citrussw-iw.pp.ua Open in urlscan Pro
2606:4700:30::681b:8ef7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Submission Tags: @ipnigh
Submission: On August 29 via api (August 29th 2019, 8:38:53 pm UTC) from GB

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 2606:4700:30::681b:8ef7, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is citrussw-iw.pp.ua.

This is the only time citrussw-iw.pp.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Vkontakte (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:30:... 2606:4700:30::681b:8ef7	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81d::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1 7	87.240.182.230 87.240.182.230	47541 (VKONTAKTE...) (VKONTAKTE-SPB-AS http://vk.com)
16	3

9 2606:4700:30::681b:8ef7 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

citrussw-iw.pp.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

images.app.goo.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 87.240.182.230 (Russian Federation) 1 redirects

ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU)
PTR: srv230-182-240-87.vk.com

pp.userapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	pp.ua citrussw-iw.pp.ua	38 KB
7	userapi.com 1 redirects pp.userapi.com	33 KB
1	google.com www.google.com
1	goo.gl 1 redirects images.app.goo.gl	768 B
16	4

	Domain	Requested by
9	citrussw-iw.pp.ua	citrussw-iw.pp.ua
7	pp.userapi.com	1 redirects citrussw-iw.pp.ua
1	www.google.com	citrussw-iw.pp.ua
1	images.app.goo.gl	1 redirects
16	4

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
www.google.com GTS CA 1O1	`2019-07-29` - `2019-10-27`	3 months	crt.sh
*.userapi.com COMODO ECC Organization Validation Secure Server CA	`2019-06-25` - `2020-06-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Frame ID: C7109C9D1B475BF6E802A0C10085FE51
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

16
Requests

44 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

71 kB
Transfer

177 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://images.app.goo.gl/c8qjEAjtgWH9NbBW9 HTTP 302
https://www.google.com/imgres?imgurl=http://www.greenpeace.org/russia/Global/russia/image/2004/7/62640.jpg&imgrefurl=http://www.greenpeace.org/russia/ru/news/2010/September/25-2/&tbnid=tJikzv2abmaCqM&vet=1&docid=PCAnbzCqVWl_jM&w=800&h=597&hl=ru&source=sh/x/im

Request Chain 6

https://pp.userapi.com/c618124/v618124160/f484/AuKpwM_v-mE.jpg?ava=1 HTTP 301
https://pp.userapi.com/etAa6n1WLzIjbq6kyOBJBsc_2XDhirzrDaVVZQ/JAVZwoFmU_8.jpg

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
citrussw-iw.pp.ua/cHVwb1FBV3k=/ 12 KB
4 KB 987ms
961ms Document
text/html 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f1c2daebbcbd159bbbc4339bd3a818972f5e482a4764273c59322eaf9b433ade

Request headers

Host: citrussw-iw.pp.ua
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:35 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=de088a464e17893b33847a799da96f32c1567111114; expires=Fri, 28-Aug-20 20:38:34 GMT; path=/; domain=.citrussw-iw.pp.ua; HttpOnly
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 50e15450accfcba8-VIE
Content-Encoding: gzip

GET
H/1.1 200
OK style1.css
citrussw-iw.pp.ua/cHVwb1FBV3k=/ 99 KB
20 KB 574ms
573ms Stylesheet
text/css 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/style1.css
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c59dfbc53f1fd7417c63b56307a9a14303507db3a40ecd6386c6d33f17cce9e

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:35 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Mon, 19 Aug 2019 19:15:55 GMT
Server: cloudflare
ETag: "18c7f-5907d2b4898c0-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 50e15456bb20cba8-VIE
Content-Length: 20373
Expires: Fri, 30 Aug 2019 00:38:35 GMT

GET
H/1.1 200
OK style2.css
citrussw-iw.pp.ua/cHVwb1FBV3k=/ 14 KB
4 KB 380ms
369ms Stylesheet
text/css 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/style2.css
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4dcf4c838d4cb18b8eca6c2120e30baee6424662a9223d411f419feb654464e

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:35 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Mon, 19 Aug 2019 19:15:55 GMT
Server: cloudflare
ETag: "37fd-5907d2b48c3b9-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 50e15456cda6cba4-VIE
Content-Length: 3241
Expires: Fri, 30 Aug 2019 00:38:35 GMT

GET
H/1.1 200
OK modul.css
citrussw-iw.pp.ua/cHVwb1FBV3k=/ 14 KB
3 KB 391ms
379ms Stylesheet
text/css 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/modul.css?24002827609
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b1da8bdbac97a68a5cc42ba43e1f4f8974dc93962d62092cfb8a3dd0c464d66

