![](/screenshots/737e0661-a7bf-4ca1-838d-874258605398.png)
www.ozonerev.ru
Open in
urlscan Pro
2606:4700:3034::ac43:ba0c
Malicious Activity!
Public Scan
Effective URL: https://www.ozonerev.ru/DE_zdf-bitcoin/?offer_id=521&aff_id=1057&aff_sub=7c40cf29927f49e0a5871ae2f2d7d197&aff_sub2=67058...
Submission: On March 13 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by E1 on February 16th 2024. Valid for: 3 months.
This is the only time www.ozonerev.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Investment Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2a00:1450:400... 2a00:1450:4001:82a::201b | 15169 (GOOGLE) (GOOGLE) | |
2 | 62.210.31.169 62.210.31.169 | 12876 (Online SAS) (Online SAS) | |
1 1 | 34.107.201.120 34.107.201.120 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
23 | 2606:4700:303... 2606:4700:3034::ac43:ba0c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
28 | 4 |
ASN15169 (GOOGLE, US)
storage.googleapis.com |
ASN12876 (Online SAS, FR)
PTR: 62-210-31-169.yaamail.com
duplus.info |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 120.201.107.34.bc.googleusercontent.com
www.disincorzu.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
ozonerev.ru
www.ozonerev.ru |
918 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 228 |
46 KB |
2 |
duplus.info
duplus.info |
1 KB |
1 |
disincorzu.com
1 redirects
www.disincorzu.com |
556 B |
1 |
googleapis.com
storage.googleapis.com — Cisco Umbrella Rank: 303 |
709 B |
28 | 5 |
Domain | Requested by | |
---|---|---|
23 | www.ozonerev.ru |
duplus.info
www.ozonerev.ru |
2 | cdnjs.cloudflare.com |
www.ozonerev.ru
|
2 | duplus.info |
storage.googleapis.com
duplus.info |
1 | www.disincorzu.com | 1 redirects |
1 | storage.googleapis.com | |
28 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
storage.googleapis.com GTS CA 1C3 |
2024-02-19 - 2024-05-13 |
3 months | crt.sh |
ozonerev.ru E1 |
2024-02-16 - 2024-05-16 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.ozonerev.ru/DE_zdf-bitcoin/?offer_id=521&aff_id=1057&aff_sub=7c40cf29927f49e0a5871ae2f2d7d197&aff_sub2=670583&aff_sub3=13&aff_sub4=571-7444&aff_sub5=Lenabankbreak&aff_click_id=1704-7471-139
Frame ID: 579C076FC3AE9E413CA200FCD4DAD7A5
Requests: 28 HTTP requests in this frame
Screenshot
![](/screenshots/737e0661-a7bf-4ca1-838d-874258605398.png)
Page Title
ZDFmediathek - Die jüngste Investition von Lena hat Experten beunruhigt und große Banken zittern lassenPage URL History Show full URLs
- https://storage.googleapis.com/dgujrytkj/poerlfi.html Page URL
- http://duplus.info/4lVITL7444ewbw571epireoazpq1704PFZHWRXPVVXXQTG7471/139u13 Page URL
- http://duplus.info/t/4lVITL7444ewbw571epireoazpq1704PFZHWRXPVVXXQTG7471/139u13 Page URL
-
https://www.disincorzu.com/2CS97TPBZ/9W8K3ZH/?sub1=13&sub2=571-7444&sub3=1704-7471-139
HTTP 302
https://www.ozonerev.ru/DE_zdf-bitcoin/?offer_id=521&aff_id=1057&aff_sub=7c40cf29927f49e0a5871ae2f2d... Page URL
Detected technologies
Detected patterns
- moment(?:\.min)?\.js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://storage.googleapis.com/dgujrytkj/poerlfi.html Page URL
- http://duplus.info/4lVITL7444ewbw571epireoazpq1704PFZHWRXPVVXXQTG7471/139u13 Page URL
- http://duplus.info/t/4lVITL7444ewbw571epireoazpq1704PFZHWRXPVVXXQTG7471/139u13 Page URL
-
https://www.disincorzu.com/2CS97TPBZ/9W8K3ZH/?sub1=13&sub2=571-7444&sub3=1704-7471-139
HTTP 302
https://www.ozonerev.ru/DE_zdf-bitcoin/?offer_id=521&aff_id=1057&aff_sub=7c40cf29927f49e0a5871ae2f2d7d197&aff_sub2=670583&aff_sub3=13&aff_sub4=571-7444&aff_sub5=Lenabankbreak&aff_click_id=1704-7471-139 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
poerlfi.html
storage.googleapis.com/dgujrytkj/ |
242 B 709 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
139u13
duplus.info/4lVITL7444ewbw571epireoazpq1704PFZHWRXPVVXXQTG7471/ |
458 B 711 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
139u13
duplus.info/t/4lVITL7444ewbw571epireoazpq1704PFZHWRXPVVXXQTG7471/ |
298 B 551 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.ozonerev.ru/DE_zdf-bitcoin/ Redirect Chain
|
74 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/ |
95 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
moment.min.js
cdnjs.cloudflare.com/ajax/libs/moment.js/2.18.1/ |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cegrc1o7f3llvodpyray.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jgc2qdsl7f0wbpyk9nap.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
62 KB 62 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jwccfgscfkwc894gdtcg.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
