kuden-guten-konten.ru
Open in
urlscan Pro
172.67.132.77
Malicious Activity!
Public Scan
Effective URL: https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html
Submission: On July 08 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by WE1 on June 14th 2024. Valid for: 3 months.
This is the only time kuden-guten-konten.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 162.241.203.60 162.241.203.60 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 8 | 2606:4700:303... 2606:4700:3037::ac43:844d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 172.67.132.77 172.67.132.77 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 4 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 162-241-203-60.unifiedlayer.com
armiato.omegamedia.com.br |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
kuden-guten-konten.ru
1 redirects
kuden-guten-konten.ru |
46 KB |
2 |
omegamedia.com.br
1 redirects
armiato.omegamedia.com.br |
579 B |
14 | 2 |
Domain | Requested by | |
---|---|---|
11 | kuden-guten-konten.ru |
1 redirects
kuden-guten-konten.ru
armiato.omegamedia.com.br |
2 | armiato.omegamedia.com.br | 1 redirects |
14 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.armiato.omegamedia.com.br R3 |
2024-05-18 - 2024-08-16 |
3 months | crt.sh |
kuden-guten-konten.ru WE1 |
2024-06-14 - 2024-09-12 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html
Frame ID: 605FF4CFFFE7D13D2D9C9AE5FE473425
Requests: 13 HTTP requests in this frame
Frame:
https://kuden-guten-konten.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/191f93ebdf8e/main.js
Frame ID: 7FFC6F29FC8924DE08209466FCCD6D21
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Suspected phishing site | CloudflarePage URL History Show full URLs
-
https://armiato.omegamedia.com.br/G7A6w/f
HTTP 301
https://armiato.omegamedia.com.br/G7A6w/f/ Page URL
- https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html Page URL
-
https://kuden-guten-konten.ru/cdn-cgi/phish-bypass?atok=Wx_ksdLeeAvRyCPtArv.RZemLgrdXOiLkXYSyeGOf_4-172044...
HTTP 301
https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html Page URL
- https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Learn More
Search URL Search Domain Scan URL
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://armiato.omegamedia.com.br/G7A6w/f
HTTP 301
https://armiato.omegamedia.com.br/G7A6w/f/ Page URL
- https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html Page URL
-
https://kuden-guten-konten.ru/cdn-cgi/phish-bypass?atok=Wx_ksdLeeAvRyCPtArv.RZemLgrdXOiLkXYSyeGOf_4-1720441755-0.0.1.1-%2FSH%2Ft%2Fmrc%2Ftl%2Ftekm.html
HTTP 301
https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html Page URL
- https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://armiato.omegamedia.com.br/G7A6w/f HTTP 301
- https://armiato.omegamedia.com.br/G7A6w/f/
- https://kuden-guten-konten.ru/cdn-cgi/phish-bypass?atok=Wx_ksdLeeAvRyCPtArv.RZemLgrdXOiLkXYSyeGOf_4-1720441755-0.0.1.1-%2FSH%2Ft%2Fmrc%2Ftl%2Ftekm.html HTTP 301
- https://kuden-guten-konten.ru/SH/t/mrc/tl/tekm.html
- https://kuden-guten-konten.ru/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://kuden-guten-konten.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/191f93ebdf8e/main.js
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
armiato.omegamedia.com.br/G7A6w/f/ Redirect Chain
|
167 B 212 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tekm.html
kuden-guten-konten.ru/SH/t/mrc/tl/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
armiato.omegamedia.com.br/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
kuden-guten-konten.ru/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
kuden-guten-konten.ru/cdn-cgi/images/ |
452 B 539 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
kuden-guten-konten.ru/ |
18 KB 19 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tekm.html
kuden-guten-konten.ru/SH/t/mrc/tl/ Redirect Chain
|
7 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
tekm.html
kuden-guten-konten.ru/SH/t/mrc/tl/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
main.js
kuden-guten-konten.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/191f93ebdf8e/ Frame 7FFC Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
kuden-guten-konten.ru/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
tekm.html
kuden-guten-konten.ru/SH/t/mrc/tl/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
kuden-guten-konten.ru/cdn-cgi/styles/ |
23 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
kuden-guten-konten.ru/cdn-cgi/images/ |
452 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
kuden-guten-konten.ru/ |
6 KB 7 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- armiato.omegamedia.com.br
- URL
- https://armiato.omegamedia.com.br/favicon.ico
- Domain
- kuden-guten-konten.ru
- URL
- https://kuden-guten-konten.ru/cdn-cgi/challenge-platform/h/b/scripts/jsd/191f93ebdf8e/main.js?
- Domain
- kuden-guten-konten.ru
- URL
- https://kuden-guten-konten.ru/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _cf_translation11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
kuden-guten-konten.ru/ | Name: kOcps-HTVfUJfbKSFbNPOz2Djvc Value: MKql-uFFxz2OKxlWLDQjz9jiRKo |
|
kuden-guten-konten.ru/ | Name: 6MGW9hPOqdNDEnJirHQS2Zl_U88 Value: 1720441754 |
|
kuden-guten-konten.ru/ | Name: Dv1qmY8spC42KWcgesBcBNj1yhw Value: 1720528154 |
|
kuden-guten-konten.ru/ | Name: eTrJUoMEzIRj2s2LriNp1e5GERA Value: IWFbXbv1dVPMizrwMpLmGIkHU84 |
|
kuden-guten-konten.ru/ | Name: RDooP8uxyywkPegqbhdxAEDHfrg Value: ll0syUnqBzh_Ugb2mCQfnC_XMPc |
|
.kuden-guten-konten.ru/ | Name: __cf_mw_byp Value: Wx_ksdLeeAvRyCPtArv.RZemLgrdXOiLkXYSyeGOf_4-1720441755-0.0.1.1-/SH/t/mrc/tl/tekm.html |
|
kuden-guten-konten.ru/ | Name: B96nUi0mzjsafl6nsHd0fD9z7Pw Value: TIdluAsfJANLD4TELkZA3WVup5I |
|
kuden-guten-konten.ru/ | Name: tiL7rsM82gvirMUhRwABOPrfBwc Value: 1720441758 |
|
kuden-guten-konten.ru/ | Name: NPtFkE-7uguav3If_-rtnnLLuSQ Value: 1720528158 |
|
kuden-guten-konten.ru/ | Name: I6AlOw3rWDhufT6Gy7eSM0swf2s Value: ZxAig5hkdirawZFt2WNl2LMgF_k |
|
kuden-guten-konten.ru/ | Name: S16K3MFhwkgtvZ6u-mdyqaaCld0 Value: jjhZJEy5H1dPmV6tSVwyGoErk1s |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
armiato.omegamedia.com.br
kuden-guten-konten.ru
armiato.omegamedia.com.br
kuden-guten-konten.ru
162.241.203.60
172.67.132.77
2606:4700:3037::ac43:844d
67ffd73e16f3f4180c85e6c5c6e4c286cb725066357b530d38a0339388052076
7cd53ea066c8d7fd3d4bcc5f64ef012967d017c47bcf1ad0faa7b2c8dfafb34b
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8a92355813961139b829054f47c570a35e0ea038c569e9dab83b3766127d37c1
8b722bf466f02087504199b67c8e8c6b6b98367aa67d512dd4677a236f9ea35e
8e9327b15e5f843c97c333098a16bbbbd43a4cb9c0593d8d15a1559336615747
e1780a39e4d6c07447a5e578b05d2f0b888213d7f95f49ded8e2338bc94a242d
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016