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:35 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
Last-Modified: Mon, 19 Aug 2019 19:15:55 GMT
Server: cloudflare
ETag: "3969-5907d2b48bfd1-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: public, max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 50e15456cb78cbb8-VIE
Content-Length: 3059
Expires: Fri, 30 Aug 2019 00:38:35 GMT

GET
H/1.1 200
OK ic_head_logo1.svg
citrussw-iw.pp.ua/cHVwb1FBV3k=/ 2 KB
1 KB 30ms
18ms Image
image/svg+xml 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/ic_head_logo1.svg
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1566a58e10519489ee882a2255e44bd523e471b0ad94e5b28b445b4928b44b60

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:35 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Mon, 19 Aug 2019 19:15:55 GMT
Server: cloudflare
Age: 2438
ETag: W/"676-5907d2b489ca8"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 50e15456cd55cbd0-VIE
Expires: Fri, 30 Aug 2019 00:38:35 GMT

GET
H2

200

imgres
www.google.com/
Redirect Chain

https://images.app.goo.gl/c8qjEAjtgWH9NbBW9
https://www.google.com/imgres?imgurl=http://www.greenpeace.org/russia/Global/russia/image/2004/7/62640.jpg&imgrefurl=http://www.greenpeace.org/russia/ru/news/2010/September/25-2/&tbnid=tJikzv2abmaC...

0
0

74ms
74ms

Image
text/html

2a00:1450:4001:81d::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/imgres?imgurl=http://www.greenpeace.org/russia/Global/russia/image/2004/7/62640.jpg&imgrefurl=http://www.greenpeace.org/russia/ru/news/2010/September/25-2/&tbnid=tJikzv2abmaCqM&vet=1&docid=PCAnbzCqVWl_jM&w=800&h=597&hl=ru&source=sh/x/im
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
content-security-policy: script-src 'report-sample' 'nonce-7+Z6yf3cclXk7h+jSdDrqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self', script-src 'nonce-7+Z6yf3cclXk7h+jSdDrqQ' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DurableDeepLinkUi/cspreport
x-content-type-options: nosniff
server: ESF
status: 302
date: Thu, 29 Aug 2019 20:38:35 GMT
x-frame-options: SAMEORIGIN
content-type: application/binary
location: https://www.google.com/imgres?imgurl=http://www.greenpeace.org/russia/Global/russia/image/2004/7/62640.jpg&imgrefurl=http://www.greenpeace.org/russia/ru/news/2010/September/25-2/&tbnid=tJikzv2abmaCqM&vet=1&docid=PCAnbzCqVWl_jM&w=800&h=597&hl=ru&source=sh/x/im
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 0
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK tt.png
citrussw-iw.pp.ua/cHVwb1FBV3k=/ 322 B
727 B 30ms
19ms Image
image/png 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/tt.png
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: da782c57e6ef6e298cb5748d3836e09345f5749128fee334a674e182e15bd23c

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:35 GMT
CF-Cache-Status: HIT
Last-Modified: Mon, 19 Aug 2019 19:15:55 GMT
Server: cloudflare
Age: 2438
ETag: "142-5907d2b48bbe9"
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: public, max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 50e15456cce0cbc0-VIE
Content-Length: 322
Expires: Fri, 30 Aug 2019 00:38:35 GMT

GET
H2

200

JAVZwoFmU_8.jpg
pp.userapi.com/etAa6n1WLzIjbq6kyOBJBsc_2XDhirzrDaVVZQ/
Redirect Chain

https://pp.userapi.com/c618124/v618124160/f484/AuKpwM_v-mE.jpg?ava=1
https://pp.userapi.com/etAa6n1WLzIjbq6kyOBJBsc_2XDhirzrDaVVZQ/JAVZwoFmU_8.jpg

4 KB
4 KB

40ms
39ms

Image
image/jpeg

87.240.182.230
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pp.userapi.com/etAa6n1WLzIjbq6kyOBJBsc_2XDhirzrDaVVZQ/JAVZwoFmU_8.jpg

Requested by

Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.240.182.230 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv230-182-240-87.vk.com

Software

VK /

Resource Hash

5e6e191efe90bf832fd6de4523470617368639ee1cc3000755aa5f42923d51c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
server: VK
status: 200
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4209
expires: Thu, 05 Sep 2019 20:38:35 GMT