23 KB 23 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dyxpm6j17qfnmnhj9rdc.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
37 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
xjfu04hzwv1fubhhu6l7.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
82 KB 82 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ulprhvedsgozq6r6gy8t.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
91 KB 92 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
l4tebgz5cuohroqtccyi.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
96 KB 97 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
step1.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
92 KB 93 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
step.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
28 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
step3.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
34 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
l7kp6sagzvgjamrhi0w8.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
14 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ainicniusbw2nyx3hlfi.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
110 KB 110 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
xo0rgoorgbynpgw4kyqp.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ooo3goob2pv5nlmdwwas.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
28 KB 28 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jfn5vt9dszilcurtwjlo.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
37 KB 37 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
wy3fkittrrlvgut3odp2.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
29 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
kdsy10yyahownwemccbo.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
27 KB 27 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
checkmark.png
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
341 B 811 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
n4donflljypzf0jwaysp.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hiqtte24snwgkglyozuw.jpg
www.ozonerev.ru/DE_zdf-bitcoin/assets/ |
26 KB 26 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Investment Scam (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| moment object| dayNames object| monthNames object| now2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.disincorzu.com/ | Name: uniqueClick_9W8K3ZH Value: f9c6a13f-9e90-475c-af51-b22489362a38:1710327356 |
|
www.disincorzu.com/ | Name: transaction_id Value: 7c40cf29927f49e0a5871ae2f2d7d197 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
duplus.info
storage.googleapis.com
www.disincorzu.com
www.ozonerev.ru
2606:4700:3034::ac43:ba0c
2606:4700::6811:190e
2a00:1450:4001:82a::201b
34.107.201.120
62.210.31.169
0f3a07f36d6bddee418f7d7548bc165b09817e10764a359d2773388cdec9ff8a
12a07516a9f031c17efe69cc7af142fa2ee0e3f598fa2ccf3355e5c4d016801e
12b99c7e0e1276cfb628a3262addb666b328c2b2103a61a65276f5397b8e6355
34e9721b7dd959abbcf2550c0e7466b1b4b574b6a192e7104dc61fd151e9778a
366ad4833759e25882be6e4bda26ff2c41d2b4e7abf5407ea116db7cffadd3a4
41df49a648ccd2386a5e32c674dc5979c069ec87359fb60aaec80eabec26c614
62a8860ba398e1cf4ad7bfe6c4fb757d3a35e672133ec0f04974afaeed954e9f
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
7080960827e86452ae31d6c3f46184c38114ab3e2c620b1548b368faec027faa
7a1521dd1aa24a81cd8d81de20b0cf93ac00256a93d3229fe842e4bc97ff1f50
83294d9755b784dcdd40202480359f828eacac3a0edd11647c26761ab56575a2
83d701bcb601f5363e1fe9da6a2ed3111d4fdc42c784d14c3c1d954abafd4082
8a45f19b688a0004e406f8d2d2b6333ea0ed2aca5e2d8f0e230356932ebcf124
960dd53b6f1e87e621300a289985b2a40b4b0b2ab59a5ea15a46619b7c75f298
9c6d97f1438bf8a9b440a190d26505b91c0848becdcf86f348757b72602baeb9
abfcb1683ba86df7a394fa39d6691eb207910eba690609687009a06e671c720e
ac7551b4605eaa98e14e210a1095d759f31443c3558313ffb7830843201cb1ff
ad7ac574660d64cfe9ae8b3f42ff972e2fcf949923887f5cbb50b118be31321b
b5a1641d9b3d5e75233f3fa0c444055d82ba06b9438582f533ba6638a3cd9398
bce535ef3c40a99c5e9bc7e701ac62332e089c1205f18e95a6ef0f88a149f921
bf5189504db2989e3793ea49c8896d16257f1c7c4e3ae1764e6b25e946c33ea2
d618d4869738e0dc22360f0ec0cbb6433257843f24723fac240dda0906685238
dc53f22b9736425cddef5735bceb510e4b182302b371b3bcce99fdc44c897149
e9d04e4fbd1f7c6a052cccf0588ed2c6ea41af104c59c70baaa10d8e0f5715a8
f23ac6edba4f2f195f4729054aab90e20c1324f2e82e49d6630e455d90b3bb12
f462d3a1e8980262d49048bba0c93026ddb913f5d6aaf143ccc24eca599a8bb9
f6bd6a6b49896da68970bd62dc8c05c2de2e82b70862894950ffc937fa80793e