urlscan.io logo urlscan.io
SecurityTrails logo

entdark.net Open in urlscan Pro
2606:4700:3032::ac43:d2f1  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Effective URL: https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Submission Tags: 0xscam
Submission: On October 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3032::ac43:d2f1, located in United States and belongs to CLOUDFLARENET, US. The main domain is entdark.net.
TLS certificate: Issued by WE1 on September 11th 2024. Valid for: 3 months.
This is the only time entdark.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 172.67.210.241 13335 (CLOUDFLAR...)
2 104.18.95.41 13335 (CLOUDFLAR...)
9 4
Apex Domain
Subdomains		 Transfer
5 entdark.net
entdark.net
85 KB
2 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3443
16 KB
9 2
Domain Requested by
5 entdark.net entdark.net
2 challenges.cloudflare.com entdark.net
challenges.cloudflare.com
9 2

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
entdark.net
WE1		 2024-09-11 -
2024-12-10		 3 months crt.sh
challenges.cloudflare.com
WE1		 2024-09-05 -
2024-12-04		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Frame ID: 414D8D5690075C07661E37A071AFD8C7
Requests: 6 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/im3kb/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/
Frame ID: 870B381B67802E29ABAE98195C01CCD8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Nur einen Moment…

Page URL History Show full URLs

  1. http://entdark.net/2022/09/zanubis-latam-banking-trojan.html HTTP 307
    https://entdark.net/2022/09/zanubis-latam-banking-trojan.html Page URL

Page Statistics

9
Requests

78 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

101 kB
Transfer

235 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://entdark.net/2022/09/zanubis-latam-banking-trojan.html HTTP 307
    https://entdark.net/2022/09/zanubis-latam-banking-trojan.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request zanubis-latam-banking-trojan.html
entdark.net/2022/09/
Redirect Chain
  • http://entdark.net/2022/09/zanubis-latam-banking-trojan.html
  • https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
12 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:d2f1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6de0790e9b4d37d3c8da119938a49bf4281199c7b8239071db376aa773bfbe4
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out
GaO2BYMbKJga7MKS0GB9hdVmOZdSUiJlfyaRYPlCUrspYOdRQuQ8K80oRzb7+OGCkTLshKX673I22jrbqsGbE/Zdpz6Hi62I+XZV/oJlhcI=$MU2vh8Amip7+A2KJ/blLbw==
cf-mitigated
challenge
cf-ray
8d617803e96c37de-FRA
content-encoding
zstd
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Mon, 21 Oct 2024 13:07:07 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ha%2B95HpwIDPQ5tAJAMwvrqgr%2FCGHuq34i0R%2BG77u38V1Mm8qQMjKvWW0o00Lt5u8CzrnML0295Qxuncupt37OT919S3xNUMGGoYPDjXH4DUxiDN%2FhCmi%2FioN3StV6u6JRv5lXRmyUsQ7OA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=31595&sent=6&recv=10&lost=0&retrans=0&sent_bytes=3942&recv_bytes=2285&delivery_rate=94146&cwnd=252&unsent_bytes=0&cid=e6b286daa3b77149&ts=340&x=0"
vary
Accept-Encoding
x-content-options
nosniff
x-frame-options
SAMEORIGIN

Redirect headers

Location
https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Non-Authoritative-Reason
HttpsUpgrades
v1
entdark.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ 		157 KB
60 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://entdark.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d617803e96c37de
Requested by
Host: entdark.net
URL: https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.210.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
133c4a8418ada5eca8dd6ac0ef262bc8ffb8146eed9a15e6bbe1927b695cd301

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://entdark.net/2022/09/zanubis-latam-banking-trojan.html?__cf_chl_rt_tk=7sKtyrkIiHWg_iVWet.DIL97viQ77ICFLpRalo7ba4o-1729516027-1.0.1.1-T9FkxCQrLBMGObsqT9kshzjNGne98eYPkD4SLzcEjU8

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BMffWZqJSDV5HgqujwkSy97X7rp1HiYwaOKFiiKnRTvM5Hu03efIYaQX6no4oWkL%2FAj%2Fsf2rcyD79xcToe7pWCz%2BGJsSGMRpFEvhAJODNH%2BZH0om2z%2BkqiblJnTTVA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d617807ba6a22da-ORD
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=135922&sent=15&recv=8&lost=4&retrans=7&sent_bytes=4840&recv_bytes=4452&delivery_rate=1059&cwnd=8400&unsent_bytes=0&cid=ac5b5083d05a7cb8&ts=950&x=1", cfExtPri, cfHdrFlush;dur=0
date
Mon, 21 Oct 2024 13:07:08 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
priority
u=3,i=?0
36468728-ce5f-48a4-833f-f1dfd545dc31
https://entdark.net/ Frame 		0
0
api.js
challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/ 		46 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js?onload=DXjyL6&render=explicit
Requested by
Host: entdark.net
URL: https://entdark.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d617803e96c37de
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ea786910282df7ae154a0011375cd1254adbd8ef0e75eb62177ada67daf9611