Redirect headers

status: 301
date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
server: VK
location: /etAa6n1WLzIjbq6kyOBJBsc_2XDhirzrDaVVZQ/JAVZwoFmU_8.jpg
strict-transport-security: max-age=15768000
content-type: image/jpeg

GET
H2 200 w00899ALACI.jpg
pp.userapi.com/c628324/v628324266/33aab/ 5 KB
6 KB 117ms
38ms Image
image/jpeg 87.240.182.230
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pp.userapi.com/c628324/v628324266/33aab/w00899ALACI.jpg?ava=1

Requested by

Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.240.182.230 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv230-182-240-87.vk.com

Software

VK /

Resource Hash

d4a9e07238890f5b23672bff51bd351b71fd5b2ccea6cd966aabf59bae9ca8ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
last-modified: Tue, 15 Dec 2015 20:20:42 GMT
server: VK
status: 200
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
cache-control: max-age=604800
accept-ranges: bytes
content-length: 5479
expires: Thu, 05 Sep 2019 20:38:35 GMT

GET
H2 200 qCl2jlsh8E0.jpg
pp.userapi.com/c840230/v840230032/3977b/ 5 KB
5 KB 153ms
73ms Image
image/jpeg 87.240.182.230
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pp.userapi.com/c840230/v840230032/3977b/qCl2jlsh8E0.jpg?ava=1

Requested by

Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.240.182.230 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv230-182-240-87.vk.com

Software

VK /

Resource Hash

8b8520f6222bb274d23c05ba8a0583e1a227c9297ad8f930f7df62ffc4a86b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
last-modified: Thu, 12 Oct 2017 23:14:38 GMT
server: VK
status: 200
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4978
expires: Thu, 05 Sep 2019 20:38:35 GMT

GET
H2 200 ZSOksST-MI8.jpg
pp.userapi.com/c636326/v636326279/20f30/ 7 KB
7 KB 149ms
70ms Image
image/jpeg 87.240.182.230
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pp.userapi.com/c636326/v636326279/20f30/ZSOksST-MI8.jpg?ava=1

Requested by

Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.240.182.230 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv230-182-240-87.vk.com

Software

VK /

Resource Hash

baa015bff7c184a344bf5a2e4c85f47c720b905fa37a2d1df2f291d173ac6ab6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
last-modified: Sat, 06 Aug 2016 07:54:23 GMT
server: VK
status: 200
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
cache-control: max-age=604800
accept-ranges: bytes
content-length: 7061
expires: Thu, 05 Sep 2019 20:38:35 GMT

GET
H2 200 0pDC0JHwpQ4.jpg
pp.userapi.com/c841130/v841130221/68510/ 5 KB
5 KB 153ms
74ms Image
image/jpeg 87.240.182.230
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pp.userapi.com/c841130/v841130221/68510/0pDC0JHwpQ4.jpg?ava=1

Requested by

Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.240.182.230 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv230-182-240-87.vk.com

Software

VK /

Resource Hash

f8f906819e1438b92830e9b0110ec4c122b4ee8bfb1f805fbbe74d61a4967e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
last-modified: Sun, 11 Feb 2018 15:20:49 GMT
server: VK
status: 200
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4908
expires: Thu, 05 Sep 2019 20:38:35 GMT

GET
H2 200 t_ttG5esg4c.jpg
pp.userapi.com/c846418/v846418487/6fff0/ 5 KB
5 KB 152ms
74ms Image
image/jpeg 87.240.182.230
VKONTAKTE-SPB-AS ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pp.userapi.com/c846418/v846418487/6fff0/t_ttG5esg4c.jpg?ava=1

Requested by

Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

87.240.182.230 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU),

Reverse DNS

srv230-182-240-87.vk.com

Software

VK /

Resource Hash

18825b6c6ef0ee4a8d8deb9bcd87f6a4cda3a4d8ef3494113f4260f481fa128c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 29 Aug 2019 20:38:35 GMT
x-frontend: front220011
last-modified: Fri, 08 Jun 2018 14:04:22 GMT
server: VK
status: 200
strict-transport-security: max-age=15768000
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Frontend
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4698
expires: Thu, 05 Sep 2019 20:38:35 GMT

GET
H/1.1 520
Origin Error backlink.gif
citrussw-iw.pp.ua/images/ 5 KB
5 KB 236ms
236ms Image
text/html 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://citrussw-iw.pp.ua/images/backlink.gif?4
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f93382dccf3063ee5ba25655452477d9cc96b72ff4614958e9314ffd1d47854

