www.kavalager.com
Open in
urlscan Pro
2606:4700:30::6812:30b6
Malicious Activity!
Public Scan
Effective URL: https://www.kavalager.com/survey/12973/source=5a16a196d6587e2247f99008/subid=5a16a196d6587e2247f99008&firstname=&lastname=...
Submission: On March 24 via manual from SG
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on December 11th 2018. Valid for: a year.
This is the only time www.kavalager.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.38.131.251 54.38.131.251 | 16276 (OVH) (OVH) | |
1 1 | 2606:4700:30:... 2606:4700:30::681b:aae8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
14 | 2606:4700:30:... 2606:4700:30::6812:30b6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
4 | 2a00:1450:400... 2a00:1450:4001:81b::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 52.219.72.143 52.219.72.143 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
2 | 2a00:1450:400... 2a00:1450:4001:819::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
22 | 4 |
ASN16276 (OVH, FR)
PTR: ip251.ip-54-38-131.eu
q4.youpicknext.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.qareeba.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.kavalager.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3.eu-central-1.amazonaws.com
s3-eu-central-1.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
kavalager.com
www.kavalager.com |
135 KB |
4 |
googleapis.com
fonts.googleapis.com |
2 KB |
2 |
gstatic.com
fonts.gstatic.com |
26 KB |
2 |
amazonaws.com
s3-eu-central-1.amazonaws.com |
118 KB |
1 |
qareeba.com
1 redirects
www.qareeba.com |
548 B |
1 |
youpicknext.com
1 redirects
q4.youpicknext.com |
1 KB |
22 | 6 |
Domain | Requested by | |
---|---|---|
14 | www.kavalager.com |
www.kavalager.com
|
4 | fonts.googleapis.com |
www.kavalager.com
|
2 | fonts.gstatic.com |
www.kavalager.com
|
2 | s3-eu-central-1.amazonaws.com |
www.kavalager.com
|
1 | www.qareeba.com | 1 redirects |
1 | q4.youpicknext.com | 1 redirects |
22 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2018-12-11 - 2019-12-11 |
a year | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-03-01 - 2019-05-24 |
3 months | crt.sh |
*.s3.eu-central-1.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-11-08 - 2019-11-06 |
a year | crt.sh |
*.google.com Google Internet Authority G3 |
2019-03-01 - 2019-05-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.kavalager.com/survey/12973/source=5a16a196d6587e2247f99008/subid=5a16a196d6587e2247f99008&firstname=&lastname=&email=&address=/nrp=5c974b7f50480505e0e5997b
Frame ID: 80B92688C9EA3C77AE8B82DB82DC80A7
Requests: 22 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://q4.youpicknext.com/link/98bc64fa38e1ea2e7e328c2e1328ad57/550efdd203dd27ede9572fdcaf945f2e
HTTP 302
https://www.qareeba.com/tracking/58c29ee4e7f63f4c290e112b?src=5a16a196d6587e2247f99008&s1=&s2=op&s3=... HTTP 302
https://www.kavalager.com/survey/12973/source=5a16a196d6587e2247f99008/subid=5a16a196d6587e2247f99008&... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
- script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://q4.youpicknext.com/link/98bc64fa38e1ea2e7e328c2e1328ad57/550efdd203dd27ede9572fdcaf945f2e
HTTP 302
https://www.qareeba.com/tracking/58c29ee4e7f63f4c290e112b?src=5a16a196d6587e2247f99008&s1=&s2=op&s3=&s4=&s5=&k=5c5d44b8d8c8532390e6bebe HTTP 302
https://www.kavalager.com/survey/12973/source=5a16a196d6587e2247f99008/subid=5a16a196d6587e2247f99008&firstname=&lastname=&email=&address=/nrp=5c974b7f50480505e0e5997b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
nrp=5c974b7f50480505e0e5997b
www.kavalager.com/survey/12973/source=5a16a196d6587e2247f99008/subid=5a16a196d6587e2247f99008&firstname=&lastname=&email=&address=/ Redirect Chain
|
36 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
backend.css
www.kavalager.com/css/ |
2 KB 729 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.css
www.kavalager.com/css/ |
144 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
www.kavalager.com/js/ |
278 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.js
www.kavalager.com/js/ |
67 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.cookie.js
www.kavalager.com/js/plugins/jqueryCookie/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
simple_green4.css
www.kavalager.com/css/tpl_css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
currency_cnd2.js
