![](/screenshots/61ca56c7-4ebe-4f36-a0b8-dd7080fa0311.png)
zabz.detnb.ru
Open in
urlscan Pro
104.21.18.150
Malicious Activity!
Public Scan
Effective URL: https://zabz.detnb.ru/Mme@urmum
Submission: On April 26 via manual from GB — Scanned from GB
Summary
TLS certificate: Issued by GTS CA 1P5 on March 31st 2023. Valid for: 3 months.
This is the only time zabz.detnb.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.18.37.36 104.18.37.36 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 185.235.178.12 185.235.178.12 | 204196 (ABELOHOST) (ABELOHOST) | |
7 | 104.21.18.150 104.21.18.150 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 7 | 104.18.6.185 104.18.6.185 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 4 |
ASN204196 (ABELOHOST, NL)
PTR: manyishganb.com
zsw.pattydeaconessfabgud.cloud |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
cloudflare.com
1 redirects
challenges.cloudflare.com — Cisco Umbrella Rank: 4009 |
113 KB |
7 |
detnb.ru
zabz.detnb.ru |
120 KB |
1 |
pattydeaconessfabgud.cloud
zsw.pattydeaconessfabgud.cloud |
220 B |
1 |
klarna.com
1 redirects
l.klarna.com — Cisco Umbrella Rank: 541148 |
364 B |
16 | 4 |
Domain | Requested by | |
---|---|---|
7 | challenges.cloudflare.com |
1 redirects
zabz.detnb.ru
challenges.cloudflare.com zsw.pattydeaconessfabgud.cloud |
7 | zabz.detnb.ru |
zabz.detnb.ru
zsw.pattydeaconessfabgud.cloud |
1 | zsw.pattydeaconessfabgud.cloud | |
1 | l.klarna.com | 1 redirects |
16 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.detnb.ru GTS CA 1P5 |
2023-03-31 - 2023-06-29 |
3 months | crt.sh |
challenges.cloudflare.com Cloudflare Inc ECC CA-3 |
2022-09-18 - 2023-09-17 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://zabz.detnb.ru/Mme@urmum
Frame ID: D8066F0EA381C4B11BB823E3477E3DBF
Requests: 10 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/09awp/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Frame ID: 55AEE89D63E8891E749D7FA2F647322C
Requests: 6 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://l.klarna.com/22XC?pid=CRM&c=UK_KlarnaDaily_Other_Revenue_MultiMerch_KlarnaDrops_EmailWebhook_221108_V1&af_adset=W1_D0_Email_Fixed.&af_ad=.&af_dp=klarna://&deep_link_value=/deals&af_web_dp=http://zsw.pattydeaconessfabgud.cloud/ur.mum/bWVAdXJtdW0= HTTP 301
- http://zsw.pattydeaconessfabgud.cloud/ur.mum/bWVAdXJtdW0=?pid=CRM&c=UK_KlarnaDaily_Other_Revenue_MultiMerch_KlarnaDrops_EmailWebhook_221108_V1&af_adset=W1_D0_Email_Fixed.&af_ad=.&deep_link_value=%2Fdeals
- https://challenges.cloudflare.com/turnstile/v0/api.js?onload=_cf_chl_turnstile_l&render=explicit HTTP 302
- https://challenges.cloudflare.com/turnstile/v0/b/078c83c1/api.js?onload=_cf_chl_turnstile_l&render=explicit
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
bWVAdXJtdW0=
zsw.pattydeaconessfabgud.cloud/ur.mum/ Redirect Chain
|
0 220 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
Mme@urmum
zabz.detnb.ru/ |
7 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1
zabz.detnb.ru/cdn-cgi/challenge-platform/h/b/orchestrate/managed/ |
148 KB 53 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
transparent.gif
zabz.detnb.ru/cdn-cgi/images/trace/managed/js/ |
42 B 220 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
challenges.cloudflare.com/turnstile/v0/b/078c83c1/ Redirect Chain
|
15 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
be3bfd323cb976a
zabz.detnb.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/594913728:1682507176:c9b55W74kcq0GJMw6nXOJwp6r0lE2_VmYJA5WOzk1bk/7bde6aa67cc77731/ |
115 KB 56 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