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://entdark.net
Referer

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
8d61780a5aa0d272-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Mon, 21 Oct 2024 13:07:08 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 01 Oct 2024 14:19:56 GMT
server
cloudflare
vary
Accept-Encoding
favicon.ico
entdark.net/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://entdark.net/favicon.ico
Requested by
Host: entdark.net
URL: https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.210.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f25fd0260c4ef8c26a87a5a126634e846ba539c75e5d508103f4d98831654a5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://entdark.net/2022/09/zanubis-latam-banking-trojan.html

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmdnRuyyg5cA4lj51fV69o5fcq%2FuymMheImVOsHDGP3XhwxeoYSBuzSpt5fEjPMtqqGSyz2s4yx0mzsTJC2COVTXv0DgIFvHC5xNKLqE9s3J1pXpmxB3najNCnxNjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d61780a7e3b22da-ORD
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=151186&sent=72&recv=39&lost=4&retrans=7&sent_bytes=68016&recv_bytes=6110&delivery_rate=195776&cwnd=8400&unsent_bytes=0&cid=ac5b5083d05a7cb8&ts=1431&x=1", cfExtPri, cfHdrFlush;dur=0
date
Mon, 21 Oct 2024 13:07:08 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i
x-frame-options
SAMEORIGIN
8aefdf0d150645d
entdark.net/cdn-cgi/challenge-platform/h/b/flow/ov1/1615284535:1729514229:CHKZXhCuQllP9Vc3EvA5jO0VltRO4WbFXEMYnYRhFio/8d617803e96c37de/ 		16 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://entdark.net/cdn-cgi/challenge-platform/h/b/flow/ov1/1615284535:1729514229:CHKZXhCuQllP9Vc3EvA5jO0VltRO4WbFXEMYnYRhFio/8d617803e96c37de/8aefdf0d150645d
Requested by
Host: entdark.net
URL: https://entdark.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8d617803e96c37de
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.210.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
972d5e1052beab2c7dfbf6f402602d524c4dad64084841ed0f5a594255533ff9

Request headers

Referer
https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded
CF-Challenge
8aefdf0d150645d

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AQjg6ZiBNf94yhzFVdBmEeXO88dUYOGXv%2FEKdrzv%2FsGQdRmNJVv%2FYzUPxz3w8yh2NVnXSh6JrebCofr3FrknpTots478bszGZjQSagSy%2FWO7iuTKcX3lzXJd8VQn6g%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d61780b2f1f22da-ORD
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=151186&sent=76&recv=42&lost=4&retrans=7&sent_bytes=69542&recv_bytes=8535&delivery_rate=195776&cwnd=8400&unsent_bytes=0&cid=ac5b5083d05a7cb8&ts=1518&x=1", cfExtPri, cfHdrFlush;dur=0
date
Mon, 21 Oct 2024 13:07:08 GMT
content-type
text/plain; charset=UTF-8
cf-chl-gen
SKq3RyiBBHDWf46hiRt5lPJ7ny4a8W1vxpxBnfZFNJYk96iUKWy/YCliiXy59LnUAdnGj5XOOA==$YtduuD6/aQc8bXb1
server
cloudflare
priority
u=1,i
favicon.ico
entdark.net/ 		2 KB
0 		Other
General
Check archive.org
Download Go to
Full URL
https://entdark.net/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.210.241 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f25fd0260c4ef8c26a87a5a126634e846ba539c75e5d508103f4d98831654a5
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://entdark.net/2022/09/zanubis-latam-banking-trojan.html

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
EXPIRED
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WmdnRuyyg5cA4lj51fV69o5fcq%2FuymMheImVOsHDGP3XhwxeoYSBuzSpt5fEjPMtqqGSyz2s4yx0mzsTJC2COVTXv0DgIFvHC5xNKLqE9s3J1pXpmxB3najNCnxNjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d61780a7e3b22da-ORD
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=151186&sent=72&recv=39&lost=4&retrans=7&sent_bytes=68016&recv_bytes=6110&delivery_rate=195776&cwnd=8400&unsent_bytes=0&cid=ac5b5083d05a7cb8&ts=1431&x=1", cfExtPri, cfHdrFlush;dur=0
date
Mon, 21 Oct 2024 13:07:08 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i
x-frame-options
SAMEORIGIN
0aacfc8d-9e0d-40bf-9f68-df9a712adade
https://entdark.net/ Frame 		0
0
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/im3kb/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Frame 870B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/im3kb/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js?onload=DXjyL6&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8d61780dcbb79f3a-FRA
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Mon, 21 Oct 2024 13:07:09 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
entdark.net
URL
blob:https://entdark.net/36468728-ce5f-48a4-833f-f1dfd545dc31
Domain
entdark.net
URL
blob:https://entdark.net/0aacfc8d-9e0d-40bf-9f68-df9a712adade

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _cf_chl_opt function| VBYM6 function| brdWQ0 function| DXjyL6 boolean| Pjghl3 function| jXVRZ7 function| ZcHV6 function| HFmwV6 function| iHCC5 object| dSJo7 object| lajwG7 object| PZKL0 object| angular object| FnNf4 object| turnstile boolean| qVQK0 string| FUWvI4 boolean| YGymh1

0 Cookies

3 Console Messages

Source Level URL
Text
network error URL: https://entdark.net/2022/09/zanubis-latam-banking-trojan.html
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://entdark.net/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://entdark.net/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN