gtdfghjouiyutrftguhij.rf.gd
Open in
urlscan Pro
185.27.134.175
Malicious Activity!
Public Scan
Effective URL: https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/login.php?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20=
Submission: On February 14 via manual from GB
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 24th 2019. Valid for: 3 months.
This is the only time gtdfghjouiyutrftguhij.rf.gd was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 192.3.2.50 192.3.2.50 | 36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing) | |
1 10 | 185.27.134.175 185.27.134.175 | 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited) | |
12 | 3 |
ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: wgh7.whogohost.com
dupyextrik.site |
ASN34119 (WILDCARD-AS Wildcard UK Limited, GB)
PTR: 17513427185.ifastnet.org
gtdfghjouiyutrftguhij.rf.gd |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
rf.gd
1 redirects
gtdfghjouiyutrftguhij.rf.gd |
661 KB |
2 |
dupyextrik.site
dupyextrik.site |
88 KB |
12 | 2 |
Domain | Requested by | |
---|---|---|
10 | gtdfghjouiyutrftguhij.rf.gd |
1 redirects
dupyextrik.site
gtdfghjouiyutrftguhij.rf.gd |
2 | dupyextrik.site |
dupyextrik.site
|
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dupyextrik.site cPanel, Inc. Certification Authority |
2019-01-28 - 2019-04-28 |
3 months | crt.sh |
gtdfghjouiyutrftguhij.rf.gd Sectigo RSA Domain Validation Secure Server CA |
2019-01-24 - 2019-04-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/login.php?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20=
Frame ID: 0F5E7BCF97C5F550EF7586B4795A43FA
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://dupyextrik.site/087b1413b8b81559549306f55a01ebc3?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20= Page URL
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20= Page URL
-
https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20=&i=1
HTTP 302
https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/login.php?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20= Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://dupyextrik.site/087b1413b8b81559549306f55a01ebc3?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20= Page URL
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20= Page URL
-
https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20=&i=1
HTTP 302
https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/login.php?email=Z3JlZy5oZWNrc2hlckBrZXJyeS5jb20= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 8- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/small.jpg?x=12f4b8b543125cc986c79cd85320812f HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA== HTTP 302
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA==
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
087b1413b8b81559549306f55a01ebc3
dupyextrik.site/ |
3 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
dupyextrik.site/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/ |
902 B 753 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aes.js
gtdfghjouiyutrftguhij.rf.gd/ |
30 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
login.php
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/ Redirect Chain
|
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
conv.min.css
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/css/ |
18 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t3.png
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logn.png
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/ |
523 B 728 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m9.png
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/ |
753 B 958 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
login.php
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
t1.jpg
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/ |
566 KB 567 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
csscheckbox_a4824bcf5d413f078bdd6abd3e6e5bf4.png
gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/ |
895 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- gtdfghjouiyutrftguhij.rf.gd
- URL
- https://gtdfghjouiyutrftguhij.rf.gd/tryuihgiyfkdhgvjkghjytd/images/login.php?email=SW52YWxpZCBFbWFpbA==
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gtdfghjouiyutrftguhij.rf.gd/ | Name: PHPSESSID Value: 9befd46d97803bfab5877c59d78bcb0f |
|
gtdfghjouiyutrftguhij.rf.gd/ | Name: __test Value: e0d583392daf8b9ff723ea939c2a51e0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dupyextrik.site
gtdfghjouiyutrftguhij.rf.gd
gtdfghjouiyutrftguhij.rf.gd
185.27.134.175
192.3.2.50
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
56cb7027c810cf15ff652f8cf0276477c0d1d1820ea060ce4cb13903acc8f3ab
7383a9572a731a91cdf2be979b396d80954e12e2cf46410a99771858d4a20ed4
7764c38d71f5ee52d39f237f08b4e82b4715c73bfa0afbaee30a60b0dfd058ca
7b73f03db4759a9a8cfe2860f5af3f4e9be1101dc03ffba61357960947092bb6
9dd5e031a96cb31830ef2fb13009f70f2001f7204e8e96faf0999821e7dd67eb
a082b1de897c01c874a9adebe1176db62100aeca440a0692a000a1da7b361f2b
c2d5ac2e5a041d4925fd77de1880a678ad3638186f57e0970e0e081c6c8812d4
d2701c86a2a31a641520e72121749dbbabeed4b1a59aece20bbf14f9c9de82bc
e8fc8a8a07adf6262c1a9b88f2d659a35278ac2e23c49c4870fc454a5b44bcc9
eca50169c6fcd9b2177061bd5e2b0021e0bc9954379f4637fdc959c4d2daebac