urlscan.io logo urlscan.io
SecurityTrails logo

badproduccion.com Open in urlscan Pro
193.17.92.95  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://badproduccion.com/zvhr/
Submission: On April 07 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 193.17.92.95, located in Moscow, Russian Federation and belongs to ZTVCORP-AS, RU. The main domain is badproduccion.com.
TLS certificate: Issued by R3 on April 6th 2024. Valid for: 3 months.
This is the only time badproduccion.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
7 193.17.92.95 43581 (ZTVCORP-AS)
8 2
Apex Domain
Subdomains		 Transfer
7 badproduccion.com
badproduccion.com
470 KB
8 1
Domain Requested by
7 badproduccion.com badproduccion.com
8 1

This site contains no links.

Subject Issuer Validity Valid
badproduccion.com
R3		 2024-04-06 -
2024-07-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://badproduccion.com/zvhr/
Frame ID: 85423A4CB4A4F32467898D8C68786E7D
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Главная

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

470 kB
Transfer

467 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
badproduccion.com/zvhr/ 		355 B
757 B 		Document
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/zvhr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
cbb20c331c87e6d25481d5e56ad9a2202eb9757af4e171104a961b92960b6093

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-US,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
access-control-max-age
3628800
cache-control
public, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sun, 07 Apr 2024 15:11:51 GMT
etag
W/"163-18defcef008"
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
index-affbc48c.js
badproduccion.com/zvhr/assets/ 		265 KB
265 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/zvhr/assets/index-affbc48c.js
Requested by
Host: badproduccion.com
URL: https://badproduccion.com/zvhr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
2a32f987b6641bef1e3da0af267d4de2b3c753275409fcb0d85ae36725a064f8

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://badproduccion.com/zvhr/
Origin
https://badproduccion.com
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 07 Apr 2024 15:11:52 GMT
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
etag
W/"42200-18defcef008"
access-control-max-age
3628800
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
270848
index-62abddb2.css
badproduccion.com/zvhr/assets/ 		202 KB
202 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/zvhr/assets/index-62abddb2.css
Requested by
Host: badproduccion.com
URL: https://badproduccion.com/zvhr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
62abddb23181d4e77fbeec5b5bc80f6577b46da5a2be68c08dc26880f65e4cd6

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://badproduccion.com/zvhr/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 07 Apr 2024 15:11:52 GMT
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
etag
W/"3271d-18defcef008"
access-control-max-age
3628800
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
206621
/
badproduccion.com/socket.io/ 		118 B
468 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/socket.io/?EIO=4&transport=polling&t=Owv7Qiq
Requested by
Host: badproduccion.com
URL: https://badproduccion.com/zvhr/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
ee876ddbe206c2dd969bf83ff363d814e3aec087cb2291d03d209f45f2e99045

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept
*/*
Referer
https://badproduccion.com/zvhr/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 07 Apr 2024 15:11:53 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
118
favicon.ico
badproduccion.com/ 		0
0
/
badproduccion.com/socket.io/ 		2 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/socket.io/?EIO=4&transport=polling&t=Owv7QoQ&sid=lJKY_IbuucyE8CUZAF5F
Requested by
Host: badproduccion.com
URL: https://badproduccion.com/zvhr/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-type
text/plain;charset=UTF-8
Accept
*/*
Referer
https://badproduccion.com/zvhr/
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 07 Apr 2024 15:11:53 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/html
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
2
/
badproduccion.com/socket.io/ 		32 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/socket.io/?EIO=4&transport=polling&t=Owv7QoR&sid=lJKY_IbuucyE8CUZAF5F
Requested by
Host: badproduccion.com
URL: https://badproduccion.com/zvhr/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
f54a7512a5fc6cbba3ea0b7303e6ea9e6e052b43d5f76099c9f84ef6fc26a4f9

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept
*/*
Referer
https://badproduccion.com/zvhr/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 07 Apr 2024 15:11:53 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
32
/
badproduccion.com/socket.io/ 		1 B
349 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://badproduccion.com/socket.io/?EIO=4&transport=polling&t=Owv7QuD&sid=lJKY_IbuucyE8CUZAF5F
Requested by
Host: badproduccion.com
URL: https://badproduccion.com/zvhr/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
193.17.92.95 Moscow, Russian Federation, ASN43581 (ZTVCORP-AS, RU),
Reverse DNS
ztv.su
Software
stormwall /
Resource Hash
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept
*/*
Referer
https://badproduccion.com/zvhr/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 07 Apr 2024 15:11:54 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
badproduccion.com
URL
https://badproduccion.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| __VUE__

1 Cookies

Domain/Path Name / Value
badproduccion.com/ Name: Auth
Value: 90e6891c98dc12cbcf6853505065b069

1 Console Messages

Source Level URL
Text
network error URL: https://badproduccion.com/favicon.ico
Message:
Failed to load resource: net::ERR_HTTP2_PROTOCOL_ERROR