![](/screenshots/b59e9ec1-1aff-410c-9e20-b75d0439a095.png)
wa5.ru
Open in
urlscan Pro
2606:4700:3036::ac43:bf27
Malicious Activity!
Public Scan
Submission: On May 16 via manual from DE — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on April 5th 2023. Valid for: 3 months.
This is the only time wa5.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 7 | 2606:4700:303... 2606:4700:3036::ac43:bf27 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
4 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:d63b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:811::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:7b60 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
5 | 146.75.120.193 146.75.120.193 | 54113 (FASTLY) (FASTLY) | |
9 | 2606:4700:303... 2606:4700:3038::6815:eb05 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
31 | 10 |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
imgscdn.ru
imgscdn.ru |
52 KB |
7 |
wa5.ru
2 redirects
wa5.ru — Cisco Umbrella Rank: 830364 |
73 KB |
5 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 5738 |
297 KB |
5 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 231 www.cloudflare.com — Cisco Umbrella Rank: 5301 |
114 KB |
3 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 39 region1.google-analytics.com — Cisco Umbrella Rank: 2495 |
21 KB |
2 |
onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3585 |
71 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62 |
79 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 385 |
31 KB |
31 | 8 |
Domain | Requested by | |
---|---|---|
9 | imgscdn.ru |
wa5.ru
|
7 | wa5.ru |
2 redirects
wa5.ru
|
5 | i.imgur.com |
wa5.ru
|
4 | cdnjs.cloudflare.com |
wa5.ru
cdnjs.cloudflare.com |
2 | www.google-analytics.com |
wa5.ru
www.google-analytics.com |
2 | cdn.onesignal.com |
wa5.ru
cdn.onesignal.com |
1 | region1.google-analytics.com |
www.googletagmanager.com
|
1 | www.cloudflare.com |
wa5.ru
|
1 | www.googletagmanager.com |
wa5.ru
|
1 | ajax.googleapis.com |
wa5.ru
|
31 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wa5.ru GTS CA 1P5 |
2023-04-05 - 2023-07-04 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-04-24 - 2023-07-17 |
3 months | crt.sh |
www.cloudflare.com Cloudflare Inc ECC CA-3 |
2022-09-27 - 2023-09-26 |
a year | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2023-03-13 - 2024-03-12 |
a year | crt.sh |
imgscdn.ru GTS CA 1P5 |
2023-05-08 - 2023-08-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://wa5.ru/ZDawoLaY/
Frame ID: 9216744EFFB9BDC7F8C3C06929820989
Requests: 31 HTTP requests in this frame
Screenshot
![](/screenshots/b59e9ec1-1aff-410c-9e20-b75d0439a095.png)
Page Title
Krombacher Vatertag 2023 AktionDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- cdn\.onesignal\.com
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://wa5.ru/ZDawoLaY/index_files/config.js HTTP 302
- https://wa5.ru/fatkrode/index_files/config.js
- https://wa5.ru/ZDawoLaY/index_files/themecustom.css HTTP 302
- https://wa5.ru/fatkrode/index_files/themecustom.css
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
wa5.ru/ZDawoLaY/ |
87 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global.js
wa5.ru/ZDawoLaY/ |
29 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.0/js/ |
62 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.0/css/ |
158 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
37 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalSDK.js
cdn.onesignal.com/sdks/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
config.js
wa5.ru/fatkrode/index_files/ Redirect Chain
|
31 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
themecustom.css
wa5.ru/fatkrode/index_files/ Redirect Chain
|
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
223 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/ |
284 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
51 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trace
www.cloudflare.com/cdn-cgi/ |
364 B 483 B |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
star.png
wa5.ru/fatkrode/index_files/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 248 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9Q9j3eU.png
i.imgur.com/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2HxCO1t.jpg
i.imgur.com/ |
137 KB 137 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nhdYcwp.png
i.imgur.com/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SLr2fst.png
i.imgur.com/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
82QEZbQ.png
i.imgur.com/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yellow_cover.png
imgscdn.ru/cdn/images/boxes/yellow/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yellow_inner.png
imgscdn.ru/cdn/images/boxes/yellow/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yellow_out.png
imgscdn.ru/cdn/images/boxes/yellow/ |
14 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.jpg
imgscdn.ru/cdn/images/avatars/generic/ |
3 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.jpg
imgscdn.ru/cdn/images/avatars/generic/ |
