zinestrawary.com
Open in
urlscan Pro
85.17.80.5
Malicious Activity!
Public Scan
Effective URL: https://zinestrawary.com/click.php?key=af2526ld6d62tfbr35cm&click_id=buciijk7p54670hls0ug&bid=0&placement_id=2953233&camp...
Submission: On October 28 via manual from ES
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 26th 2020. Valid for: 3 months.
This is the only time zinestrawary.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Apple Software Update (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 31.220.27.135 31.220.27.135 | 39572 (ADVANCEDH...) (ADVANCEDHOSTERS-AS) | |
1 1 | 94.130.88.225 94.130.88.225 | 24940 (HETZNER-AS) (HETZNER-AS) | |
12 | 85.17.80.5 85.17.80.5 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
1 | 2a00:1450:400... 2a00:1450:4001:803::200a | 15169 (GOOGLE) (GOOGLE) | |
15 | 3 |
ASN24940 (HETZNER-AS, DE)
PTR: static.225.88.130.94.clients.your-server.de
click9.gosyncrise.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
zinestrawary.com
zinestrawary.com |
152 KB |
2 |
viimad.com
s.viimad.com |
19 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
gosyncrise.com
1 redirects
click9.gosyncrise.com |
371 B |
15 | 4 |
Domain | Requested by | |
---|---|---|
12 | zinestrawary.com |
s.viimad.com
zinestrawary.com |
2 | s.viimad.com |
s.viimad.com
|
1 | ajax.googleapis.com |
zinestrawary.com
|
1 | click9.gosyncrise.com | 1 redirects |
15 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
viimad.com Let's Encrypt Authority X3 |
2020-09-03 - 2020-12-02 |
3 months | crt.sh |
zinestrawary.com Let's Encrypt Authority X3 |
2020-10-26 - 2021-01-24 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-10-06 - 2020-12-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zinestrawary.com/click.php?key=af2526ld6d62tfbr35cm&click_id=buciijk7p54670hls0ug&bid=0&placement_id=2953233&campaign_id=8568&site_id=60&creative_id=8411&age=1&rc=1&mc=1&bid=0&rn=0
Frame ID: 105EF1B8AFBC124A61727DB5A768960E
Requests: 15 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://s.viimad.com/h/nphhsxez3jnxt7gnygdge4fwz7opl6watzkgov2rkrafyeqhafvgfge5v6ovkeb2zi4za2e2k6... Page URL
-
http://click9.gosyncrise.com/ie?v=3&c=gyBiHUatc9vwoCqnt0acaIuRi8WOF-MbpYzanbP61qTDFq6jycMmpDPyUXv_t6_Ettf...
HTTP 301
https://zinestrawary.com/click.php?key=af2526ld6d62tfbr35cm&click_id=buciijk7p54670hls0ug&bid=0&place... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://s.viimad.com/h/nphhsxez3jnxt7gnygdge4fwz7opl6watzkgov2rkrafyeqhafvgfge5v6ovkeb2zi4za2e2k6qyiz7apha2eoprncznnt6lqhuzxbll6bed72sx35viculsxrj25fff4ox3bne6v542iu5osss6hl5qwspk66oukcb4z5gmkhpus4h2pjlbo27znmwkmtkktfjhbvcrsxhnmm66jseljg3zsri6v2x5u5nz2sddk55yyunhuoj7wx5pjdmfhecxkmvhcyn7toyeu4oxqfgeuoljo6nfpr6pm3qhtou5h32gqx76hmf2iulmcrbhrilixljers3dtn45yuh5q7433lfqwspk66koaqzg2cctmf5hsbjvj54weadrlmpwe6d5kj6uaz3gbbsf6blffrzvkm2knrtq2l3zrk3mxep677q7o6aqzg537oklbfrfb2cxal3ozqgbvgyljhvppegnfoxfhnjnp3nhrwvipk5ny5eewns6gf5r66d2msoovlmvg5wgkq3ajdynaviyu6tdi6zc4mkratkaciuasufiz7lnf6gj2hvrhkar4j6vo76vlymgybcg?u=http%3A%2F%2Fclick9.gosyncrise.com%2Fie%3Fv%3D3%26c%3DgyBiHUatc9vwoCqnt0acaIuRi8WOF-MbpYzanbP61qTDFq6jycMmpDPyUXv_t6_EttfZfjioD3tV643Sz6opGD1MSP6XXTmNenr5n3TKZtvjZuaxyryEuBg4z-S-XEHn8ui-4fGSiJBD1aDUZmYPchkL6hUwOLOp-ksI9SHhBURDD4pS2o2QU6UJEfMD72V-Puyv4vCdiRbEJgyKvKsRgZ4WbdZqYNYKg09u6xOAKY2wsvCVw0nU2qvTKxqWogFGFOuez70j60ItRDCRCSQXCJWHJYY3M_6bNBkpOu0IAWztpTbCyq7FkTVMY0nDBXDSnmM6OfF_CARhPMhJUs6hj1eL-G1oRyiFyPUYwwyDgTKT_QVFd41IYbcvG2eln1Iq7hHTe2jBDLssEfXUr5qwWorG9PnlqFZwuIMAyeIJ9kqFg26lmcgFrXgk5r88gOjfyDEV7o6rFNpq9E7XWamXjD8NaiOy_4fFJyb_5Rl29L1lrTxH1w1soNMI8lhNBxLXEaBLOIHWlYx4gHilScTZYDGQg_Fp_R1Zk8amqPdbt-OP05SJMMEDKdnpZA%3D%3D Page URL
-
