cool.powlowwki.cyou
Open in
urlscan Pro
5.104.107.248
Malicious Activity!
Public Scan
Submitted URL: https://actumtextil.com/cuhdkyrgsx
Effective URL: https://cool.powlowwki.cyou/s/14534492ea333
Submission: On December 08 via api from US — Scanned from PL
Effective URL: https://cool.powlowwki.cyou/s/14534492ea333
Submission: On December 08 via api from US — Scanned from PL
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 5.104.107.248, located in
Düsseldorf, Germany and
belongs to MYLOC-AS WIIT AG, DE.
The main domain is cool.powlowwki.cyou.
TLS certificate: Issued by R10 on December 5th 2024. Valid for: 3 months.
This is the only time cool.powlowwki.cyou was scanned on urlscan.io!
TLS certificate: Issued by R10 on December 5th 2024. Valid for: 3 months.
This is the only time cool.powlowwki.cyou was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 146.19.128.5 146.19.128.5 | 207957 (ServHost-...) (ServHost-AS SERV.HOST GROUP LTD) | |
| 10 | 5.104.107.248 5.104.107.248 | 24961 (MYLOC-AS ...) (MYLOC-AS WIIT AG) | |
| 12 | 2 |
2
146.19.128.5
(Latvia)
ASN207957 (ServHost-AS SERV.HOST GROUP LTD, GB)
PTR: amridin772.serv.host
ASN207957 (ServHost-AS SERV.HOST GROUP LTD, GB)
PTR: amridin772.serv.host
| actumtextil.com |
10
5.104.107.248
(Düsseldorf, Germany)
ASN24961 (MYLOC-AS WIIT AG, DE)
PTR: srv11409.dus4.dedicated.server-hosting.expert
ASN24961 (MYLOC-AS WIIT AG, DE)
PTR: srv11409.dus4.dedicated.server-hosting.expert
| cool.powlowwki.cyou |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
powlowwki.cyou
cool.powlowwki.cyou |
272 KB |
| 2 |
actumtextil.com
actumtextil.com |
3 KB |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 10 | cool.powlowwki.cyou |
cool.powlowwki.cyou
|
| 2 | actumtextil.com | |
| 12 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| actumtextil.com R11 |
2024-12-07 - 2025-03-07 |
3 months | crt.sh |
| cool.powlowwki.cyou R10 |
2024-12-05 - 2025-03-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cool.powlowwki.cyou/s/14534492ea333
Frame ID: 6C9F4F6709942C8E047084A3BC997310
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Najbardziej popularny serwis randkowy w tym miesiącuPage URL History Show full URLs
- https://actumtextil.com/cuhdkyrgsx Page URL
- https://cool.powlowwki.cyou/s/14534492ea333 Page URL
Detected technologies
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://actumtextil.com/cuhdkyrgsx Page URL
- https://cool.powlowwki.cyou/s/14534492ea333 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
cuhdkyrgsx
actumtextil.com/ |
5 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
14534492ea333
cool.powlowwki.cyou/s/ |
41 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
actumtextil.com/ |
552 B 363 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
cool.powlowwki.cyou/bundle/2/assets/css/ |
71 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-2.js
cool.powlowwki.cyou/bundle/2/assets/js/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
js.js
cool.powlowwki.cyou/bundle/2/assets/js/ |
414 B 627 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
no.png
cool.powlowwki.cyou/bundle/2/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
yes.png
