17
7af802cb9aecd2bc227dfc385bf78d34005f7ad8ea06ceeeea352ebcd7c8ce51
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
85253548a360b17799e57150acf83f73787554dc09172b92b3b44bbd39c08030
9a50081ded4faf8b4b18ff05f2ca6f60ec81624d4e7a153a4b3f0f9ebcb9f668
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
d6284aaa458ddb76ccd7202781a95862815750b4387db99cf6097d8fd3757afe
e13c416d636e63fe34bb68ff15694645a79b4ae6be1d74890fca98956ca7fb68
e2c81f62640949d1ff9aec0b804dbe4c7a58b460f022e43a32081c6aadc20d14
ef359e60ab0537fe4fdf26b992838eef0ea71d7bb4d7023538104def9aef6980
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

185.196.10.78 Open in urlscan Pro 185.196.10.78 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

33 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

772 kBTransfer

1116 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

2 Console Messages

Security Headers

Indicators

185.196.10.78 Open in urlscan Pro
185.196.10.78 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

33 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

772 kB
Transfer

1116 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!