5 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.jpg
imgscdn.ru/cdn/images/avatars/generic/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.jpg
imgscdn.ru/cdn/images/avatars/generic/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.jpg
imgscdn.ru/cdn/images/avatars/generic/ |
2 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.jpg
imgscdn.ru/cdn/images/avatars/generic/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
3 B 202 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
May 16th 2023, 2:33:22 pm
UTC —
From Germany
Threats:
Phishing
Comment: Fake giveaway that encourages people on WhatsApp to share the phishing link further. Identical to the domain "urlshrt1.ru"
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
85 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| _0x274f function| _0x2fe141 function| _0x2a8a object| googleIDs object| domesticAppsArray function| $ function| jQuery object| bootstrap function| OneSignal function| _0x40c0 function| makeSequence function| _0x4361 function| populateClasses object| _0x5a47 function| _0x34a9 function| _0x263ba0 function| _0x34da function| _0x3687 function| _0x44eda2 string| GoogleAnalyticsObject function| ga function| _0x3d0c function| getRandomInt function| _0x3814 function| _0x4c7371 function| _0x53a0 function| _0x73cd function| _0x3db5 function| _0x3ab9 function| _0x1b2b4d number| adindex string| isoCode function| set_Cookie function| get_Cookie function| getQueryString function| spinnerAction function| hh1 function| jp function| fh function| wxalert number| maxParticleCount number| particleSpeed function| startConfetti function| stopConfetti function| toggleConfetti function| removeConfetti object| ques boolean| box_ini object| modalOptions number| count number| intentos boolean| puedo object| boxRoot string| tipnstr string| alertTip number| value string| appName boolean| g_banner_ad function| showShare function| incrementValue_a function| chooseApp function| _0x2fe6 function| fn1_i function| _0x1e1c function| makePath function| incrementValue1 function| incrementValue_i function| lasthtml function| dapp function| tipn string| j string| banner number| __oneSignalSdkLoadCount function| _0x2e7c26 function| gtag function| _0x2633 function| _0x3dc2 object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.onesignal.com/ | Name: __cf_bm Value: 0fjtelvtVnt97BBwIn1l9SpgrSpL15eyFO4q241sVGI-1684246914-0-Aah89FGGuG7Dk7CrS/iyrD2JVYLjNQRBTLVLbkGXEnwUrecImNEp2uhDJP7/3ZiXW7IBi3v9G0eicrIn3v8UOnM= |
|
.wa5.ru/ | Name: _ga_9X98Y9K1R3 Value: GS1.1.1684246915.1.0.1684246915.0.0.0 |
|
.wa5.ru/ | Name: _ga Value: GA1.2.1829771084.1684246915 |
|
.wa5.ru/ | Name: _gid Value: GA1.2.808435644.1684246915 |
|
.wa5.ru/ | Name: _gat Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.onesignal.com
cdnjs.cloudflare.com
i.imgur.com
imgscdn.ru
region1.google-analytics.com
wa5.ru
www.cloudflare.com
www.google-analytics.com
www.googletagmanager.com
146.75.120.193
2001:4860:4802:34::36
2606:4700:3036::ac43:bf27
2606:4700:3038::6815:eb05
2606:4700::6810:7b60
2606:4700::6811:190e
2606:4700::6812:d63b
2a00:1450:4001:80f::2008
2a00:1450:4001:811::200e
2a00:1450:4001:828::200a
02688f6a610844b06271d8b10dd6030ca0d09901f4a19ce3eb7a92d282ab8fc0
0e4c3d99efa3b2c5bc62e7e9775f6df76aedb4439717f62dea63e33855dfac92
0f7476367287cf4091b0ab6504a2dadc508a8f7dfe86970bc8435f9161b1229a
115dc4c6ae1e93a4fdb68f9aa6df82f18d715ed0a880a9f3cfa68f03a166be18
18f551911c68e079ef629648f47ad743c99d47e9d5c0d5a475c7392a1f0ab248
194addf8fd862999286b33cf83116babe8c700ba3a28111777f49ca72c429970
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1f87d46187a3e1d76e46ac6f86ca10bddb83cfb9a840c954e844640cdcef048a
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3f4f746c80e27c660c9e6df3da619301ae93bb83793446892405d113ec28979f
4d78c8f4d02ba55c72852d3bf5b789a963176967936e13087a494cdc0f70b217
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
74afbb40ee27adf2455d7c49c41fd32d22aebc0a4a524e8d03d80bb9641a09b5
91c5f494e0b7ee29212ebfa51cf6f0ee77a57e125d9852319d52f58e561031b5
93ceeb16bcf59acb9496835518d19562ac9643d16e92af0bc5be34206c37db8c
94982dab3e83f209f5628d47bffde42045eec4f7067f90a7276053663242333e
9860f4ce37af4594415edd7ff4b0a83d5fb72e9175cfd748e2254133a86cf17e
99078204d77be7f6a22a47326a602f78bdadba0b2e934d9c97c6b53a1e2a54f8
a91485a476a1fd5748900f2105f2a87084d8e9bd4e95969a774bc4b4ddb6227b
b27c88a5296adead993468d33381dfc05b215a5358d2f22ec74e2346c409c24f
c868ebeb22a6d2945834c14da4641969a62e35a6cfa434a974339df068324b6e
ca4cedd1c9261184b904ad58d6383fb7913a3f974ea31a52cc0400914576827d
d616c291b84a2e5f0871002db666aaabbacbd84efb629d7f8f7a573b37fb8268
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
dc5de5104018495c7374c7ba59adb71b7863b47e08a35e0c75e7e722865c2db0
e0def3da0c0b947298a89a547b9ecc8e775a6dc67f42eac2a8bfad984da3eb0b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
edd03b96ae4ff7886406c59d7dfeeaa1b624a7da297bf2f92d0cb6b7f9633cba
ef1b2338a0cc7d5f34aeefcc7a38b11ec81feb3c8bfcb3de16f3b6180dffcc87
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e