illuminationsbycurtis.com

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 2.57.122.11, located in Romania and belongs to UNMANAGED-DEDICATED-SERVERS, GB. The main domain is illuminationsbycurtis.com.

This is the only time illuminationsbycurtis.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Sparkasse (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	2.57.122.11 2.57.122.11	47890 (UNMANAGED...) (UNMANAGED-DEDICATED-SERVERS)
1 2	2606:4700::68... 2606:4700::6812:9b2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	35.186.213.112 35.186.213.112	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	4

1 2.57.122.11 (Romania)

ASN47890 (UNMANAGED-DEDICATED-SERVERS, GB)

illuminationsbycurtis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:9b2 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

i.gyazo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.213.112 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 112.213.186.35.bc.googleusercontent.com

gyazo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	gyazo.com 2 redirects i.gyazo.com — Cisco Umbrella Rank: 97497 gyazo.com — Cisco Umbrella Rank: 73840	6 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 255	18 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 406	31 KB
1	illuminationsbycurtis.com illuminationsbycurtis.com	158 KB
4	4

	Domain	Requested by
2	i.gyazo.com	1 redirects illuminationsbycurtis.com
1	cdnjs.cloudflare.com	illuminationsbycurtis.com
1	ajax.googleapis.com	illuminationsbycurtis.com
1	gyazo.com	1 redirects
1	illuminationsbycurtis.com
4	5

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-07-03` - `2023-09-25`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://illuminationsbycurtis.com/spk.php
Frame ID: 4705FCFC41F223F713866FF9ED66A6CB
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

50 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

211 kB
Transfer

439 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://i.gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.pngg HTTP 302
https://gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.pngg HTTP 302
https://i.gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.png

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request spk.php Show response
illuminationsbycurtis.com/ 240 KB
158 KB 1398ms
262ms Document
text/html 2.57.122.11
UNMANAGED-DEDICAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://illuminationsbycurtis.com/spk.php
Protocol: HTTP/1.1
Server: 2.57.122.11 , Romania, ASN47890 (UNMANAGED-DEDICATED-SERVERS, GB),
Reverse DNS
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 835463245ce736fb98345266ea1aabe0e480c1deea353f054c7b420a39e32fae

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Wed, 19 Jul 2023 23:03:37 GMT
Keep-Alive: timeout=5, max=100
Server: Apache/2.4.29 (Ubuntu)
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2

200

cd05991d32686f6e23cff3fdd7bd9503.png
i.gyazo.com/
Redirect Chain

https://i.gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.pngg
https://gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.pngg
https://i.gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.png

5 KB
5 KB

34ms
34ms

Image
image/png

2606:4700::6812:9b2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.png
Requested by: Host: illuminationsbycurtis.com
URL: http://illuminationsbycurtis.com/spk.php
Protocol: H2
Server: 2606:4700::6812:9b2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d32b8e6980baf4984537bb96ad5380405c1aed75ae609a53bfd80347b5a24a7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://illuminationsbycurtis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Wed, 19 Jul 2023 23:03:38 GMT
via: 1.1 google
cf-cache-status: HIT
age: 160273
content-length: 5212
server: cloudflare
etag: "cd05"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
content-dpr: 1.000000
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 7e96994efdd639d0-FRA
expires: Thu, 18 Jul 2024 23:03:38 GMT

Redirect headers

date: Wed, 19 Jul 2023 23:03:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
via: 1.1 google
x-permitted-cross-domain-policies: none
cache-tag: 189b4d6b75199753
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
x-request-id: 53d56c3b-3b56-4c42-a0bb-ac36ec26487c
x-runtime: 0.016243
referrer-policy: strict-origin-when-cross-origin
server: nginx/1.17.8
x-download-options: noopen
x-frame-options: SAMEORIGIN
content-type: #<Mime::NullType:0x00007fbb28de2d90>; charset=utf-8
location: https://i.gyazo.com/cd05991d32686f6e23cff3fdd7bd9503.png
cache-control: no-cache

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 68ms
20ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: illuminationsbycurtis.com
URL: http://illuminationsbycurtis.com/spk.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://illuminationsbycurtis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Wed, 19 Jul 2023 21:49:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4442
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Jul 2024 21:49:36 GMT

GET
H2 200 beautify-html.js Show response
cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.3/ 107 KB
18 KB 74ms
27ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-beautify/1.14.3/beautify-html.js

Requested by

Host: illuminationsbycurtis.com
URL: http://illuminationsbycurtis.com/spk.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae259af05b2211d86a28c6850e5ac4a9121272dc3b394355334a6b2d65764fe9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://illuminationsbycurtis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.98 Safari/537.36

Response headers

date: Wed, 19 Jul 2023 23:03:38 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 50068
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 17400
last-modified: Thu, 22 Jun 2023 11:06:11 GMT
server: cloudflare
cf-cdnjs-via: cfworker/r2
etag: "64942b23-43f8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=03U6gviR%2B7Xmq4lcRGDVeDWPEtr0xDCocQBRBKIrk%2F2FAsQJsd3gu833xdK%2BbLHpF7hRv96o3QyCQ81AeQiMxo0yXDSC%2FzHTH3EbGwe8qlQdX%2FC7REqx%2F6qiXuDdmOjuckqJiLekvsNUFansC09lrrze"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7e96994e89791917-FRA
expires: Mon, 08 Jul 2024 23:03:38 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Sparkasse (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			i.gyazo.com/	1970-01-20 22:59:27	Name: Gyazo_cfwoker Value: i

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
gyazo.com
i.gyazo.com
illuminationsbycurtis.com
2.57.122.11
2606:4700::6811:190e
2606:4700::6812:9b2
2a00:1450:4001:802::200a
35.186.213.112
835463245ce736fb98345266ea1aabe0e480c1deea353f054c7b420a39e32fae
ae259af05b2211d86a28c6850e5ac4a9121272dc3b394355334a6b2d65764fe9
d32b8e6980baf4984537bb96ad5380405c1aed75ae609a53bfd80347b5a24a7f
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

illuminationsbycurtis.com Open in urlscan Pro 2.57.122.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

50 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

4 IPs

3 Countries

211 kBTransfer

439 kBSize

1 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

1 Cookies

Indicators

illuminationsbycurtis.com Open in urlscan Pro
2.57.122.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

211 kB
Transfer

439 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!