vkblack.ru Open in urlscan Pro
91.217.9.164 Malicious Activity! Public Scan

URL:
http://vkblack.ru/v/index3.php
Submission: On March 14 via api (March 14th 2017, 8:22:16 pm UTC) from CA

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 14 HTTP transactions. The main IP is 91.217.9.164, located in Moscow, Russian Federation and belongs to SELECTEL , RU. The main domain is vkblack.ru.

This is the only time vkblack.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Vkontakte (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
7	91.217.9.164 91.217.9.164	49505 (SELECTEL ) (SELECTEL )
1	217.69.133.145 217.69.133.145	47764 (MAILRU-AS...) (MAILRU-AS Mail.Ru)
14	3

7 91.217.9.164 (Moscow, Russian Federation)

ASN49505 (SELECTEL , RU)
PTR: s06-2.mx.webhost1.ru

vkblack.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 217.69.133.145 (Russian Federation)

ASN47764 (MAILRU-AS Mail.Ru, RU)
PTR: topf8.l.smailru.net

top-fwz1.mail.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	vkblack.ru vkblack.ru	74 KB
1	mail.ru top-fwz1.mail.ru	4 KB
0	vk.com Failed vk.com Failed
0	vk.me Failed st0.vk.me Failed st1.vk.me Failed st2.vk.me Failed
14	4

	Domain	Requested by
7	vkblack.ru	vkblack.ru
1	top-fwz1.mail.ru	vkblack.ru
0	vk.com Failed	vkblack.ru
0	st2.vk.me Failed	vkblack.ru
0	st1.vk.me Failed	vkblack.ru
0	st0.vk.me Failed	vkblack.ru
14	6

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://vkblack.ru/v/index3.php
Frame ID: 15246.1
Requests: 13 HTTP requests in this frame

Frame: http://vk.com/login.php?act=slogin&auto=1&to=&s=0
Frame ID: 15246.4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

14
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

3
IPs

1
Countries

77 kB
Transfer

96 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request 11

https://login.vk.com/?role=al_frame&_origin=http://vk.com&ip_h=da2a7d253d5b31923d
http://vk.com/login.php?act=slogin&auto=1&to=&s=0

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index3.php Show response
vkblack.ru/v/ 21 KB
8 KB 120ms
72ms Document
text/html 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL: http://vkblack.ru/v/index3.php
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash: 70acd08b32e98d37ef4a69fae28a086cd1481ec690723159b293d937b1cdba6e

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK Cookie set code.js Show response
top-fwz1.mail.ru/js/ 9 KB
4 KB 107ms
53ms Script
application/javascript 217.69.133.145
MAILRU-AS Mail.Ru

General

Check archive.org

Show headers Download Go to

Full URL

http://top-fwz1.mail.ru/js/code.js

Requested by

Host: vkblack.ru
URL: http://vkblack.ru/v/index3.php

Protocol

HTTP/1.1

Server

217.69.133.145 , Russian Federation, ASN47764 (MAILRU-AS Mail.Ru, RU),

Reverse DNS

topf8.l.smailru.net

Software

nginx /

Resource Hash

8b6978c55e3f17c10d85a4da21aef1b054e81944833b24bc24dd8cc35cad45b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: top-fwz1.mail.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 03 Mar 2017 09:55:49 GMT
Server: nginx
ETag: W/"58b93da5-24f9"
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: application/javascript
Cache-Control: max-age=43200, private
Set-Cookie: FTID=2K-osg1N-hXZ:1489522929::::; path=/; expires=Thu, 15-Mar-18 20:22:09 GMT; domain=.mail.ru
Keep-Alive: timeout=60

GET common.css
st0.vk.me/css/al/ 0
0

GET index.css
st0.vk.me/css/al/ 0
0

GET
H/1.1 404
Not Found loader_nav17453_0.js
vkblack.ru/js/ 0
0 48ms
47ms Script
text/html 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL: http://vkblack.ru/js/loader_nav17453_0.js
Requested by: Host: vkblack.ru
URL: http://vkblack.ru/v/index3.php
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Server: nginx
Connection: keep-alive
Content-Length: 13
Content-Type: text/html

GET common.js
st1.vk.me/js/al/ 0
0

GET
H/1.1 200
OK lang0_0.js Show response
vkblack.ru/js/ 0
0 96ms
47ms Script
application/javascript 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL: http://vkblack.ru/js/lang0_0.js?6627
Requested by: Host: vkblack.ru
URL: http://vkblack.ru/v/index3.php
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: */*
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Last-Modified: Sat, 17 Dec 2016 09:14:57 GMT
Server: nginx
ETag: "58550211-0"
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 0
Expires: Thu, 13 Apr 2017 20:22:09 GMT

