rhl-brua2.kylinvc.com
Open in
urlscan Pro
2606:4700:3034::681b:8cd6
Malicious Activity!
Public Scan
Effective URL: https://rhl-brua2.kylinvc.com/tz?lm=aYVwlGppa2KEmLqxy5qmnnx0YqeCjIx0fGBpYsBxj2o/david.summers%40ce.com.au
Submission: On April 07 via manual from AU
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on February 20th 2020. Valid for: 8 months.
This is the only time rhl-brua2.kylinvc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 2606:4700:303... 2606:4700:3036::681c:1a7f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
19 | 2606:4700:303... 2606:4700:3034::681b:8cd6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:85e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:12b7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:821::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:800::2003 | 15169 (GOOGLE) (GOOGLE) | |
25 | 5 |
ASN13335 (CLOUDFLARENET, US)
trk-beet.caar-international.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
kylinvc.com
rhl-brua2.kylinvc.com |
1 MB |
3 |
gstatic.com
fonts.gstatic.com |
27 KB |
2 |
caar-international.com
2 redirects
trk-beet.caar-international.com |
969 B |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
wonderpush.com
cdn.by.wonderpush.com |
1 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
6 KB |
25 | 6 |
Domain | Requested by | |
---|---|---|
19 | rhl-brua2.kylinvc.com |
rhl-brua2.kylinvc.com
|
3 | fonts.gstatic.com |
rhl-brua2.kylinvc.com
|
2 | trk-beet.caar-international.com | 2 redirects |
1 | fonts.googleapis.com |
rhl-brua2.kylinvc.com
|
1 | cdn.by.wonderpush.com |
rhl-brua2.kylinvc.com
|
1 | cdnjs.cloudflare.com |
rhl-brua2.kylinvc.com
|
25 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
mtp.capitalrtv.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2020-02-20 - 2020-10-09 |
8 months | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
*.by.wonderpush.com Gandi Standard SSL CA 2 |
2019-05-27 - 2020-06-21 |
a year | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-03-24 - 2020-06-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://rhl-brua2.kylinvc.com/tz?lm=aYVwlGppa2KEmLqxy5qmnnx0YqeCjIx0fGBpYsBxj2o/david.summers%40ce.com.au
Frame ID: 719D9FEC0F44EE363A63020DB281AA41
Requests: 25 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://trk-beet.caar-international.com/ga/click/2-4977950-337-3852-7446-7705-73f17a2db0-e2647c6feb
HTTP 301
https://trk-beet.caar-international.com/ga/click/2-4977950-337-3852-7446-7705-73f17a2db0-e2647c6feb HTTP 302
https://rhl-brua2.kylinvc.com/tz?lm=aYVwlGppa2KEmLqxy5qmnnx0YqeCjIx0fGBpYsBxj2o/david.summers%40ce.com.au Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
animate.css (Web Frameworks) Expand
Detected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: (310) Apple iPhone 11 Normal Price: R8490 Today's Price: R0.00Shipping:: R200Qty Left: 1I’ll Choose This23 users have chosen this reward
Search URL Search Domain Scan URL
Title: (328) Huawei P30 Pro Normal Price: R20022Today's Price: R0.00Shipping: R25Qty Left: 2I’ll Choose This48 users have chosen this reward
Search URL Search Domain Scan URL
Title: (328) Apple iPhone XS Normal Price: R20022Today's Price: R0.00Shipping: R249Qty Left: 2I’ll Choose This48 users have chosen this reward
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://trk-beet.caar-international.com/ga/click/2-4977950-337-3852-7446-7705-73f17a2db0-e2647c6feb
HTTP 301
https://trk-beet.caar-international.com/ga/click/2-4977950-337-3852-7446-7705-73f17a2db0-e2647c6feb HTTP 302
https://rhl-brua2.kylinvc.com/tz?lm=aYVwlGppa2KEmLqxy5qmnnx0YqeCjIx0fGBpYsBxj2o/david.summers%40ce.com.au Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
tz
rhl-brua2.kylinvc.com/ Redirect Chain
|
26 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
118 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.css
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
56 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custome.css
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
26 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
36 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wonderpush-loader.min.js
cdn.by.wonderpush.com/sdk/1.1/ |
887 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.jpg
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
newbnrs.jpg
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
612 KB 613 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
calling-girl1.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
304 KB 305 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gift.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
871 B 956 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
11.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p30.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
74 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xs.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
social-icon.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ssl.png
rhl-brua2.kylinvc.com/allcustomfiles/ZA-Spar-2020/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
25 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| WonderPush function| chkvali function| partstep function| toSimpleJson function| startTimer function| what0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.by.wonderpush.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
rhl-brua2.kylinvc.com
trk-beet.caar-international.com
2606:4700:3034::681b:8cd6
2606:4700:3036::681c:1a7f
2606:4700::6810:85e5
2606:4700::6812:12b7
2a00:1450:4001:800::2003
2a00:1450:4001:821::200a
01522549a0a0a1d2b0c677a23d6bfeb299e2f19cd51ef502ca2446478c0c2aef
20edf9b12140a37b26d49323ce2cd0ca145f7032450ecea3664cffb1255368c1
21d4a7860aca1e16713c9a30b9243c45475aeafe774a09d573e8080fbf50f3d2
2d07dc950069456f7216f32a6f5d5d299948b021d64035edca161089bf8edc1d
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
59a1460df6cb458204ec993345ff4964fa7e1a77da4ab7137e50fce8434c1d6a
5d713a967b6bead9d59a92a820e6cf80e60fa945cd2dfce4a3bfea56f90a392b
79223032a62e7c710d93015f8d9cc699999e5b4dadf3a7c4363851d859e74bbb
8e93cb373931ef7f1823f95ac826c32096334b8261a0d6c91c82637e1c7c1dfd
93627ecbb6b08e6ec610c20b36d0d2cfa5c850187ba77fa994ab76974c7ffa61
a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
b2284cb536284aa9c29aa5c2943a2a53e8fe4457e89de12fe63ebf2ad032c8c3
b5efbd155f5f4ff8ef070debc54e7630f495edda4610e5f5b4e2d3b4c00eb62c
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bcc19857d61a70683071426a9452fb4190deefd86ae0554cbd596d6960f367d8
d3fb385aad2757e720c0e49ca0b807172ff255ad2dc2bf4b1998e632297800a9
dd504221f5066c57a04ecc1e0f9b77fd215c18cb24376a8f4e39aec2e57ca9e3
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
df13e56d096613520c4bd81943a4894c2779749e1b13affccf6a05f4d3adf2aa
f39bdaf48348cc7bdbc75fd7cb71e7561929db8313c09c382fd288c26e7c59b5
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fbc30effbaf9ff7d432c502145b9b90b67ff39bf2bdfba516c504d967b5909f2
fe4d5471407a3c85c70952dd43b4c2aafb5e9409f2e9a48e7dfa37330e112f03