e-mail.flash-fantasy.ru
Open in
urlscan Pro
2a00:15f8:a000:5:1:12:4:2d9c
Malicious Activity!
Public Scan
Submission: On April 30 via automatic, source openphish
Summary
This is the only time e-mail.flash-fantasy.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AOL (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:15f8:a00... 2a00:15f8:a000:5:1:12:4:2d9c | 25532 (MASTERHOS...) (MASTERHOST-AS Moscow) | |
11 | 2606:2800:233... 2606:2800:233:af6:eab:2108:1892:6d8 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
6 | 195.93.85.179 195.93.85.179 | 1668 (AOL-ATDN) (AOL-ATDN - AOL Transit Data Network) | |
1 | 52.48.142.133 52.48.142.133 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 66.235.148.65 66.235.148.65 | 15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.) | |
1 | 95.100.248.105 95.100.248.105 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
29 | 7 |
ASN25532 (MASTERHOST-AS Moscow, Russia, RU)
e-mail.flash-fantasy.ru |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
s.aolcdn.com | |
o.aolcdn.com |
ASN1668 (AOL-ATDN - AOL Transit Data Network, US)
PTR: snsproxy-shared-frr.evip.aol.com
sns-static.aolcdn.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-48-142-133.eu-west-1.compute.amazonaws.com
dpm.demdex.net |
ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: *.d2.sc.omtrdc.net
o.sa.aol.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a95-100-248-105.deploy.akamaitechnologies.com
b.scorecardresearch.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
aolcdn.com
s.aolcdn.com sns-static.aolcdn.com o.aolcdn.com |
462 KB |
2 |
aol.com
cdn.webmail.aol.com Failed o.sa.aol.com |
157 B |
2 |
flash-fantasy.ru
e-mail.flash-fantasy.ru b.flash-fantasy.ru Failed |
6 KB |
1 |
scorecardresearch.com
b.scorecardresearch.com |
|
1 |
demdex.net
dpm.demdex.net |
217 B |
0 |
atwola.com
Failed
at.atwola.com Failed cdn.at.atwola.com Failed |
|
29 | 6 |
Domain | Requested by | |
---|---|---|
10 | s.aolcdn.com |
e-mail.flash-fantasy.ru
|
6 | sns-static.aolcdn.com |
e-mail.flash-fantasy.ru
|
2 | o.sa.aol.com |
s.aolcdn.com
e-mail.flash-fantasy.ru |
2 | e-mail.flash-fantasy.ru | |
1 | b.scorecardresearch.com |
e-mail.flash-fantasy.ru
|
1 | dpm.demdex.net |
e-mail.flash-fantasy.ru
|
1 | o.aolcdn.com |
e-mail.flash-fantasy.ru
|
0 | cdn.at.atwola.com Failed |
s.aolcdn.com
|
0 | b.flash-fantasy.ru Failed |
e-mail.flash-fantasy.ru
|
0 | at.atwola.com Failed |
s.aolcdn.com
|
0 | cdn.webmail.aol.com Failed |
e-mail.flash-fantasy.ru
|
29 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.aol.com |
aol.com |
help.channels.aol.com |
adinfo.aol.com |
i.aol.com |
lifestore.aol.com |
www.corp.aol.com |
privacy.aol.com |
legal.aol.com |
daol.aol.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
o.aolcdn.com DigiCert SHA2 High Assurance Server CA |
2016-06-29 - 2019-07-10 |
3 years | crt.sh |
sns-static.aolcdn.com DigiCert SHA2 High Assurance Server CA |
2017-04-14 - 2020-04-22 |
3 years | crt.sh |
This page contains 4 frames:
Primary Page:
http://e-mail.flash-fantasy.ru/
Frame ID: 27623.1
Requests: 27 HTTP requests in this frame
Frame:
https://at.atwola.com/adiframe/3.0/5113.1/221794/0/-1/size=1200x800;noperf=1;alias=93464624;kvpg=e-mail.flash-fantasy.ru;kvugc=0;kvh5lsid=0;kvdom=e-mail.flash-fantasy.ru;kvpage=1b8495165875c02e0a2614dbe29807d702bbc06a;kvmn=93464624;kvgrp=514177261;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=0;grp=514177261
Frame ID: 27623.2
Requests: 1 HTTP requests in this frame
Frame:
http://cdn.at.atwola.com/_media/uac/guid.html
Frame ID: 27623.3
Requests: 1 HTTP requests in this frame
Frame:
http://cdn.at.atwola.com/_media/uac/tcode3.html
Frame ID: 27623.4
Requests: 1 HTTP requests in this frame
13 Outgoing links
These are links going to different origins than the main page.
