![](/screenshots/ad82739f-ee6c-4b13-9213-0b3b495993d2.png)
www.mrcrest.ru
Open in
urlscan Pro
2606:4700:3031::ac43:d168
Malicious Activity!
Public Scan
Effective URL: https://www.mrcrest.ru/it2-new/?MPC_4=90af7c5b1aa54654b4739f943ff294e3&MPC_3=670459&MPC_1=e0c04e8817df46ca88708d1fb3001...
Submission: On June 08 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by E1 on May 21st 2022. Valid for: 3 months.
This is the only time www.mrcrest.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Investment Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 132.145.103.136 132.145.103.136 | 31898 (ORACLE-BM...) (ORACLE-BMC-31898) | |
1 1 | 46.182.19.9 46.182.19.9 | 43847 (NBISERV-AS) (NBISERV-AS) | |
1 1 | 34.117.93.76 34.117.93.76 | 15169 (GOOGLE) (GOOGLE) | |
26 | 2606:4700:303... 2606:4700:3031::ac43:d168 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
29 | 2 |
ASN15169 (GOOGLE, US)
PTR: 76.93.117.34.bc.googleusercontent.com
www.zzatrk-4.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
mrcrest.ru
www.mrcrest.ru |
1 MB |
3 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 206 |
154 KB |
1 |
zzatrk-4.com
1 redirects
www.zzatrk-4.com |
505 B |
1 |
firingcloud.com
1 redirects
www.firingcloud.com |
610 B |
29 | 4 |
Domain | Requested by | |
---|---|---|
26 | www.mrcrest.ru |
www.mrcrest.ru
|
3 | cdnjs.cloudflare.com |
www.mrcrest.ru
cdnjs.cloudflare.com |
1 | www.zzatrk-4.com | 1 redirects |
1 | www.firingcloud.com | 1 redirects |
29 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.mrcrest.ru E1 |
2022-05-21 - 2022-08-19 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.mrcrest.ru/it2-new/?MPC_4=90af7c5b1aa54654b4739f943ff294e3&MPC_3=670459&MPC_1=e0c04e8817df46ca88708d1fb3001486&MPC_2=2263&so=BitcoinEra&sub=EMMA&ai=2958049&ci=142&gi=44
Frame ID: E798D5CB328CF0A22433BC395DEA18CB
Requests: 29 HTTP requests in this frame
Screenshot
![](/screenshots/ad82739f-ee6c-4b13-9213-0b3b495993d2.png)
Page Title
RAPPORTO SPECIALE: l'ultimo investimento di Emma Marrone ha lasciato gli esperti a bocca aperta e spaventato le banchePage URL History Show full URLs
-
http://132.145.103.136/YXBwL3JlZGlyZWN0aW9uL3dyYXAucGhwP3RyYWNrPUExWEMyNTQxM1hSMlhNNjlYUzIzMTkyWFYz...
HTTP 302
https://www.firingcloud.com/4MPNPD4/R5M46WR/?creative_id=10294&s1=2&s2=315&s3=30945&s4=25413&s5= HTTP 302
https://www.zzatrk-4.com/2CS3L858S/3Q4DPF4/?sub1=e0c04e8817df46ca88708d1fb3001486&sub2=2263&s3=30945&... HTTP 302
https://www.mrcrest.ru/it2-new/?MPC_4=90af7c5b1aa54654b4739f943ff294e3&MPC_3=670459&MPC_1=e0c04e881... Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://132.145.103.136/YXBwL3JlZGlyZWN0aW9uL3dyYXAucGhwP3RyYWNrPUExWEMyNTQxM1hSMlhNNjlYUzIzMTkyWFYzNzY2OFhOOFhPNDI0WFczWFAyNlhMMzE1WFUzMDk0NVhUMVhaWA==
HTTP 302
https://www.firingcloud.com/4MPNPD4/R5M46WR/?creative_id=10294&s1=2&s2=315&s3=30945&s4=25413&s5= HTTP 302
https://www.zzatrk-4.com/2CS3L858S/3Q4DPF4/?sub1=e0c04e8817df46ca88708d1fb3001486&sub2=2263&s3=30945&s4=25413&s5=&s1=2&s2=315 HTTP 302
https://www.mrcrest.ru/it2-new/?MPC_4=90af7c5b1aa54654b4739f943ff294e3&MPC_3=670459&MPC_1=e0c04e8817df46ca88708d1fb3001486&MPC_2=2263&so=BitcoinEra&sub=EMMA&ai=2958049&ci=142&gi=44 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.mrcrest.ru/it2-new/ Redirect Chain
|
45 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/ |
287 KB 72 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
37 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.mrcrest.ru/it2-new/assets/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
www.mrcrest.ru/it2-new/assets/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
J-01.jpg
www.mrcrest.ru/it2-new/assets/ |
48 KB 48 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
socialmediabar.png
www.mrcrest.ru/it2-new/assets/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
J-02.jpg
www.mrcrest.ru/it2-new/assets/ |
41 KB 42 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jv-logo.jpg
www.mrcrest.ru/it2-new/assets/ |
27 KB 27 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
muskbranson.jpg
www.mrcrest.ru/it2-new/assets/ |
60 KB 61 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dreamcar.jpg
www.mrcrest.ru/it2-new/assets/ |
