fruitgun.ru - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 87.236.16.22, located in Russian Federation and belongs to BEGET-AS, RU. The main domain is fruitgun.ru.

This is the only time fruitgun.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	87.236.16.22 87.236.16.22	198610 (BEGET-AS) (BEGET-AS)
4	2a00:1450:400... 2a00:1450:4001:820::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
7	3

1 87.236.16.22 (Russian Federation)

ASN198610 (BEGET-AS, RU)
PTR: ssl.tilda.beget.com

fruitgun.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	gstatic.com ssl.gstatic.com fonts.gstatic.com	57 KB
1	fruitgun.ru fruitgun.ru	25 KB
7	2

	Domain	Requested by
4	ssl.gstatic.com	fruitgun.ru
2	fonts.gstatic.com	fruitgun.ru
1	fruitgun.ru
7	3

This site contains links to these domains. Also see Links.

Domain
accounts.google.com
www.google.com

Subject Issuer	Validity	Valid
*.gstatic.com GTS CA 1O1	`2020-05-20` - `2020-08-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://fruitgun.ru/
Frame ID: 395743ED7EBFC8C67BB3A1EC1F5D7BC9
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

7
Requests

86 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

82 kB
Transfer

156 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://accounts.google.com/signin/usernamerecovery?continue=https%3A%2F%2Fsites.google.com%2Fview%2Fgermaneretr134%2F&hl=ru
Title: Найти аккаунт

Search URL Search Domain Scan URL

URL: https://accounts.google.com/AccountChooser?continue=https%3A%2F%2Fsites.google.com%2Fview%2Fgermaneretr134%2F&followup=https%3A%2F%2Fsites.google.com%2Fview%2Fgermaneretr134%2F
Title: Войти в другой аккаунт

Search URL Search Domain Scan URL

URL: https://accounts.google.com/SignUp?continue=https%3A%2F%2Fsites.google.com%2Fview%2Fgermaneretr134%2F
Title: Создать аккаунт

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/ru/about
Title: Всё о Google

Search URL Search Domain Scan URL

URL: https://accounts.google.com/TOS?loc=RU&hl=ru&privacy=true
Title: Политика конфиденциальности

Search URL Search Domain Scan URL

URL: https://accounts.google.com/TOS?loc=RU&hl=ru
Title: Условия

Search URL Search Domain Scan URL

URL: http://www.google.com/support/accounts?hl=ru
Title: Справка

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
fruitgun.ru/ 73 KB
25 KB 1397ms
1275ms Document
text/html 87.236.16.22
BEGET-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://fruitgun.ru/
Protocol: HTTP/1.1
Server: 87.236.16.22 , Russian Federation, ASN198610 (BEGET-AS, RU),
Reverse DNS: ssl.tilda.beget.com
Software: nginx-reuseport/1.13.4 / PHP/7.0.33
Resource Hash: 402ed66979c99de3b136ce7fbd2cf66c0b5fbc813d3e568677177b34a23b9fb8

Request headers

Host: fruitgun.ru
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx-reuseport/1.13.4
Date: Sat, 06 Jun 2020 18:04:08 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=30
Vary: Accept-Encoding
X-Powered-By: PHP/7.0.33
Content-Encoding: gzip

GET
H2 200 avatar_2x.png
ssl.gstatic.com/accounts/ui/ 626 B
714 B 31ms
9ms Image
image/png 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/accounts/ui/avatar_2x.png

Requested by

Host: fruitgun.ru
URL: http://fruitgun.ru/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fruitgun.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 18 May 2020 23:23:58 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 1622410
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 626
x-xss-protection: 0
expires: Tue, 18 May 2021 23:23:58 GMT

GET
H2 200 universal_language_settings-21.png
ssl.gstatic.com/images/icons/ui/common/ 199 B
288 B 31ms
8ms Image
image/png 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/images/icons/ui/common/universal_language_settings-21.png

Requested by

Host: fruitgun.ru
URL: http://fruitgun.ru/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://fruitgun.ru/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 17 May 2020 05:11:02 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 1774386
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 199
x-xss-protection: 0
expires: Mon, 17 May 2021 05:11:02 GMT