www.kavalager.com/custom_js/ |
1 KB 527 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 540 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue_notys3.css
www.kavalager.com/css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prof_pic.png
www.kavalager.com/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
public.png
www.kavalager.com/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.kavalager.com/uploads/products/ |
571 B 571 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 581 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
20170517113334_check.png
www.kavalager.com/uploads/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
763 B 386 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 700 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
topmenu_newhbo.jpg
s3-eu-central-1.amazonaws.com/igamingcloudstr/images/ |
14 KB 14 KB |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background3_incode_newhbo.jpg
s3-eu-central-1.amazonaws.com/igamingcloudstr/images/ |
104 KB 104 KB |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTURjIg1_i6t8kCHKm45_dJE3gnD_vx3rCs.woff2
fonts.gstatic.com/s/montserrat/v12/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
JTUSjIg1_i6t8kCHKm459WlhyyTh89Y.woff2
fonts.gstatic.com/s/montserrat/v12/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
survey
www.kavalager.com/survey/ |
73 B 434 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| jQuery11130006080580540210656 function| countdown number| numRight number| numQuestions object| answerDiv object| questionDiv object| numRightSpan object| numQuestionsSpan function| displayQuestion function| startTimer function| rand function| myRedirectTimer function| stopRedirectTimer function| show_answer_btn number| checkTimer string| survey_id object| btn4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
www.kavalager.com/ | Name: survey_id_14917 Value: true |
|
www.kavalager.com/ | Name: b2ZmZXJXYWxs Value: %7B%22campaign%22%3A%2212973%22%2C%22survey%22%3A%2214917%22%2C%22source%22%3A%225a16a196d6587e2247f99008%22%2C%22subid%22%3A%22subid%3D5a16a196d6587e2247f99008%26firstname%3D%26lastname%3D%26email%3D%26address%3D%22%2C%22firstSession%22%3A%22mle1fDwJHcd696Vzm7dw8UcfCMbqtsAp0XhQfMk1_12973%22%7D |
|
www.kavalager.com/ | Name: laravel_session Value: eyJpdiI6IjFMVHJiMjhucmh3T0hUUmI1ZmZxNGc9PSIsInZhbHVlIjoiVFp5V09XcENTaHJRYXRqRE5oaWpBMHlFXC9IamNmZFBSRlRMalpzYUVValwvd0hmWW5YdlNTcXNNWlB0YVI5VGx4amExeWdtRVhVM2psSFFDYzl2b3VpQT09IiwibWFjIjoiMTA4NmYyN2FlYjY0MWY2NmZjNWI2ODdlOTFjMjVlNTMxZDllMGY5MmFiYmUzMWFiYzczODc4ZTgwZmYyNTdkYyJ9 |
|
.kavalager.com/ | Name: __cfduid Value: da4318150dcf7f5c1036b43d83b9b92271553419135 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
q4.youpicknext.com
s3-eu-central-1.amazonaws.com
www.kavalager.com
www.qareeba.com
2606:4700:30::6812:30b6
2606:4700:30::681b:aae8
2a00:1450:4001:819::2003
2a00:1450:4001:81b::200a
52.219.72.143
54.38.131.251
04bdf7a7f188c4aa11765dd32f67e30c23bd4c20aea5067e37c14c1a6f8a6b20
112171d811a0dc267552419e2bc4766da6655e3992857757001866f0cb0c4a25
2065aecca0fb9b0567358d352ed5f1ab72fce139bf449b4d09805f5d9c3725ed
2897f490eaee6fd3c20a755839a30d051c2b4423a9cbc1af2a6d8a05c15e9154
3ff817f9993de055634774310a26061f2feafbccfaad8aaa6bfb9e4d6fe5ce94
50e7e16fa947036ed479023375a7a44597c72dcc780c110ddb87a28cfa7fd16c
54685db07aca72f8729aafc7d545ad6cd2804361d9d1960a48c20a5bc02967f9
698f77305cc3cc72ecd4caa6a074c93356c02cb69c602f49039a50ff9e329254
ad00b579caf455c9dc60bf2cf178a56634ebdd2a2f6ea3a47d28a6bf7b8dd762
ae88db06df66fada6bd19661950611c6a69796df07f7a97991ec8db92c124af7
af0b1d3088755d3bfff4c14b6a9d495a1697c24875303f6b2285b931e683bf5f
b24eb9638260837328cb57cc88a42c7472eebcef0d23ad953073901d3bf41c6d
b336ee919770f24464a0092df7f6abc78383d7c7054174713908b4b079cdae2e
b84161c9fbf7520cd14e7019f92120bd87a928a074156e91a992eba9fc9436e8
bc686bee454b25fceccc2b62076fb139811940ab579c1601cb6d8321b815cbd6
bcd5566fa10f5136b8696011aeead1304594441e672de88838ac761256d9a99b
c345fc13257023a5594f0be4a3b4643774ebfcba01a95d53c7842515d500ae7c
c3dad67a08080a266e21b05646996aa41c3c9cd4f65cb902916d6a76978baa0b
d7793635b3a67ad46bb0f738f17326d1d4de4ef3e9a2a2ee4ac4e318a77dabd0
de8025dffc57069d02c00a3640796dec23114f51af54c209b8fee272d8d0ecd6
ef43a4d502ffb688656851d788c42869d47e8840d007b4f4b66f62530171acd4
ef9c554bca3ce5b9f978b626ff8c3a441c0468af2599bdb4e9b6b32f6743f058