53 KB 54 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Silvio.jpg
www.mrcrest.ru/it2-new/assets/ |
60 KB 60 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
everydayprofit_euro.gif
www.mrcrest.ru/it2-new/assets/ |
571 KB 572 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cheque.jpg
www.mrcrest.ru/it2-new/assets/ |
57 KB 58 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
step1-IT.jpg
www.mrcrest.ru/it2-new/assets/ |
100 KB 100 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
step2-IT.jpg
www.mrcrest.ru/it2-new/assets/ |
35 KB 36 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
step3-IT-updated2.jpg
www.mrcrest.ru/it2-new/assets/ |
28 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side1.png
www.mrcrest.ru/it2-new/assets/ |
32 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side2.png
www.mrcrest.ru/it2-new/assets/ |
32 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side3.png
www.mrcrest.ru/it2-new/assets/ |
35 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side4.png
www.mrcrest.ru/it2-new/assets/ |
25 KB 26 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side5.png
www.mrcrest.ru/it2-new/assets/ |
36 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side6.png
www.mrcrest.ru/it2-new/assets/ |
32 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
side7.png
www.mrcrest.ru/it2-new/assets/ |
28 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s1.jpg
www.mrcrest.ru/it2-new/assets/ |
100 KB 100 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s2.jpg
www.mrcrest.ru/it2-new/assets/ |
35 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
s3.jpg
www.mrcrest.ru/it2-new/assets/ |
28 KB 29 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
footer-logo2.png
www.mrcrest.ru/it2-new/assets/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Investment Scam (Online)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| $ function| jQuery string| today string| dd string| mm number| yyyy function| countdown string| url2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.zzatrk-4.com/ | Name: uniqueClick_3Q4DPF4 Value: 914de63f-08d0-484a-979f-ccc79b5863fe:1654691428 |
|
www.zzatrk-4.com/ | Name: transaction_id Value: 90af7c5b1aa54654b4739f943ff294e3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
www.firingcloud.com
www.mrcrest.ru
www.zzatrk-4.com
132.145.103.136
2606:4700:3031::ac43:d168
2606:4700::6811:180e
34.117.93.76
46.182.19.9
10da4f8c0459798518feab11a3f819f4bc224dbaf20d1f04e0b0928b20def957
1b7e0a2736aeb5f656f8b9cc2fda4b3eb2ea212d2f344dae9b7792136c9c5562
2f49a4d346bba8856fc81011e853ba8fa7577e209bd9270230dab7e043fec07e
34a2392f2e50678310eccaaeccd567fe85d9db09fee0f3cd22e99bbc8f602986
3601b2b3e1bfc6103e6928e26fb91fcd81af615110134402771df0fe09e4aefd
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
39b49cd7b3f12e9a828ad58f5381f166152acbbf1800445c332d936338a19a8e
430f36f9b5f21aae8cc9dca6a81c4d3d84da5175eaedcf2fdc2c226302cb3575
5b4a5e55877c317edb9fee432ec87c4e84421440ccc7de4a39e74eb949f5f43b
5c7b24b739cec4e33ddbd6593f844473853a03aadeb88621eaa8c1d5ddab9ccc
7d4cf9fec92331e6d46db371d7fe1483ecc6ca3d05bc180ffe4d8cbd915941e7
8945ef654142be08a6241ccffe2fd93b08a5446da9084353a5874f5e0a4950e4
896892e2fba29eb854a921cf1804d9b4fc49b62f24668621a0d5fd6f51ea3244
8eb42717ed064abffa8051c7e4051f8b647ef33f935091cac36cf8036e431f13
99563326c935b6bfc617246aa95a64c4a8ba9fc5ae7addca6a9258d83e24d001
a2dd17792e66ec9a086fa9b79735dba63abea040403de7adadd2ca011d69b192
c40a697945c5a6e2ba2a9580c1e681aefff36f4db5866d1e6d6f0314929e63e6
c668475509ca28624f703231b56656c9ccca5227a6ddbccf1faffccfe2c14717
cf2a03b86601f419ab5db89ec02a793b0e7df4d7777e8da49f75175da119e8af
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
dc5719a76b684ffd0f0ffa316289024abd6a6be216f2b40dba80c4fc02376744
dd06d86c324ba751a80ef5d28a9ae4dd9e1ca812d5cb8a68f9f997b110405e86
ea23b76fd49e2e4b7ac6966c136f88025c519df2360ee3320a32840ef95acf39
eda32d3b1abca2905d56e29d97f8c3ad90f5d64ac2faff579899feb94604700b
ee2fca38a5c97861c9bee8607899fa93795d117fbb22d661ba9b63d987e72d95
f049c57eeed01ae537b39921f35b4cb20b52f51e6840dcf09e10813a7c7f39b4
f4cd3aafbcd39299de3a7b2fbf85d8bffdc035eb40a4f27228ed2166aee4b324
ff6a6dac2501bc3ef21eac79501d69ae1e94796f207b70bee9427234d0ae0500