vww-kraken-pro.com Open in urlscan Pro
2606:4700:3031::6815:252a Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://vww-kraken-pro.com/
Effective URL:
https://vww-kraken-pro.com/login/static/login.php?id
Submission: On April 27 via automatic, source certstream-suspicious (April 27th 2024, 12:48:43 am UTC) — Scanned from DE

Summary HTTP 1 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 2606:4700:3031::6815:252a, located in United States and belongs to CLOUDFLARENET, US. The main domain is vww-kraken-pro.com.
TLS certificate: Issued by GTS CA 1P5 on April 26th 2024. Valid for: 3 months.

This is the only time vww-kraken-pro.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Kraken (Crypto Exchange)

Domain & IP information

	IP Address		AS Autonomous System
2 3	2606:4700:303... 2606:4700:3031::6815:252a		13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2

3 2606:4700:3031::6815:252a (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

vww-kraken-pro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	vww-kraken-pro.com 2 redirects vww-kraken-pro.com	761 KB
1	1

	Domain	Requested by
3	vww-kraken-pro.com	2 redirects
1	1

This site contains links to these domains. Also see Links.

Domain
www.kraken.com

Subject Issuer	Validity	Valid
vww-kraken-pro.com GTS CA 1P5	`2024-04-26` - `2024-07-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://vww-kraken-pro.com/login/static/login.php?id
Frame ID: D98306A14F57CC9E784A16B4321A1231
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Kraken | Buy, Sell and Margin Trade Bitcoin (BTC) and Ethereum (ETH)

Page URL History Show full URLs

https://vww-kraken-pro.com/ HTTP 302
https://vww-kraken-pro.com/login/index.php?pwd=UEh0cFFyRkA HTTP 302
https://vww-kraken-pro.com/login/static/login.php?id Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

874 kB
Transfer

1494 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.kraken.com/

Search URL Search Domain Scan URL

URL: https://www.kraken.com/sign-up
Title: Create account

Search URL Search Domain Scan URL

URL: https://www.kraken.com/self-help
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://vww-kraken-pro.com/ HTTP 302
https://vww-kraken-pro.com/login/index.php?pwd=UEh0cFFyRkA HTTP 302
https://vww-kraken-pro.com/login/static/login.php?id Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request login.php Show response vww-kraken-pro.com/login/static/ Redirect Chain https://vww-kraken-pro.com/ https://vww-kraken-pro.com/login/index.php?pwd=UEh0cFFyRkA https://vww-kraken-pro.com/login/static/login.php?id	1 MB 760 KB	339ms 339ms	Document text/html	2606:4700:3031::6815:252a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://vww-kraken-pro.com/login/static/login.php?id Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3031::6815:252a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `836bfc9568e2c63ba863b50f8d835933092d46c153306e6b62ff0baf24caa300` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 87aaced86a0c3605-FRA content-encoding br content-type text/html; charset=UTF-8 date Sat, 27 Apr 2024 00:48:37 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N%2Fef%2BsnGjag1xJCSNEqauSjrfSatmLMjcdZYqdNHao8JGifvzEQeFKvOVwonSvEGOaNAElCy5ev2g6AGHqnqSnVdvotBVYr1gH9UK97XwlZgtNtw%2BsSkKvSS5sGDG%2BQKW892PhX1%2F7eC78uGRPy4bps%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate cf-cache-status DYNAMIC cf-ray 87aaced35f353605-FRA content-type text/html; charset=UTF-8 date Sat, 27 Apr 2024 00:48:37 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location static/login.php?id#_ nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VwJeGsru3LbECEB03fgio6NIZGDtyjjn7uAvzFZO6dNai9EjyxSQOLPf2ut%2F5mDTZJhRfWPsLiZM5%2BOES7PtD1FKIC%2FPBRyNwczwDmQcb1Pl0p6UPwuz%2BRCU%2FsAeWx3RKyO7TjI%2B%2FvKKh7XyUyZ662Y%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `786714b48a70a4dc9168814d519dbce33801b93ccbd7062150dc3b09fdc835aa` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	24 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b034f4c4f0cbb897a07d312624bcc00303e651125ac0247a2cba0ee08b493741` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	151 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `3a585b6fea16288b0a8b6cbd87f2262454774ed346242edd62e4e91f3cff4033` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	334 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d6af4e841ae21e4bf7308fa7ccd2ef434acc56d9ace0d6056e75234ac503d350` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	21 KB 21 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b5610af04d0d4b5a14a621d96d974b993e945a065db1a8861918f69ef9321934` Request headers Referer Origin https://vww-kraken-pro.com Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	21 KB 21 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `914f1400f363e636b6f9cc7965aa807ff01e93586e1437617525cba0a62aa78d` Request headers Referer Origin https://vww-kraken-pro.com Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	29 KB 29 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0aa91303eaecad1e845d4a9ca346ef1c009440893738c540048c4f05bc1f92b2` Request headers Referer Origin https://vww-kraken-pro.com Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	22 KB 22 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fff0ab3a88b0b4aa0b693e4f0201359a15183b08e3fa5696d1918d8f0ade8ad5` Request headers Referer Origin https://vww-kraken-pro.com Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	20 KB 20 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `b5ad7bd39f996144915f0ad9849a90183b27d8c28ad97ed98af5b1bebc51f6b1` Request headers Referer Origin https://vww-kraken-pro.com Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Kraken (Crypto Exchange)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			vww-kraken-pro.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: oom33f1o0q2l8lkotbps9v3nng

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://vww-kraken-pro.com/login/static/login.php?id#_(Line 1) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://vww-kraken-pro.com/login/static/login.php?id#_(Line 1) Message: <link rel=preload> has an invalid `href` value
other	warning	URL: https://vww-kraken-pro.com/login/static/login.php?id#_(Line 1) Message: <link rel=preload> has an invalid `href` value

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

vww-kraken-pro.com
2606:4700:3031::6815:252a
0aa91303eaecad1e845d4a9ca346ef1c009440893738c540048c4f05bc1f92b2
3a585b6fea16288b0a8b6cbd87f2262454774ed346242edd62e4e91f3cff4033
786714b48a70a4dc9168814d519dbce33801b93ccbd7062150dc3b09fdc835aa
836bfc9568e2c63ba863b50f8d835933092d46c153306e6b62ff0baf24caa300
914f1400f363e636b6f9cc7965aa807ff01e93586e1437617525cba0a62aa78d
b034f4c4f0cbb897a07d312624bcc00303e651125ac0247a2cba0ee08b493741
b5610af04d0d4b5a14a621d96d974b993e945a065db1a8861918f69ef9321934
b5ad7bd39f996144915f0ad9849a90183b27d8c28ad97ed98af5b1bebc51f6b1
d6af4e841ae21e4bf7308fa7ccd2ef434acc56d9ace0d6056e75234ac503d350
fff0ab3a88b0b4aa0b693e4f0201359a15183b08e3fa5696d1918d8f0ade8ad5

vww-kraken-pro.com Open in urlscan Pro 2606:4700:3031::6815:252a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

874 kBTransfer

1494 kBSize

1 Cookies

3 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

3 Console Messages

Indicators

vww-kraken-pro.com Open in urlscan Pro
2606:4700:3031::6815:252a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

874 kB
Transfer

1494 kB
Size

1
Cookies

1 HTTP transactions
9 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!