2ede24ed-a1c3-4b30-98c0-00aba220f76f
https://zabz.detnb.ru/ |
539 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
QT8CmVtXxkshJGM
zabz.detnb.ru/cdn-cgi/challenge-platform/h/b/pat/7bde6aa67cc77731/1682507818270/8014f2698a63bd23dd25895bce8b5d6b49f315eff3989a40865610230c84e149/ |
1 B 754 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MExnyIbLeaXQLea
zabz.detnb.ru/cdn-cgi/challenge-platform/h/b/img/7bde6aa67cc77731/1682507818270/ |
61 B 348 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
be3bfd323cb976a
zabz.detnb.ru/cdn-cgi/challenge-platform/h/b/flow/ov1/594913728:1682507176:c9b55W74kcq0GJMw6nXOJwp6r0lE2_VmYJA5WOzk1bk/7bde6aa67cc77731/ |
5 KB 4 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/09awp/0x4AAAAAAAAjq6WYeRDKmebM/light/ Frame 55AE |
22 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/ Frame 55AE |
152 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
9bb1524664bea2b
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/346299183:1682503666:YgPAVlBi8BvRJ-JqHnN7Vs2GLqKUfjPprslYBq4W_zU/7bde6ab6cf313865/ Frame 55AE |
81 KB 46 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KdZKHbOF6V9eYXd
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/img/7bde6ab6cf313865/1682507820914/ Frame 55AE |
61 B 142 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
j0rbNtY2R7tdN5V
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/7bde6ab6cf313865/1682507820916/f468f7d92d297a05c9091c4280c54158261ecadddb94195510ed01c8b7c72f33/ Frame 55AE |
1 B 582 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
9bb1524664bea2b
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/346299183:1682503666:YgPAVlBi8BvRJ-JqHnN7Vs2GLqKUfjPprslYBq4W_zU/7bde6ab6cf313865/ Frame 55AE |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- challenges.cloudflare.com
- URL
- https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/346299183:1682503666:YgPAVlBi8BvRJ-JqHnN7Vs2GLqKUfjPprslYBq4W_zU/7bde6ab6cf313865/9bb1524664bea2b
Verdicts & Comments Add Verdict or Comment
Malicious
page.url
Submitted on
April 26th 2023, 11:40:32 am
UTC —
From United Kingdom
Threats:
Phishing
Comment: Generic credentials stealer - Phishing URL.
Fake Microsoft log-in page hosted in web package.
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| _cf_chl_opt function| sendRequest function| _cf_chl_turnstile_l function| _cf_chl_preload function| _cf_chl_enter boolean| _cf_chl_done_ran function| _cf_chl_done function| SHA256 object| _cf_chl_ctx string| prefix object| _ object| turnstile boolean| _cf_chl_turnstile_loaded0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
challenges.cloudflare.com
l.klarna.com
zabz.detnb.ru
zsw.pattydeaconessfabgud.cloud
challenges.cloudflare.com
104.18.37.36
104.18.6.185
104.21.18.150
185.235.178.12
08c91791d18c8b35509f8951ba53b3868ebc91a142f78fb1294aadad03f537c8
1603bdaf89f0fbd37b2dbb79f9abe6ba8fc2770f4529a9d534014692b88d085b
2bca841606ccac8efc4bc17a79ed2d231148929b3f15897cce748dc64e7c0a84
55fa43f2d12d84958a73483d2edf8990720dc94f25d14b6f833fad4cb9a33082
5689dbe3e1a5b35da4c6ce96f0f533c20730375550987d9eda37dd2da47b6f00
6a1dd8f5044ad39fdf36b0e7527e250f627f200d73a65562e6e138a3542b3624
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
700ca08235bf09611295d4be1dec1d835ff7f4c0869b869ade57f373d144149d
c6dcb11f88f62f584a642fa252f3f35605397d7e8e114073d730c6c90c994262
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2b71ce770b2c3eb459cca7219211f1eadafe11a4c5bf42257ac4a4654277d3a
f418842730d282aee35e4090f16ac08d741ada4d34972e86e855de140f5910a1
fae1007ce0ff19dead7e67b463c5ccd561e6f914807eb7de1fc161a5998aebde