voba-tanupdate.info Open in urlscan Pro
195.133.13.91  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response voba-tanupdate.info/	11 KB 4 KB	1105ms 205ms	Document text/html	195.133.13.91 RETNNET-AS
General Check archive.org Show headers Download Go to Full URL https://voba-tanupdate.info/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.133.13.91 Moscow, Russian Federation, ASN29470 (RETNNET-AS, RU), Reverse DNS Software nginx / PHP/7.4.33 PleskLin Resource Hash cf3060393ad65560fcbca7f57e70db16f482290544b12e835e50a58a0293cace Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers content-encoding gzip content-length 3782 content-type text/html; charset=UTF-8 date Thu, 11 Jul 2024 15:27:48 GMT server nginx vary Accept-Encoding x-powered-by PHP/7.4.33 PleskLin
GET		6SB9iVqY50zdmvA1 anal-lytics.gay/pixel/	0 0
GET H2	200	bootstrap.min.css cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/	190 KB 28 KB	60ms 30ms	Stylesheet text/css	2606:4700::6812:ba1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/bootstrap.min.css Requested by Host: voba-tanupdate.info URL: https://voba-tanupdate.info/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://voba-tanupdate.info/ Origin https://voba-tanupdate.info User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 11 Jul 2024 15:11:39 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding gzip nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 10366722 x-jsd-version 5.2.3 x-cache HIT, HIT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27506 x-served-by cache-fra-eddf8230122-FRA, cache-lga21962-LGA x-jsd-version-type version server cloudflare etag W/"2f955-d5HdHzFzoNYsw5wh0q1x/I2tDnI" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ISjhAkQX0aHEJR6awdLdKIEV35jVaQvM9aKxEkCuXomCLdcqwm3ZAw4HTne4YdFuOaDM%2FuzVpPtYewO%2F%2F0a%2FHFxrB3R9aqYsLdbHxjHiek3QHRMev5VB0sFYT40BWd11yIuJSx3EREyqKY5tdwk%3D"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable accept-ranges bytes timing-allow-origin * cf-ray 8a19ba316ce19729-FRA
GET H2	200	jquery-3.6.1.min.js Show response code.jquery.com/	88 KB 31 KB	44ms 14ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.1.min.js Requested by Host: voba-tanupdate.info URL: https://voba-tanupdate.info/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74 Request headers Referer https://voba-tanupdate.info/ Origin https://voba-tanupdate.info User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 11 Jul 2024 15:11:39 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 5554618 x-cache HIT, HIT content-length 30957 x-served-by cache-lga13629-LGA, cache-fra-eddf8230044-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1720710700.745722,VS0,VE0 etag W/"28feccc0-15e40" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 2, 105382
GET H3	200	api.js Show response www.google.com/recaptcha/	1 KB 973 B	79ms 43ms	Script text/javascript	172.217.16.196 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: voba-tanupdate.info URL: https://voba-tanupdate.info/ Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.196 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f196.1e100.net Software GSE / Resource Hash 059728b7d37ce9683bbd1a8f8368d77d91e0a4219e5a44a9c4f19fb8fc894391 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://voba-tanupdate.info/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 11 Jul 2024 15:11:39 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block expires Thu, 11 Jul 2024 15:11:39 GMT
GET H/1.1	200 OK	/ Show response pro.ip-api.com/json/	306 B 462 B	85ms 15ms	XHR application/json	51.77.64.70 OVH
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/json/?key=N4PcgVWGrSH8svA Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.1.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.77.64.70 , Germany, ASN16276 (OVH, FR), Reverse DNS de-fra-1.pro.ip-api.com Software / Resource Hash 08cfea04b8ba4f695744671aa7a246257b3236d5e91e8866385ba5ade5c7e062 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://voba-tanupdate.info/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Thu, 11 Jul 2024 15:11:39 GMT Content-Length 306 Content-Type application/json; charset=utf-8
