www.wfpodarok.ru Open in urlscan Pro
2606:4700:30::681b:9b08  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response www.wfpodarok.ru/vk/	3 KB 2 KB	100ms 94ms	Document text/html	2606:4700:30::681b:9b08 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://www.wfpodarok.ru/vk/ Protocol HTTP/1.1 Server 2606:4700:30::681b:9b08 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e1a4a4af35b61c2c9ae6f9c4273e0cc2bbced0d556ea7905becf4f586cba1893 Request headers Host www.wfpodarok.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 25 Nov 2018 19:12:07 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=dc0b2aceb2b43f46171cfd62663172e0e1543173127; expires=Mon, 25-Nov-19 19:12:07 GMT; path=/; domain=.wfpodarok.ru; HttpOnly Server cloudflare CF-RAY 47f66cccf324bee9-FRA Content-Encoding gzip
GET S	200	fonts_cnt.css vk.com/css/al/	643 KB 486 KB	59ms 58ms	Stylesheet text/css	87.240.129.133 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/css/al/fonts_cnt.css Requested by Host: www.wfpodarok.ru URL: http://www.wfpodarok.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.129.133 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv133-129-240-87.vk.com Software nginx / Resource Hash 37d2493a71736e52813d0701f573a0b048c5cbaffb174d21ebe5984be478147e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer http://www.wfpodarok.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sun, 25 Nov 2018 19:12:07 GMT content-encoding gzip x-frontend front623304 last-modified Thu, 27 Sep 2018 11:44:17 GMT server nginx etag W/"5bacc291-a0d58" strict-transport-security max-age=15768000 content-type text/css status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Thu, 29 Nov 2018 19:12:07 GMT
GET S	200	common.css vk.com/css/al/	333 KB 77 KB	346ms 346ms	Stylesheet text/css	87.240.129.133 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/css/al/common.css Requested by Host: www.wfpodarok.ru URL: http://www.wfpodarok.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.129.133 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv133-129-240-87.vk.com Software nginx / Resource Hash 9a36c044a82df2db4c4d1bc3fa2ddb234f154f15c2406ae46623306b1c9c65ae Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer http://www.wfpodarok.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sun, 25 Nov 2018 19:12:07 GMT content-encoding gzip x-frontend front623304 last-modified Fri, 23 Nov 2018 10:39:44 GMT server nginx etag W/"5bf7d8f0-53366" strict-transport-security max-age=15768000 content-type text/css status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Thu, 29 Nov 2018 19:12:07 GMT
GET S	200	oauth_popup.css vk.com/css/api/	4 KB 2 KB	348ms 348ms	Stylesheet text/css	87.240.129.133 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/css/api/oauth_popup.css Requested by Host: www.wfpodarok.ru URL: http://www.wfpodarok.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.129.133 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv133-129-240-87.vk.com Software nginx / Resource Hash 83971bd09fced7ef47878abf75dfcba48e0b57341b131a6948513eb0235d0406 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer http://www.wfpodarok.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sun, 25 Nov 2018 19:12:07 GMT content-encoding gzip x-frontend front623304 last-modified Fri, 23 Nov 2018 11:47:00 GMT server nginx etag W/"5bf7e8b4-10cc" strict-transport-security max-age=15768000 content-type text/css status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Thu, 29 Nov 2018 19:12:07 GMT
GET S	200	common_light.js Show response vk.com/js/api/	3 KB 1 KB	348ms 348ms	Script application/x-javascript	87.240.129.133 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/js/api/common_light.js Requested by Host: www.wfpodarok.ru URL: http://www.wfpodarok.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.129.133 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv133-129-240-87.vk.com Software nginx / Resource Hash 8d51d3444a0bd5851bc1213cad24cd54d73809210961891c3d9525c03c2206e5 Request headers Referer http://www.wfpodarok.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sun, 25 Nov 2018 19:12:07 GMT content-encoding gzip x-frontend front623304 last-modified Sat, 02 Jun 2018 00:06:22 GMT server nginx etag W/"5b11df7e-db1" content-type application/x-javascript status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Thu, 29 Nov 2018 19:12:07 GMT
GET DATA	200 OK	truncated /	88 KB 0		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ba3627978bd7d98b4294876d73a52f2e74cc4201cdbdaf043cb647042fba699d Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin http://www.wfpodarok.ru Response headers Access-Control-Allow-Origin * Content-Type font/woff
GET S	200	logo_vk.png vk.com/images/	493 B 747 B	56ms 56ms	Image image/png	87.240.129.133 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Show image Full URL https://vk.com/images/logo_vk.png Requested by Host: www.wfpodarok.ru URL: http://www.wfpodarok.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.129.133 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv133-129-240-87.vk.com Software nginx / Resource Hash e7de505c1c69628c07120cc5e298f89e1a2d90370ead5fb0acde8e518c58a88e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer https://vk.com/css/api/oauth_popup.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sun, 25 Nov 2018 19:12:07 GMT x-frontend front623304 last-modified Sat, 02 Jun 2018 00:06:22 GMT server nginx etag "5b11df7e-1ed" strict-transport-security max-age=15768000 content-type image/png status 200 access-control-expose-headers X-Frontend cache-control max-age=604800 accept-ranges bytes content-length 493 expires Sun, 02 Dec 2018 19:12:07 GMT
GET DATA	200 OK	truncated /	87 KB 0		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash da4929f143ad03e5465455bb1cf1333bf060ae7641f0fcf115ea65a30793e180 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin http://www.wfpodarok.ru Response headers Access-Control-Allow-Origin * Content-Type font/woff
GET DATA	200 OK	truncated /	88 KB 0		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a8968be35c05d541ccd4eb1c4af41cb3b27f470986c85cb23062ace8938828a9 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin http://www.wfpodarok.ru Response headers Access-Control-Allow-Origin * Content-Type font/woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vkontakte (Social Network)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| ge function| trim function| hasClass function| addClass function| removeClass function| isChecked function| checkbox function| parseJSON function| show function| hide function| domInsertBefore function| showProgress function| re function| hideProgress function| lockButton function| unlockButton function| isButtonLocked

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.wfpodarok.ru/	1970-01-19 05:25:09	Name: __cfduid Value: dc0b2aceb2b43f46171cfd62663172e0e1543173127

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

vk.com
www.wfpodarok.ru
2606:4700:30::681b:9b08
87.240.129.133
37d2493a71736e52813d0701f573a0b048c5cbaffb174d21ebe5984be478147e
83971bd09fced7ef47878abf75dfcba48e0b57341b131a6948513eb0235d0406
8d51d3444a0bd5851bc1213cad24cd54d73809210961891c3d9525c03c2206e5
9a36c044a82df2db4c4d1bc3fa2ddb234f154f15c2406ae46623306b1c9c65ae
a8968be35c05d541ccd4eb1c4af41cb3b27f470986c85cb23062ace8938828a9
ba3627978bd7d98b4294876d73a52f2e74cc4201cdbdaf043cb647042fba699d
da4929f143ad03e5465455bb1cf1333bf060ae7641f0fcf115ea65a30793e180
e1a4a4af35b61c2c9ae6f9c4273e0cc2bbced0d556ea7905becf4f586cba1893
e7de505c1c69628c07120cc5e298f89e1a2d90370ead5fb0acde8e518c58a88e