Title: Help article.
Search URL Search Domain Scan URL
Title:
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Forgot password?
Search URL Search Domain Scan URL
Title: Get a Free Username
Search URL Search Domain Scan URL
Title: Erase Hard Drive Junk Now
Search URL Search Domain Scan URL
Title: AOL Inc.
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: About Our Ads
Search URL Search Domain Scan URL
Title: Site Map
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request 20- http://dpm.demdex.net/id?d_rtbd=json&d_ver=2&d_verify=1&d_orgid=6B25357E519160E40A490D44%40AdobeOrg&d_cb=s_c_il%5B1%5D._setMarketingCloudFields
- http://dpm.demdex.net/id/rd?d_rtbd=json&d_ver=2&d_verify=1&d_orgid=6B25357E519160E40A490D44%40AdobeOrg&d_cb=s_c_il%5B1%5D._setMarketingCloudFields
- http://b.scorecardresearch.com/b?rn=86527965&C1=2&C2=1000009&C4=http%3A%2F%2Fe-mail.flash-fantasy.ru%2F&C5=us.snssignin&C7=http%3A%2F%2Fe-mail.flash-fantasy.ru%2F&C8=AOL%20Mail%3A%20Simple%2C%20Fre...
- http://b.scorecardresearch.com/b2?rn=86527965&C1=2&C2=1000009&C4=http%3A%2F%2Fe-mail.flash-fantasy.ru%2F&C5=us.snssignin&C7=http%3A%2F%2Fe-mail.flash-fantasy.ru%2F&C8=AOL%20Mail%3A%20Simple%2C%20Fr...
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
e-mail.flash-fantasy.ru/ |
20 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ad_1200.js
s.aolcdn.com/os/landingpages/js/ |
279 B 208 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ready.min.js
s.aolcdn.com/os/landingpages/js/ |
485 B 338 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
snslanding.js
s.aolcdn.com/os/landingpages/js/sns_v11r11_1/ |
2 KB 710 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
snslanding.css
s.aolcdn.com/os/landingpages/css/sns_v11r11_1/ |
595 KB 379 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9-ad_1200.css
s.aolcdn.com/os/landingpages/css/ |
0 0 |
Stylesheet
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hdr_err.css
s.aolcdn.com/os/landingpages/css/ |
676 B 353 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lpUiStyles.css
sns-static.aolcdn.com/sns.v16r4_1/style/ |
13 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
module.css
cdn.webmail.aol.com/resources/core/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error.gif
s.aolcdn.com/os/landingpages/images/ |
1021 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol_logo_new_sm.gif
s.aolcdn.com/os/landingpages/images/ |
989 B 998 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adsWrapper.js
s.aolcdn.com/ads/ |
48 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lpUi.js
sns-static.aolcdn.com/sns.v16r4_1/js/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
util.js
sns-static.aolcdn.com/sns.v16r4_1/js/ |
12 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lp-aol-head-lg.png
sns-static.aolcdn.com/sns.v16r4_1/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AC_OETags.js
sns-static.aolcdn.com/sns.v16r4_1/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fs.js
sns-static.aolcdn.com/sns.v16r4_1/js/ |
1 KB 796 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
110 KB 0 |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
s.aolcdn.com/os_merge/ |
80 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adchoices.png
o.aolcdn.com/ads/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
size=1200x800;noperf=1;alias=93464624;kvpg=e-mail.flash-fantasy.ru;kvugc=0;kvh5lsid=0;kvdom=e-mail.flash-fantasy.ru;kvpage=1b8495165875c02e0a2614dbe29807d702bbc06a;kvmn=93464624;kvgrp=514177261;kvi...