cool.powlowwki.cyou/bundle/2/assets/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.jpg
cool.powlowwki.cyou/bundle/2/assets/img/ |
88 KB 89 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pattern.png
cool.powlowwki.cyou/bundle/2/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Lato-Regular.ttf
cool.powlowwki.cyou/bundle/2/assets/css/fonts/ |
117 KB 118 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
cool.powlowwki.cyou/ |
0 107 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .powlowwki.cyou/ | Name: s Value: Sq06m6mI0gqqyPnglJA%2FSPfpWoE8RGfW2OndU0Pe77YQs41K6fVojlMnxg%2FCEmoa87PdKZ80AUHgx%2BWNh2RnqyB%2BLvaRHuNb%2BRS47yAzDSKHGzeZMTUYJBmvKxNtPUkKx5RQEGwuAGbl0CRu0Up0zaH7Na04ZsNvTw7i9PJ149rHiPS48Mi4hvhZq9b%2FEamWX0XsvxCOAf%2FL3De0nYf5F0pzwHoZyMoaJEi1JzQUhaKwE%2FwkFuihu7iNs3uY4J97Dz9UjI9XRIaX87FUUK3IyQESUbIgeZIS1zIdIKmyjLtO7MOo2dLYNtf7P2i0pvzCDky1aPTe5dXFv87xLdGbgtyGINQPo4Nt1yGvpq10RNcUG8CeVpYNIjyMab%2BqGEPmGQBqkUynm08YoDUmsGAFV6KG8NM2tlrUDuByoIAF4O38XX3XNPkeQjPRufEZ%2BpZRIDm592O9FPvUyfAdPqaw%2FOAkrl6joqgvsETZI8%2BskIRXgPFiz%2BWZdr5%2FHAu2NexwfTql6tTtIb4TwC%2BUFe43WmrJpJCgtLlRCAAuDHSOaQ45UwZq9R6Tyvm9vs839dlaPjXmxPHLGUZHCaCweiSt%2FppHSN03OntbR4JULApYYQGW47JkkDoYL6Xv6GP7o0mZsb9y2oobpiLHyzVkJqkH3QTaE3lo8ynfkvXvhCQrMGJWpR2i360YmEFnf5aUcx%2FJvyidYN0SEBTNdMzz%2BXdes0u8SG1OPj1EEsALzRA013up8nWug4nrO53TrrDhB2o5Ulegv0ToffFEHiNpVqnHkXMqz9qdC4pNvjNcxlPt3WDob1VrEGrRy8CXZStmmLJq%2Bi2A9TDdzskbieW92dBk6ajPxUE%2Bf3FXcM59afeuHTVTTOWx4YGuI2v5xTEH2PikYcrrSmNi1rXREVuqnGd7K3T%2FNLi3omfiuOwax5zITg17a8K4HGiaGEapye%2F%2BV3Jmwoobftqbiws1IOr4X9m2DUgWAke9aeuNvVzT0rDrRw6mubVGOIDLEXtQq1KWkeLw6pZZj6yL095OGXsKQlC158zM8ABAUFIEpy19ggKNtWhUlCRXc7UDlA5g0mnPiamoVYU7yP3ugda1dAZETaZwqtP72gQWFDEU%2FhXH3gJicZuvFeuW4eVqiCPK3kg0pRxrgs11MCN0Si0Rqx5oYWR%2Bf6fVN5kY1L4Sn93FlSQd1pRhsRJDBiJ1v7tMp8JQ27A%2FC4lAVSyUhUWTEk6j%2F6kr7n6zuUChyCsHnLNC9FFT9Om5VDiUdcyYOQRQAedS593BsV2eoQX%2FUB7QG7ma7GwtOdLl3vzxf1bU4I3a3JcmiFaDQZgRs8K0RIx9%2ByewY7aBfxeiAWgPPFqg21sui8AalVMYcwSy4NlMtiDPyB%2FeYTX15RmQ0HovSO9KoEUekhz%2BlNNnjMlH4%2B4KKkY8RFLuzLXHoch4fQxBpRcC%2FcOGuoOQ%2F2v7%2BSuw4TTSoee22iWa7qJSa%2B7LsRjLzIHVugGRuIqq8po9YcqSaAeyodMbA%2BIqy4VXVUyTWDtkFcvIiyrvpka07nagzhJX7Nd2po%2Fsv32DVFfYVtQZHd5ZK9FZMM4PIjIfBwrjlMmdqD0hWdcqnVEWLt8T9eqR6HEIG70VHJYxkWcl9j3zBinUCiF3qepz75Mozw1BRNH%2FpEfiy67DbeAX5P1DQwjnH11BhQ5uHPZURPdYLT78ClJ2A4QOdad4Sm9WR1pPBUffQVHCmZ%2BNlsaalsXjeJ4dwcJJQEkihlhWVKJ2dGZJFltfEslY5GqNc2RrEJsGex3mblIBnU%2Br3JG6JP4TxeS2XZL2JXMnQk6Zljdt7RuFGIg03I2sZeXdYIGqPDrgYDv1Bcw2LwRRHyRvZ%2Fmq |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
actumtextil.com
cool.powlowwki.cyou
146.19.128.5
5.104.107.248
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
15d4127cd56e1b50b5d57340161ff54d22713da009df6904925833779ab125d0
3836b0592b467da4cab99eb40b0fc44f34622144bac13a784ac88848b2890bda
5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004
6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
cd084077853a052be3c0fe0ba7cb4d46ab6b3d5db44ff8dda3c75efaab37f8d6
d213c97217874e8490d2af892db9a1126fb02758c56990572fd139c376778bdc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f92df46462c54bc2ac714a834a336ca1c8c961992495b6f641311ecb587a9a96
fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1