shop.kandns.us - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 2606:4700:3030::6818:701d, located in United States and belongs to CLOUDFLARENET, US. The main domain is shop.kandns.us.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 18th 2020. Valid for: a year.

This is the only time shop.kandns.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayPal (Financial)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3030::6818:701d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::2001	15169 (GOOGLE) (GOOGLE)
5	2

4 2606:4700:3030::6818:701d (United States)

ASN13335 (CLOUDFLARENET, US)

shop.kandns.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

beltornado2020.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	kandns.us shop.kandns.us	36 KB
1	blogspot.com beltornado2020.blogspot.com
5	2

	Domain	Requested by
4	shop.kandns.us	shop.kandns.us
1	beltornado2020.blogspot.com	shop.kandns.us
5	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-18` - `2021-08-18`	a year	crt.sh
misc-sni.blogspot.com GTS CA 1O1	`2020-08-11` - `2020-11-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://shop.kandns.us/service/home/signin/
Frame ID: D49B5A1E47BD2E1B12077C4B2621D3CB
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

36 kB
Transfer

113 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response shop.kandns.us/service/home/signin/	9 KB 3 KB	1555ms 1525ms	Document text/html	2606:4700:3030::6818:701d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://shop.kandns.us/service/home/signin/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6818:701d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e52ff6f2bd05f324a44024d0b05ad697f233459a91b44e502dbee09dbb2f5f84` Request headers :method GET :authority shop.kandns.us :scheme https :path /service/home/signin/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 date Thu, 27 Aug 2020 02:57:19 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d71f7eff9661a7f8675d22b17ac8008831598497038; expires=Sat, 26-Sep-20 02:57:18 GMT; path=/; domain=.kandns.us; HttpOnly; SameSite=Lax PHPSESSID=a7f86660789182e3c6d24ca77a5fa0a6; path=/ expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache vary Accept-Encoding,User-Agent cf-cache-status DYNAMIC cf-request-id 04cf7236d10000c2723e1d5200000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 5c928637bcfbc272-FRA content-encoding br
GET H2	200	login.css shop.kandns.us/service/home/assets/main/styles/	15 KB 3 KB	583ms 582ms	Stylesheet text/css	2606:4700:3030::6818:701d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://shop.kandns.us/service/home/assets/main/styles/login.css Requested by Host: shop.kandns.us URL: https://shop.kandns.us/service/home/signin/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6818:701d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4b0df061fe264bbc633c5886fbc1f9013d93857cb5d793e01654100d0c208f88` Request headers Referer https://shop.kandns.us/service/home/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 27 Aug 2020 02:57:20 GMT content-encoding br cf-cache-status MISS last-modified Thu, 27 Aug 2020 00:38:49 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type text/css status 200 cache-control max-age=14400 cf-ray 5c9286414eefc272-FRA cf-request-id 04cf723cca0000c2723e1fd200000001
GET H2	200	jquery.min.js Show response shop.kandns.us/service/home/assets/vendors/scripts/	85 KB 29 KB	730ms 730ms	Script application/javascript	2606:4700:3030::6818:701d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://shop.kandns.us/service/home/assets/vendors/scripts/jquery.min.js Requested by Host: shop.kandns.us URL: https://shop.kandns.us/service/home/signin/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6818:701d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f` Request headers Referer https://shop.kandns.us/service/home/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 27 Aug 2020 02:57:20 GMT content-encoding br cf-cache-status MISS last-modified Thu, 27 Aug 2020 00:38:49 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type application/javascript status 200 cache-control max-age=14400 cf-ray 5c9286414ef1c272-FRA cf-request-id 04cf723cca0000c2723e1fe200000001
GET H2	200	logo-129x32.svg shop.kandns.us/service/home/assets/main/images/	5 KB 2 KB	583ms 583ms	Image image/svg+xml	2606:4700:3030::6818:701d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://shop.kandns.us/service/home/assets/main/images/logo-129x32.svg Requested by Host: shop.kandns.us URL: https://shop.kandns.us/service/home/assets/main/styles/login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6818:701d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5` Request headers Referer https://shop.kandns.us/service/home/assets/main/styles/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 27 Aug 2020 02:57:20 GMT content-encoding br cf-cache-status MISS last-modified Thu, 27 Aug 2020 00:38:49 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent content-type image/svg+xml status 200 cache-control max-age=14400 cf-ray 5c928645fc5dc272-FRA cf-request-id 04cf723fb60000c2723e211200000001
GET H2	200	/ beltornado2020.blogspot.com/	0 0	193ms 172ms	Image text/html	2a00:1450:4001:802::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://beltornado2020.blogspot.com/ Requested by Host: shop.kandns.us URL: https://shop.kandns.us/service/home/assets/main/styles/login.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://shop.kandns.us/service/home/assets/main/styles/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayPal (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| $ function| jQuery function| validatePayForm

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			shop.kandns.us/	1969-12-31 23:59:59	Name: PHPSESSID Value: a7f86660789182e3c6d24ca77a5fa0a6
			.kandns.us/	1970-01-19 12:44:49	Name: __cfduid Value: d71f7eff9661a7f8675d22b17ac8008831598497038

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

beltornado2020.blogspot.com
shop.kandns.us
2606:4700:3030::6818:701d
2a00:1450:4001:802::2001
4b0df061fe264bbc633c5886fbc1f9013d93857cb5d793e01654100d0c208f88
b3cc50b9e94bbecaaeb1079b64b8ca50616d1732824964c1cc2c5422627a0ec5
d3a518dea876de39f9e5dc1ffcdeb6c661aee25d8a62474386b664ef3bf1b40f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e52ff6f2bd05f324a44024d0b05ad697f233459a91b44e502dbee09dbb2f5f84

shop.kandns.us Open in urlscan Pro 2606:4700:3030::6818:701d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

36 kBTransfer

113 kBSize

2 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

2 Cookies

Indicators

shop.kandns.us Open in urlscan Pro
2606:4700:3030::6818:701d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

36 kB
Transfer

113 kB
Size

2
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!