deklaumra.pl
Open in
urlscan Pro
3.122.252.12
Malicious Activity!
Public Scan
Submission: On July 16 via manual from PL — Scanned from DE
Summary
This is the only time deklaumra.pl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 3.122.252.12 3.122.252.12 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:82a::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:5814 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2603:1020:c01... 2603:1020:c01:4::40 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2001:4860:480... 2001:4860:4802:34::36 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::200e | 15169 (GOOGLE) (GOOGLE) | |
13 | 7 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-122-252-12.eu-central-1.compute.amazonaws.com
deklaumra.pl |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
danielhar.containers.piwik.pro | |
danielhar.piwik.pro |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
piwik.pro
danielhar.containers.piwik.pro danielhar.piwik.pro |
88 KB |
3 |
google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2603 www.google-analytics.com — Cisco Umbrella Rank: 69 |
20 KB |
2 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 101 |
110 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 459 |
25 KB |
1 |
deklaumra.pl
deklaumra.pl |
19 KB |
13 | 5 |
Domain | Requested by | |
---|---|---|
4 | danielhar.piwik.pro |
danielhar.containers.piwik.pro
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | danielhar.containers.piwik.pro |
deklaumra.pl
|
2 | www.googletagmanager.com |
deklaumra.pl
www.googletagmanager.com |
1 | region1.google-analytics.com |
www.googletagmanager.com
|
1 | cdn.jsdelivr.net |
deklaumra.pl
|
1 | deklaumra.pl | |
13 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com GTS CA 1C3 |
2022-06-27 - 2022-09-19 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-02 - 2023-06-01 |
a year | crt.sh |
*.containers.piwik.pro GlobeSSL DV CA |
2021-08-17 - 2022-09-08 |
a year | crt.sh |
*.piwik.pro GlobeSSL DV CA |
2022-01-10 - 2023-01-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://deklaumra.pl/gb/facebook/login/index.html
Frame ID: B79278F956ACFC75233C750142CFB12C
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Analytics (Analytics) Expand
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/gtag/js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
deklaumra.pl/gb/facebook/login/ |
59 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
196 KB 70 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.5.3/dist/css/ |
157 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9dda3b8f-d3cd-49b0-9bab-fc06cb34f389.js
danielhar.containers.piwik.pro/ |
228 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
103 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
region1.google-analytics.com/g/ |
0 344 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
49 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ppms.js
danielhar.containers.piwik.pro/ |
78 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
collect
www.google-analytics.com/j/ |
1 B 21 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
ppms.php
danielhar.piwik.pro/ |
0 0 |
Ping
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation object| dataLayer object| ppms function| gtag function| getCookie string| ssid object| _0x38d5 function| _0x5b6c function| _0x5d242a object| _0xdb4b function| _0x588151 function| _0x29e7 function| setCookie function| setValues object| google_tag_manager function| onYouTubeIframeAPIReady object| google_tag_data object| gaGlobal string| GoogleAnalyticsObject function| ga string| SYNC_EVENT string| ONCE_PER_PAGE_VIEW_ACTION string| ONCE_PER_SESSION_ACTION string| VARIABLE_NAME string| COOKIE_PREFIX string| GLOBAL_CONFIG_NAME function| ppmsWebStorage object| sevenTag object| _paq object| Piwik object| AnalyticsTracker function| piwik_log object| gaplugins object| gaData11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
deklaumra.pl/ | Name: host Value: aHR0cDovL2Rla2xhdW1yYS5wbC9nYi9mYWNlYm9vay9sb2dpbi9pbmRleC5odG1s |
|
.deklaumra.pl/ | Name: _ga_9Z3VZZZJ2S Value: GS1.1.1657964886.1.1.1657964886.0 |
|
deklaumra.pl/ | Name: stg_returning_visitor Value: Sat%2C%2016%20Jul%202022%2009:48:06%20GMT |
|
deklaumra.pl/ | Name: stg_traffic_source_priority Value: 1 |
|
deklaumra.pl/ | Name: stg_externalReferrer Value: |
|
deklaumra.pl/ | Name: stg_last_interaction Value: Sat%2C%2016%20Jul%202022%2009:48:06%20GMT |
|
deklaumra.pl/ | Name: _pk_id.9dda3b8f-d3cd-49b0-9bab-fc06cb34f389.8bd8 Value: 0dacf09e7493c2e4.1657964887.1.1657964887.1657964887. |
|
deklaumra.pl/ | Name: _pk_ses.9dda3b8f-d3cd-49b0-9bab-fc06cb34f389.8bd8 Value: * |
|
.deklaumra.pl/ | Name: _ga Value: GA1.2.1274002937.1657964887 |
|
.deklaumra.pl/ | Name: _gid Value: GA1.2.1834649894.1657964887 |
|
.deklaumra.pl/ | Name: _gat_gtag_UA_219740429_1 Value: 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
danielhar.containers.piwik.pro
danielhar.piwik.pro
deklaumra.pl
region1.google-analytics.com
www.google-analytics.com
www.googletagmanager.com
2001:4860:4802:34::36
2603:1020:c01:4::40
2606:4700::6810:5814
2a00:1450:4001:812::200e
2a00:1450:4001:82a::2008
3.122.252.12
180c3f72b62cb358b7e048c42d277986f92f79e0f872a1ee39cac34b40df5bb2
1df2873b1f8bd62d6fcc3a81076d1c5461e5d562200981f6f3cda0be897864d9
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
9b302004e7910676a9eb17bcea4fe6b659caa9abc475ae32d96a592c9ddc8523
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a36f4879a86ad9ba668a4df9efb8fb50d256bbd7310abc51f92617c014b7e75a
a819bdfc9068eadadc3d3e2039284344b68faebfd6b7e7f464326437353698c6
aa627141fc46c1659bad26a2c2c5e203bc3400115b2245f4e4191b6eabbcfc4a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194