at.atwola.com/adiframe/3.0/5113.1/221794/0/-1/ Frame 2762 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Cookie set
rd
dpm.demdex.net/id/ Redirect Chain
|
218 B 217 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
id
o.sa.aol.com/ |
114 B 114 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s89990756149219
o.sa.aol.com/b/ss/aolsnssignin/1/JS-1.4.3/ |
43 B 43 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b2
b.scorecardresearch.com/ Redirect Chain
|
0 0 |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
b.flash-fantasy.ru/vanity/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
guid.html
cdn.at.atwola.com/_media/uac/ Frame 2762 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
tcode3.html
cdn.at.atwola.com/_media/uac/ Frame 2762 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
ping
b.flash-fantasy.ru/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
e-mail.flash-fantasy.ru/ |
209 B 201 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cdn.webmail.aol.com
- URL
- https://cdn.webmail.aol.com/resources/core/css/module.css
- Domain
- at.atwola.com
- URL
- https://at.atwola.com/adiframe/3.0/5113.1/221794/0/-1/size=1200x800;noperf=1;alias=93464624;kvpg=e-mail.flash-fantasy.ru;kvugc=0;kvh5lsid=0;kvdom=e-mail.flash-fantasy.ru;kvpage=1b8495165875c02e0a2614dbe29807d702bbc06a;kvmn=93464624;kvgrp=514177261;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=0;grp=514177261
- Domain
- b.flash-fantasy.ru
- URL
- http://b.flash-fantasy.ru/vanity/?ts=1493514177818&h=e-mail.flash-fantasy.ru&v=58&r=&l=0&k=1&m=1600x1200&bd=1583x1132&tz=0&ms=504&da_pr=1&da_ar=null&t=AOL%20Mail%3A%20Simple%2C%20Free%2C%20Fun&dL_ch=us.snssignin&dL_dpt=ssologin&fv=25.0&ads_grp=514177261&dL_abp=0&dL_sDpt=sso%20%3A%20&dL_hnu=1&pgvis=1&pgid=e-mail.flash-fantasy.ru1b8495165875c02e0a2614dbe29807d702bbc06a
- Domain
- cdn.at.atwola.com
- URL
- http://cdn.at.atwola.com/_media/uac/guid.html
- Domain
- cdn.at.atwola.com
- URL
- http://cdn.at.atwola.com/_media/uac/tcode3.html
- Domain
- b.flash-fantasy.ru
- URL
- http://b.flash-fantasy.ru/ping?ts=1493514178513&h=e-mail.flash-fantasy.ru&v=58&r=&l=0&k=1&m=1600x1200&bd=1583x1132&tz=0&ms=1199&da_pr=1&da_ar=null&t=AOL%20Mail%3A%20Simple%2C%20Free%2C%20Fun&nm=SNS%20Premium%20Link%2012&dL_ch=us.snssignin&dL_dpt=ssologin&fv=25.0&ads_grp=514177261&dL_abp=0&dL_sDpt=sso%20%3A%20&pageName=aol%20mail&pgvis=1
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AOL (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.flash-fantasy.ru/ | Name: s_cc Value: true |
|