GET H2	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/	536 KB 213 KB	81ms 14ms	Script text/javascript	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0481cf978633d761686dd05ed060c86593d34768aa66d43d61c4f968cbe6b63d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://voba-tanupdate.info/ Origin https://voba-tanupdate.info User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 11 Jul 2024 13:54:30 GMT content-encoding gzip x-content-type-options nosniff age 4629 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 217833 x-xss-protection 0 last-modified Sun, 23 Jun 2024 08:01:07 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Fri, 11 Jul 2025 13:54:30 GMT
GET H3	200	anchor www.google.com/recaptcha/api2/ Frame A8F1	0 0	104ms 55ms	Document text/html	172.217.16.196 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc_EwkqAAAAAPN3r9S4mgBZWJKIVnTqwWMhulRJ&co=aHR0cHM6Ly92b2JhLXRhbnVwZGF0ZS5pbmZvOjQ0Mw..&hl=de&v=rKbTvxTxwcw5VqzrtN-ICwWt&size=normal&cb=uun180798ds6 Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/recaptcha__de.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.196 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f196.1e100.net Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-QA_-y5PY1FhAOMbg2jDlwQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://voba-tanupdate.info/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-QA_-y5PY1FhAOMbg2jDlwQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Thu, 11 Jul 2024 15:11:40 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	404	favicon.ico voba-tanupdate.info/	808 B 501 B	94ms 93ms	Other text/html	195.133.13.91 RETNNET-AS
General Check archive.org Show headers Download Go to Full URL https://voba-tanupdate.info/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.133.13.91 Moscow, Russian Federation, ASN29470 (RETNNET-AS, RU), Reverse DNS Software nginx / Resource Hash b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187 Request headers Referer https://voba-tanupdate.info/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 11 Jul 2024 15:27:49 GMT content-encoding br last-modified Wed, 08 Mar 2023 06:26:32 GMT server nginx etag W/"328-5f65d9bf5e432" content-type text/html
GET H3	200	bframe www.google.com/recaptcha/api2/ Frame 4D6B	0 0	45ms 45ms	Document text/html	172.217.16.196 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/bframe?hl=de&v=rKbTvxTxwcw5VqzrtN-ICwWt&k=6Lc_EwkqAAAAAPN3r9S4mgBZWJKIVnTqwWMhulRJ Requested by Host: www.gstatic.com URL: https://www.gstatic.com/recaptcha/releases/rKbTvxTxwcw5VqzrtN-ICwWt/recaptcha__de.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.16.196 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s08-in-f196.1e100.net Software GSE / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-9qb7NXTym1z6ezl7QKvosQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://voba-tanupdate.info/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding gzip content-security-policy script-src 'report-sample' 'nonce-9qb7NXTym1z6ezl7QKvosQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-type text/html; charset=utf-8 cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Thu, 11 Jul 2024 15:11:40 GMT expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} server GSE x-content-type-options nosniff x-xss-protection 1; mode=block

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

anal-lytics.gay

URL

https://anal-lytics.gay/pixel/6SB9iVqY50zdmvA1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| $ function| jQuery function| CheckRecaptcha function| Reload function| setCookie function| getCookie object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_682251

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			voba-tanupdate.info/	1970-01-20 22:05:42	Name: Allowed Value: TRUE

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://anal-lytics.gay/pixel/6SB9iVqY50zdmvA1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://voba-tanupdate.info/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anal-lytics.gay
cdn.jsdelivr.net
code.jquery.com
pro.ip-api.com
voba-tanupdate.info
www.google.com
www.gstatic.com
anal-lytics.gay
172.217.16.196
195.133.13.91
2606:4700::6812:ba1f
2a00:1450:4001:803::2003
2a04:4e42:600::649
51.77.64.70
0481cf978633d761686dd05ed060c86593d34768aa66d43d61c4f968cbe6b63d
059728b7d37ce9683bbd1a8f8368d77d91e0a4219e5a44a9c4f19fb8fc894391
08cfea04b8ba4f695744671aa7a246257b3236d5e91e8866385ba5ade5c7e062
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
cf3060393ad65560fcbca7f57e70db16f482290544b12e835e50a58a0293cace