http://click9.gosyncrise.com/ie?v=3&c=gyBiHUatc9vwoCqnt0acaIuRi8WOF-MbpYzanbP61qTDFq6jycMmpDPyUXv_t6_EttfZfjioD3tV643Sz6opGD1MSP6XXTmNenr5n3TKZtvjZuaxyryEuBg4z-S-XEHn8ui-4fGSiJBD1aDUZmYPchkL6hUwOLOp-ksI9SHhBURDD4pS2o2QU6UJEfMD72V-Puyv4vCdiRbEJgyKvKsRgZ4WbdZqYNYKg09u6xOAKY2wsvCVw0nU2qvTKxqWogFGFOuez70j60ItRDCRCSQXCJWHJYY3M_6bNBkpOu0IAWztpTbCyq7FkTVMY0nDBXDSnmM6OfF_CARhPMhJUs6hj1eL-G1oRyiFyPUYwwyDgTKT_QVFd41IYbcvG2eln1Iq7hHTe2jBDLssEfXUr5qwWorG9PnlqFZwuIMAyeIJ9kqFg26lmcgFrXgk5r88gOjfyDEV7o6rFNpq9E7XWamXjD8NaiOy_4fFJyb_5Rl29L1lrTxH1w1soNMI8lhNBxLXEaBLOIHWlYx4gHilScTZYDGQg_Fp_R1Zk8amqPdbt-OP05SJMMEDKdnpZA==
HTTP 301
https://zinestrawary.com/click.php?key=af2526ld6d62tfbr35cm&click_id=buciijk7p54670hls0ug&bid=0&placement_id=2953233&campaign_id=8568&site_id=60&creative_id=8411&age=1&rc=1&mc=1&bid=0&rn=0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
nphhsxez3jnxt7gnygdge4fwz7opl6watzkgov2rkrafyeqhafvgfge5v6ovkeb2zi4za2e2k6qyiz7apha2eoprncznnt6lqhuzxbll6bed72sx35viculsxrj25fff4ox3bne6v542iu5osss6hl5qwspk66oukcb4z5gmkhpus4h2pjlbo27znmwkmtkktfjhb...
s.viimad.com/h/ |
47 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
click.php
zinestrawary.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
index
s.viimad.com/cnt/api/ |
0 143 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
zinestrawary.com/landers/blue_white_2/ |
5 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
zinestrawary.com/landers/blue_white_2/ |
95 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0-logo.jpg
zinestrawary.com/landers/blue_white_2/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
search.png
zinestrawary.com/landers/blue_white_2/ |
631 B 869 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
win-overlay.png
zinestrawary.com/landers/blue_white_2/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dreq.png
zinestrawary.com/landers/blue_white_2/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cross.png
zinestrawary.com/landers/blue_white_2/ |
344 B 582 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tick.png
zinestrawary.com/landers/blue_white_2/ |
381 B 619 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ajax2.gif
zinestrawary.com/landers/blue_white_2/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.png
zinestrawary.com/landers/blue_white_2/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.mp3
zinestrawary.com/landers/blue_white_2/ |
16 KB 16 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Apple Software Update (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| $ function| jQuery function| getURLParameter object| w object| m object| td2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
zinestrawary.com/ | Name: uclickhash Value: u3bzirho-u3bzirho-nt1n-kt1n-175m0-wfoj0-y9e8wj-bd9e8c |
|
zinestrawary.com/ | Name: uclick Value: u3bzirho |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
click9.gosyncrise.com
s.viimad.com
zinestrawary.com
2a00:1450:4001:803::200a
31.220.27.135
85.17.80.5
94.130.88.225
0aca5e6ac88c6c6f705fe8f77c9830630e8ea7d22ff06ce7d4d2fd25f7b050c1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
37e0435378f92ff39e2cea7b04e01b3d55430ecf53edd90c2288edfe12eadd55
3d520d6c4219bd80b31b9607f51622a3b2980eac46e149216ed5348cc7d74855
562b29e08c7d623d3604b9fce91a6715c5f3d14ce62fee4e3c806b72528402ce
5a54ff1f189090954bc51ef197b0c3615cda8a5473466253db5acdf4451f1878
5b5e9eae5931e881567bab9db481dd50c356d24a6956035b73957e1cfdccf3c9
655e75b5f9a75e8aac6a6b7da84720daae348194b525518e4b47b5c580b0b316
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
8e65c9d3060370944dfd7cbd20cb45952d6d0b40c1a742b2b2048e6d6e475682
8f353892cfafea3aea0577c45d1d393c42a9d771ac069922151c94396209d527
9b1192a77adc835c1665f249fd08384d10a447271925e6d81fcdc8fdfba7771e
a4b2b465b45b670914e799ffc44f0a237e59b0a8957b20c7c95f77bc81212b6b
ed5ffc658eaf4e04edf3c08a94d35ff7bee0c5be95eda88bcb60c239986c5c2c