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/style1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 29 Aug 2019 20:38:36 GMT
CF-Cache-Status: MISS
Server: cloudflare
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 50e1545a5be8cba8-VIE
Expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H/1.1 404
Not Found dev_head_magglass.png
citrussw-iw.pp.ua/images/icons/ 315 B
315 B 227ms
227ms Image
text/html 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://citrussw-iw.pp.ua/images/icons/dev_head_magglass.png
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bab051d775671b2f4a69eaedbf47159d1d1648442a23ffafc182c6e8105edce1

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/style1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:36 GMT
Content-Encoding: gzip
CF-Cache-Status: STALE
Server: cloudflare
Age: 2437
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 50e1545a5c3ecbb8-VIE
Expires: Fri, 30 Aug 2019 00:38:36 GMT

GET
H/1.1 404
Not Found upload.gif
citrussw-iw.pp.ua/images/ 298 B
298 B 254ms
254ms Image
text/html 2606:4700:30::681b:8ef7
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://citrussw-iw.pp.ua/images/upload.gif
Requested by: Host: citrussw-iw.pp.ua
URL: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/
Protocol: HTTP/1.1
Security: , ,
Server: 2606:4700:30::681b:8ef7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb34dc3ff4de4ecf11f3dd63684f75e621ba1ee7b68f321effd0601e0ece438b

Request headers

Referer: http://citrussw-iw.pp.ua/cHVwb1FBV3k=/style1.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 29 Aug 2019 20:38:36 GMT
Content-Encoding: gzip
CF-Cache-Status: EXPIRED
Server: cloudflare
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1
Cache-Control: public, max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 50e1545a6f7bcba4-VIE
Expires: Fri, 30 Aug 2019 00:38:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vkontakte (Social Network)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
citrussw-iw.pp.ua/	1970-01-19 03:18:31	Name: cf_ob_info Value: 520:50e1545a5be8cba8:VIE
citrussw-iw.pp.ua/	1970-01-19 03:18:31	Name: cf_use_ob Value: 80
.citrussw-iw.pp.ua/	1970-01-19 12:04:07	Name: __cfduid Value: de088a464e17893b33847a799da96f32c1567111114

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

citrussw-iw.pp.ua
images.app.goo.gl
pp.userapi.com
www.google.com
2606:4700:30::681b:8ef7
2a00:1450:4001:818::200e
2a00:1450:4001:81d::2004
87.240.182.230
1566a58e10519489ee882a2255e44bd523e471b0ad94e5b28b445b4928b44b60
18825b6c6ef0ee4a8d8deb9bcd87f6a4cda3a4d8ef3494113f4260f481fa128c
2b1da8bdbac97a68a5cc42ba43e1f4f8974dc93962d62092cfb8a3dd0c464d66
5e6e191efe90bf832fd6de4523470617368639ee1cc3000755aa5f42923d51c1
6c59dfbc53f1fd7417c63b56307a9a14303507db3a40ecd6386c6d33f17cce9e
6f93382dccf3063ee5ba25655452477d9cc96b72ff4614958e9314ffd1d47854
8b8520f6222bb274d23c05ba8a0583e1a227c9297ad8f930f7df62ffc4a86b0b
baa015bff7c184a344bf5a2e4c85f47c720b905fa37a2d1df2f291d173ac6ab6
bab051d775671b2f4a69eaedbf47159d1d1648442a23ffafc182c6e8105edce1
cb34dc3ff4de4ecf11f3dd63684f75e621ba1ee7b68f321effd0601e0ece438b
d4a9e07238890f5b23672bff51bd351b71fd5b2ccea6cd966aabf59bae9ca8ad
da782c57e6ef6e298cb5748d3836e09345f5749128fee334a674e182e15bd23c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1c2daebbcbd159bbbc4339bd3a818972f5e482a4764273c59322eaf9b433ade
f4dcf4c838d4cb18b8eca6c2120e30baee6424662a9223d411f419feb654464e
f8f906819e1438b92830e9b0110ec4c122b4ee8bfb1f805fbbe74d61a4967e89

citrussw-iw.pp.ua Open in urlscan Pro 2606:4700:30::681b:8ef7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

44 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

71 kBTransfer

177 kBSize

3 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

3 Cookies

Indicators

citrussw-iw.pp.ua Open in urlscan Pro
2606:4700:30::681b:8ef7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

44 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

71 kB
Transfer

177 kB
Size

3
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!