viralbuzz.ru
Open in
urlscan Pro
199.116.250.70
Malicious Activity!
Public Scan
Effective URL: https://viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/
Submission: On October 26 via manual from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on September 26th 2018. Valid for: 3 months.
This is the only time viralbuzz.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OneDrive (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 40.70.21.212 40.70.21.212 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
1 11 | 199.116.250.70 199.116.250.70 | 46549 (GVO) (GVO - Global Virtual Opportunities) | |
1 | 23.111.9.35 23.111.9.35 | 33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group) | |
1 | 2400:cb00:204... 2400:cb00:2048:1::6813:c597 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
13 | 4 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
40.70.21.212 |
ASN46549 (GVO - Global Virtual Opportunities, US)
PTR: gvo25070.gvodatacenter.com
viralbuzz.ru |
ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
use.fontawesome.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
viralbuzz.ru
1 redirects
viralbuzz.ru |
492 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
fontawesome.com
use.fontawesome.com |
12 KB |
13 | 3 |
Domain | Requested by | |
---|---|---|
11 | viralbuzz.ru |
1 redirects
viralbuzz.ru
|
1 | cdnjs.cloudflare.com |
viralbuzz.ru
|
1 | use.fontawesome.com |
viralbuzz.ru
|
13 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
viralbuzz.ru cPanel, Inc. Certification Authority |
2018-09-26 - 2018-12-25 |
3 months | crt.sh |
*.fontawesome.com DigiCert SHA2 Secure Server CA |
2018-09-17 - 2019-11-21 |
a year | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-22 - 2019-03-31 |
6 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/
Frame ID: C13FD4DAD2F5C4EA8941A65133917861
Requests: 13 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://40.70.21.212/ Page URL
-
https://viralbuzz.ru/axcio~%40%23%24%25%21%2A%26%28%2A%2A%28%2A%21~%40%23%24%25%21%2A%26%28%2A%2A...
HTTP 301
https://viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/ Page URL
Detected technologies
Windows Server (Operating Systems) ExpandDetected patterns
- headers server /IIS(?:\/([\d.]+))?/i
IIS (Web Servers) Expand
Detected patterns
- headers server /IIS(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://40.70.21.212/ Page URL
-
https://viralbuzz.ru/axcio~%40%23%24%25%21%2A%26%28%2A%2A%28%2A%21~%40%23%24%25%21%2A%26%28%2A%2A%28%2A%21~%40%23%24%25%21%2A%26%28%2A%2A%28%2A
HTTP 301
https://viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
40.70.21.212/ |
192 B 417 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap1.min.css
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/css/ |
141 KB 142 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style1.css
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/css/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
all.css
use.fontawesome.com/releases/v5.2.0/css/ |
46 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.2.1.min.js
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap1.min.js
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/js/ |
48 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
particles.js
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/js/ |
44 KB 44 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.js
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
landing-devices-bg.jpg
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/images/ |
157 KB 157 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
outlook.png
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office.png
viralbuzz.ru/axcio~@%23$%25!*&(**(*!~@%23$%25!*&(**(*!~@%23$%25!*&(**(*/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OneDrive (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Popper object| bootstrap function| pJS function| hexToRgb function| clamp function| isInArray function| requestAnimFrame function| cancelRequestAnimFrame object| pJSDom function| particlesJS0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
use.fontawesome.com
viralbuzz.ru
199.116.250.70
23.111.9.35
2400:cb00:2048:1::6813:c597
40.70.21.212
1500514adf9e666a3d20530815df881bc94812c6906a53bd4c216d051d18c372
17f02fdb590800c9a21e2b6166f5f22cc54952d58897f09d8e82bb9195bc2071
19ba8ce8ded4a23b0fe9e4e9cd17e4a62070712fc6cecf2444d376c2a74eef7d
19efb99f169ab05fa1d7d1e1d55759a8d1ad21eefa0c6298a04795db1c7d328e
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
91c7fd9b189fb2bbfe70dc02fb4744d0f53eff91c6947dcb42de1fe8d0002163
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b00834c17c50af103e353ef86a69d90bbcaa819ed92b4d6ed670a425514e3c3a
c4b6ed2645519ec2c128badb2a2e7720052f8441ffa94c4f0bceca02311004da
c86c4a6731077f1994a8caeccb1fc06477ea35a5b6abbb4abde1d06b8ef9ff32
e3b4881910e4899e61b0098a7aa971bfea0cb3947a6baa7a413ca386a286500d
f93368b1c355be81e86f9c91b868a8fdc79f9966f4abe9e1e3a6d0d28e423120