t4.synergeticwave.sc
Open in
urlscan Pro
2606:4700:3031::6815:4215
Malicious Activity!
Public Scan
Submission Tags: https://phish.report @phish_report Search All
Submission: On July 22 via api from FI — Scanned from FI
Summary
This is the only time t4.synergeticwave.sc was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 2 votes Show Verdicts
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 2606:4700:303... 2606:4700:3031::6815:4215 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 3 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
synergeticwave.sc
t4.synergeticwave.sc |
15 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 3 | 2 |
| Domain | Requested by | |
|---|---|---|
| 2 | t4.synergeticwave.sc |
t4.synergeticwave.sc
|
| 0 | 127.0.0.1 Failed |
t4.synergeticwave.sc
|
| 3 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Frame:
http://127.0.0.1/
Frame ID: 4AF16E7E48F63B4D3A5699E9F6E1940E
Requests: 3 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://t4.synergeticwave.sc/aff_c?offer_id=437&aff_id=1677&aff_sub=deltaairlines&aff_sub3=823080&aff_click_id=733698968&view=e20514d8945697be13e97c5a7c4d5a0d_0 HTTP 302
- http://127.0.0.1/
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
aff_c
t4.synergeticwave.sc/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ads.js
t4.synergeticwave.sc/js/ |
31 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
/
127.0.0.1/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 127.0.0.1
- URL
- http://127.0.0.1/
Verdicts & Comments Add Verdict or Comment
Malicious
page.url
Submitted on
July 23rd 2023, 1:34:58 pm
UTC —
From United States
Threats:
Malware
Unwanted Software
Potentially Harmful Application
Comment: RUSSIAN MALWARE sent by large botnet targeting email addresses obtained from DATA BREACH using malicious websites: http://t4.synergeticwave.sc/aff_c?offer_id=437&aff_id=1677&aff_sub=deltaairlines&aff_sub3=823080&aff_click_id=733795168 https://tatalina.foundation https://tracking.thecreditpros.com https://thecreditpros.com https://maleenhancement.cfd https://www.greywish.com https://www.gq5gn7trk.com https://tryinchagrow.com https://planebale.com
Malicious
page.url
Submitted on
July 22nd 2023, 3:24:54 pm
UTC —
From United States
Threats:
Malware
Unwanted Software
Potentially Harmful Application
Comment: RUSSIAN MALWARE sent by large botnet targeting email addresses obtained from DATA BREACH using malicious websites: http://t4.synergeticwave.sc/aff_c?offer_id=437&aff_id=1677&aff_sub=deltaairlines&aff_sub3=823080&aff_click_id=733698968 https://planebale.com https://planebale.com https://www.greywish.com/
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| t4.synergeticwave.sc/ | Name: C Value: 7edaec8843abb27fb1f0c7d31787faff |
|
| t4.synergeticwave.sc/ | Name: fe9ecf68-6582-48ba-8fd6-8415647123fe-v4 Value: OsZbH1qf6YtSG5BO7lhgfS93tg170VJdAm2Do5Ofvys |
|
| t4.synergeticwave.sc/ | Name: cc-v4 Value: 7EfNldsg3h1fnMbjyIEEMaU7vz7bgRNC1yw9OUwpendXrA1wDsUiR%2FBAfANQDgtAV%2FeumjBZv%2ByLu6%2B6BS%2F9PDqA2McUfMNh4l8DJs2TJz3YjeFv5oSttIgAE1j8bKb3S2PX%2FySQ1%2FF4uWako6dRHg%3D%3D |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
127.0.0.1
t4.synergeticwave.sc
127.0.0.1
2606:4700:3031::6815:4215
86cf05d546e6604dd5cd5d5d5684fe14f6f9af9f1c56235eddd223941b168f0f
d88c72596233ee490491b90016b2949657136d29762153ea2284ac1926adf3a5