.flash-fantasy.ru/ | Name: AMCV_6B25357E519160E40A490D44%40AdobeOrg Value: 1256414278%7CMCMID%7C52191217406924409370903490735331632439%7CMCAAMLH-1494118977%7C6%7CMCAAMB-1494118977%7CNRX38WO0n5BH8Th-nqAG_A%7CMCAID%7CNONE |
|
.at.atwola.com/ | Name: APIDTS Value: 1493514178 |
|
.atwola.com/ | Name: CfP Value: 1 |
|
.atwola.com/ | Name: JEB2 Value: 590537126E650F1FCD7C86EAF40E280A |
|
.flash-fantasy.ru/ | Name: s_pers Value: %20s_getnr%3D1493514177482-New%7C1556586177482%3B%20s_nrgvo%3DNew%7C1556586177484%3B |
|
.at.atwola.com/ | Name: ATTACID Value: a3Z0aWQ9VVBjMDIxZDkwMS0yZDQwLTExZTctYTE2Ni0wMDE2M2U1ZTBjZTY= |
|
.at.atwola.com/ | Name: APID Value: UPc021d901-2d40-11e7-a166-00163e5e0ce6 |
|
.e-mail.flash-fantasy.ru/ | Name: _vdl Value: 1 |
|
e-mail.flash-fantasy.ru/ | Name: Value: testcookie |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
at.atwola.com
b.flash-fantasy.ru
b.scorecardresearch.com
cdn.at.atwola.com
cdn.webmail.aol.com
dpm.demdex.net
e-mail.flash-fantasy.ru
o.aolcdn.com
o.sa.aol.com
s.aolcdn.com
sns-static.aolcdn.com
at.atwola.com
b.flash-fantasy.ru
cdn.at.atwola.com
cdn.webmail.aol.com
195.93.85.179
2606:2800:233:af6:eab:2108:1892:6d8
2a00:15f8:a000:5:1:12:4:2d9c
52.48.142.133
66.235.148.65
95.100.248.105
07981e5b5f4c84246a00de0212f7f4af17cae9e45c4bdf357ced2cad8a1bbc32
0ded4262649075a423901ff9ac63a84d53a7acdaa88292f54b884f45c21f1e2c
32c36d23f6e33422f1fe05ec4f0d2d9701b097ae6f3fd090114d98474808622a
3641d275ec9df661aa0e75017d3129712e8e298d5613bbad1f1ed47276e6de21
754d851f37baf4b424f4d86d668755d7d2b042534f96b3de0b27e6ce3b095392
7b7f3134eed58dd58a821beb9efee2aa329eba63ed478fab19bd80701a156896
98ea9aa66c97e340045e3a67e5e7cfc68f637ffe11fe999f92e6e8497eeb76dd
9c93744806c44a40497f708dac0dcc389729ad044d647995e7ae4d0639a3cba6
9d7244692af31fd3d779002b0670fbdd1a2937be52fee1c73cbd0dadbce5d1b8
9f1774fd4436d906d1534570ac7055031f20a30ffc945ff3f3d2022cd217f965
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b6682cab65d3243b5b75efb7279dbf49491957484780f2ba0a87632cc0e25642
b6fbd0e1845aebb3bf513537eb3d8dae360ea4b5d2e225ab22679da9bb75292c
ca06cc86362548d949921dec1eb8c62696b3710d9654c81699b83e9060fe74b3
cdf8f02e1a267481eae66506327050db6d1afc32cad4cf4a8111c368238fbd89
cfbbfc1e621e6729702da3e7d17d189bc745c95d2f90555ee019155bf8aec264
d0e899759cfa8a636fd6ff15c7f4aed191e24f82307500ebf7efa1732d0c52c2
da5eaf73a812166dceb10169b7ea8fa621efe3107e0bc04d27a7374d18a77fd8
db3e1ed756f54826d4011d2230eace15b816b6f98197c4e43a84d5e8c9937304
dcee5312b1a816445dcc424a72970ad633f4fdf67d35dd1e80beb3579f7b399f
ddae6d3eb90e6652daa591e4363bc52d269c1e100643c97a376611b7adbc9367
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef879d396f3a90cb3d68cba878c3359aedff62de30d51cc37d147e78c9dfae46