GET
H2 200 googlelogo_color_112x36dp.png
ssl.gstatic.com/images/branding/googlelogo/1x/ 2 KB
3 KB 23ms
7ms Image
image/png 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/images/branding/googlelogo/1x/googlelogo_color_112x36dp.png

Requested by

Host: fruitgun.ru
URL: http://fruitgun.ru/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ecd5e18216a965021f794cc1fd255767f8437ce1dd6c6c2ff4ceea7ccc0073d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sites.google.com/view/germaneretr134/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 15 May 2020 19:33:49 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 1895419
vary: Origin
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2449
x-xss-protection: 0
expires: Sat, 15 May 2021 19:33:49 GMT

GET
H2 200 wlogostrip_230x17_1x.png
ssl.gstatic.com/accounts/ui/ 4 KB
4 KB 19ms
8ms Image
image/png 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.gstatic.com/accounts/ui/wlogostrip_230x17_1x.png

Requested by

Host: fruitgun.ru
URL: http://fruitgun.ru/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05cdc120325f04f53e3ec7dbba877500d94db5a47e38fb6a2cc96fa3d1d7664c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://sites.google.com/view/germaneretr134/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 18 May 2020 00:54:57 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 10:15:00 GMT
server: sffe
age: 1703351
content-type: image/png
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4285
x-xss-protection: 0
expires: Tue, 18 May 2021 00:54:57 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN_r8OVuhs.ttf
fonts.gstatic.com/s/opensans/v15/ 38 KB
25 KB 7ms
6ms Font
font/ttf 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v15/mem5YaGs126MiZpBA-UN_r8OVuhs.ttf

Requested by

Host: fruitgun.ru
URL: http://fruitgun.ru/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

624b8ba56f3fb80b93f2036ed86c0d50864bca58f1c9f033c0bf4e76636cc560

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://sites.google.com/view/germaneretr134/
Origin: http://fruitgun.ru

Response headers

date: Mon, 18 May 2020 23:03:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1623621
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25340
x-xss-protection: 0
last-modified: Wed, 11 Oct 2017 21:49:30 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 May 2021 23:03:47 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFUZ0e.ttf
fonts.gstatic.com/s/opensans/v15/ 37 KB
24 KB 8ms
7ms Font
font/ttf 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v15/mem8YaGs126MiZpBA-UFUZ0e.ttf

Requested by

Host: fruitgun.ru
URL: http://fruitgun.ru/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b119c61e413676a35bc72225185721e20315ec490030518984ae240f8b4f3a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://sites.google.com/view/germaneretr134/
Origin: http://fruitgun.ru

Response headers

date: Fri, 22 May 2020 19:35:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1290491
status: 200
alt-svc: h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24699
x-xss-protection: 0
last-modified: Wed, 11 Oct 2017 21:49:37 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 May 2021 19:35:57 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
fruitgun.ru
ssl.gstatic.com
2a00:1450:4001:800::2003
2a00:1450:4001:820::2003
87.236.16.22
05cdc120325f04f53e3ec7dbba877500d94db5a47e38fb6a2cc96fa3d1d7664c
402ed66979c99de3b136ce7fbd2cf66c0b5fbc813d3e568677177b34a23b9fb8
59404af2d92c53ad1ee9e21b252c07c77dcba810b248a79d6ae989b1ff63c7d6
624b8ba56f3fb80b93f2036ed86c0d50864bca58f1c9f033c0bf4e76636cc560
9ecd5e18216a965021f794cc1fd255767f8437ce1dd6c6c2ff4ceea7ccc0073d
b119c61e413676a35bc72225185721e20315ec490030518984ae240f8b4f3a32
cdcc6d6dcda827a694dce8bfa9a1ab41113b629ef1cc11f886866af9194c81d0

fruitgun.ru Open in urlscan Pro 87.236.16.22 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

67 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

82 kBTransfer

156 kBSize

0 Cookies

7 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

0 Cookies

Indicators

fruitgun.ru Open in urlscan Pro
87.236.16.22 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

82 kB
Transfer

156 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!