GET index.js
st2.vk.me/js/al/ 0
0

GET aes_light.js
st2.vk.me/js/al/ 0
0

GET
H/1.1 200
OK prof_m.png
vkblack.ru/images/join/ 25 KB
25 KB 48ms
48ms Image
image/png 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://vkblack.ru/images/join/prof_m.png?4
Requested by: Host: vkblack.ru
URL: http://vkblack.ru/v/index3.php
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash: e09f0133af32021c4e28db075e4c7101ce96b8736454bbe9926febfc2c4ec11b

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Last-Modified: Sat, 12 Mar 2016 11:41:07 GMT
Server: nginx
ETag: "56e40053-6370"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25456
Expires: Thu, 13 Apr 2017 20:22:09 GMT

GET
H/1.1 200
OK news_m.png
vkblack.ru/images/join/ 21 KB
21 KB 49ms
48ms Image
image/png 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://vkblack.ru/images/join/news_m.png?4
Requested by: Host: vkblack.ru
URL: http://vkblack.ru/v/index3.php
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash: 397bced1feb84f385b03850a441d1bbb3c292f1d67b6013742187b75a29e2ce4

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Last-Modified: Sat, 12 Mar 2016 11:41:06 GMT
Server: nginx
ETag: "56e40052-5423"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21539
Expires: Thu, 13 Apr 2017 20:22:09 GMT

GET
H/1.1 200
OK dial_m.png
vkblack.ru/images/join/ 19 KB
19 KB 100ms
50ms Image
image/png 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://vkblack.ru/images/join/dial_m.png?4
Requested by: Host: vkblack.ru
URL: http://vkblack.ru/v/index3.php
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash: 9ffd221363db281f142c22775ee09c76312040c585ecc92b0141b325ac40cb06

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Last-Modified: Sat, 12 Mar 2016 11:41:06 GMT
Server: nginx
ETag: "56e40052-4b81"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19329
Expires: Thu, 13 Apr 2017 20:22:09 GMT

GET

https://login.vk.com/?role=al_frame&_origin=http://vk.com&ip_h=da2a7d253d5b31923d
http://vk.com/login.php?act=slogin&auto=1&to=&s=0

0
0

GET
H/1.1 200
OK faviconnew.ico
vkblack.ru/images/ 1 KB
1 KB 51ms
50ms Other
image/x-icon 91.217.9.164
SELECTEL

General

Check archive.org

Show headers Download Go to

Full URL: http://vkblack.ru/images/faviconnew.ico?3
Protocol: HTTP/1.1
Server: 91.217.9.164 Moscow, Russian Federation, ASN49505 (SELECTEL , RU),
Reverse DNS: s06-2.mx.webhost1.ru
Software: nginx /
Resource Hash: 35f9c9dd568c8c49e9d1adc99dfae841abdccf6cae9344068f3c387465e5704a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch
Host: vkblack.ru
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: http://vkblack.ru/v/index3.php
Connection: keep-alive
Cache-Control: no-cache
Referer: http://vkblack.ru/v/index3.php
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Response headers

Date: Tue, 14 Mar 2017 20:22:09 GMT
Last-Modified: Sat, 12 Mar 2016 11:40:59 GMT
Server: nginx
ETag: "56e4004b-47e"
Content-Type: image/x-icon
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1150
Expires: Thu, 13 Apr 2017 20:22:09 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: st0.vk.me
URL: http://st0.vk.me/css/al/common.css?495

Domain: st0.vk.me
URL: http://st0.vk.me/css/al/index.css?27

Domain: st1.vk.me
URL: http://st1.vk.me/js/al/common.js?1118_144

Domain: st2.vk.me
URL: http://st2.vk.me/js/al/index.js?32

Domain: st2.vk.me
URL: http://st2.vk.me/js/al/aes_light.js?65

Domain: vk.com
URL: http://vk.com/login.php?act=slogin&auto=1&to=&s=0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vkontakte (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

st0.vk.me
st1.vk.me
st2.vk.me
top-fwz1.mail.ru
vk.com
vkblack.ru
st0.vk.me
st1.vk.me
st2.vk.me
vk.com
217.69.133.145
91.217.9.164
35f9c9dd568c8c49e9d1adc99dfae841abdccf6cae9344068f3c387465e5704a
397bced1feb84f385b03850a441d1bbb3c292f1d67b6013742187b75a29e2ce4
70acd08b32e98d37ef4a69fae28a086cd1481ec690723159b293d937b1cdba6e
8b6978c55e3f17c10d85a4da21aef1b054e81944833b24bc24dd8cc35cad45b5
9ffd221363db281f142c22775ee09c76312040c585ecc92b0141b325ac40cb06
e09f0133af32021c4e28db075e4c7101ce96b8736454bbe9926febfc2c4ec11b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

vkblack.ru Open in urlscan Pro 91.217.9.164 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

14 Requests

0 %HTTPS

0 %IPv6

4 Domains

6 Subdomains

3 IPs

1 Countries

77 kBTransfer

96 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

vkblack.ru Open in urlscan Pro
91.217.9.164 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

0 %
HTTPS

0 %
IPv6

4
Domains

6
Subdomains

3
IPs

1
Countries

77 kB
Transfer

96 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!