zonomail.win
Open in
urlscan Pro
217.147.169.145
Malicious Activity!
Public Scan
Submitted URL: http://zonomail.win/index.php?s=1
Effective URL: https://zonomail.win/index.php?s=1
Submission: On January 11 via automatic, source phishtank
Effective URL: https://zonomail.win/index.php?s=1
Submission: On January 11 via automatic, source phishtank
Summary
This website contacted 3 IPs
in 3 countries
across 3 domains to perform 4 HTTP transactions.
The main IP is 217.147.169.145, located in
Ukraine and
belongs to HOSTFORY, UA.
The main domain is zonomail.win.
TLS certificate: Issued by Let's Encrypt Authority X3 on December 18th 2018. Valid for: 3 months.
This is the only time zonomail.win was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on December 18th 2018. Valid for: 3 months.
This is the only time zonomail.win was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PayPal (Financial)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 3 | 217.147.169.145 217.147.169.145 | 206638 (HOSTFORY) (HOSTFORY) | |
| 1 | 176.9.102.206 176.9.102.206 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 1 | 151.101.120.193 151.101.120.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
| 4 | 3 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
zonomail.win
1 redirects
zonomail.win |
6 KB |
| 1 |
imgur.com
i.imgur.com |
19 KB |
| 1 |
abload.de
abload.de |
1 KB |
| 4 | 3 |
| Domain | Requested by | |
|---|---|---|
| 3 | zonomail.win |
1 redirects
zonomail.win
|
| 1 | i.imgur.com |
zonomail.win
|
| 1 | abload.de |
zonomail.win
|
| 4 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| zonomail.win Let's Encrypt Authority X3 |
2018-12-18 - 2019-03-18 |
3 months | crt.sh |
| *.abload.de Thawte TLS RSA CA G1 |
2018-05-22 - 2019-05-22 |
a year | crt.sh |
| *.imgur.com DigiCert SHA2 Secure Server CA |
2018-12-14 - 2020-02-12 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://zonomail.win/index.php?s=1
Frame ID: 88249BE23AA9556433A68993C131981B
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://zonomail.win/index.php?s=1
HTTP 301
https://zonomail.win/index.php?s=1 Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://zonomail.win/index.php?s=1
HTTP 301
https://zonomail.win/index.php?s=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
zonomail.win/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wrongcredentials.png
zonomail.win/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
282533c2543501a361b66w4sm1.png
abload.de/img/ |
969 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
w3FNx2D.png
i.imgur.com/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PayPal (Financial)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| validateForm boolean| waited function| checkAmount function| showin1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| zonomail.win/ | Name: PHPSESSID Value: kneu8pr9ea0l1ti64ibp9g7e17 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
abload.de
i.imgur.com
zonomail.win
151.101.120.193
176.9.102.206
217.147.169.145
02b341af1b5c99b22e3867c251172fed336b7599a2ee0599cdf6ade6cfb82e7c
4ddcb22254633a19a1524f0f5cc5b60da98bce9400dea572197338296c41c7f4
c5f9c53417463cf9b5f39763525db9d2b9ffc36a8f46248f003695e207e6429d
dc8e24b85bbe78c6be2a991c11c845a909758174b6f8ea61e27af4440966f271