URL: https://valledellunarejo.uy/
Submission Tags: phishingrod
Submission: On January 04 via api from DE — Scanned from DE

Summary

This website contacted 7 IPs in 1 countries across 7 domains to perform 7 HTTP transactions. The main IP is 192.185.88.176, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is valledellunarejo.uy.
TLS certificate: Issued by R3 on January 3rd 2024. Valid for: 3 months.
This is the only time valledellunarejo.uy was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 192.185.88.176 19871 (NETWORK-S...)
1 204.12.226.3 32097 (WII)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 34.194.150.97 14618 (AMAZON-AES)
1 18.214.211.92 14618 (AMAZON-AES)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
7 7
Apex Domain
Subdomains
Transfer
1 hizliresim.com
i.hizliresim.com — Cisco Umbrella Rank: 102323
2 KB
1 indirdur.ist
cdn.indirdur.ist
1 jumpshare.com
pouch.jumpshare.com
1 glitch.me
digital-mystery.glitch.me
10 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 395
28 KB
1 pngitem.com
www.pngitem.com — Cisco Umbrella Rank: 278748
25 KB
1 valledellunarejo.uy
valledellunarejo.uy
4 KB
7 7
Domain Requested by
1 i.hizliresim.com valledellunarejo.uy
1 cdn.indirdur.ist valledellunarejo.uy
1 pouch.jumpshare.com valledellunarejo.uy
1 digital-mystery.glitch.me valledellunarejo.uy
1 cdnjs.cloudflare.com valledellunarejo.uy
1 www.pngitem.com valledellunarejo.uy
1 valledellunarejo.uy
7 7

This site contains no links.

Subject Issuer Validity Valid
*.valledellunarejo.uy
R3
2024-01-03 -
2024-04-02
3 months crt.sh
pngitem.com
R3
2023-12-03 -
2024-03-02
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
glitch.com
Amazon RSA 2048 M03
2023-12-04 -
2025-01-01
a year crt.sh
jumpshare.com
Amazon RSA 2048 M03
2023-10-19 -
2024-11-15
a year crt.sh
indirdur.ist
GTS CA 1P5
2023-11-09 -
2024-02-07
3 months crt.sh
hizliresim.com
E1
2023-11-25 -
2024-02-23
3 months crt.sh

This page contains 1 frames:

Primary Page: https://valledellunarejo.uy/
Frame ID: 2A32CB3B8835670BE70A5C8FF941F6B2
Requests: 7 HTTP requests in this frame

Screenshot

Page Title

Hacked By Ross Team

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

43 %
IPv6

7
Domains

7
Subdomains

7
IPs

1
Countries

69 kB
Transfer

139 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
valledellunarejo.uy/
12 KB
4 KB
Document
General
Full URL
https://valledellunarejo.uy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.185.88.176 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS
192-185-88-176.unifiedlayer.com
Software
Apache /
Resource Hash
5363f57837f68315969b4cf75805a7fec117d0cef0b306a1684631ff583bedbe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
3899
content-type
text/html; charset=UTF-8
date
Thu, 04 Jan 2024 03:06:23 GMT
link
<https://valledellunarejo.uy/wp-json/>; rel="https://api.w.org/", <https://valledellunarejo.uy/wp-json/wp/v2/pages/678>; rel="alternate"; type="application/json", <https://valledellunarejo.uy/>; rel=shortlink
server
Apache
vary
Accept-Encoding
524-5246388_anonymous-user-hd-png-download.png
www.pngitem.com/pimgs/m/
29 KB
25 KB
Image
General
Full URL
https://www.pngitem.com/pimgs/m/524-5246388_anonymous-user-hd-png-download.png
Requested by
Host: valledellunarejo.uy
URL: https://valledellunarejo.uy/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.12.226.3 , United States, ASN32097 (WII, US),
Reverse DNS
Software
nginx/1.14.0 /
Resource Hash
6bafed128e193253458ded634dbfca20477c931e6a7c5a107b8927420f097867

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://valledellunarejo.uy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Thu, 04 Jan 2024 03:06:24 GMT
Content-Encoding
gzip
Last-Modified
Fri, 16 Dec 2022 12:51:01 GMT
Server
nginx/1.14.0
ETag
W/"639c69b5-7204"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
image/png
Connection
keep-alive
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/
87 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: valledellunarejo.uy
URL: https://valledellunarejo.uy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://valledellunarejo.uy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Thu, 04 Jan 2024 03:06:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
692661
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27938
last-modified
Tue, 02 Mar 2021 18:58:36 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"603e8adc-15d9d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PVJF1Q66iILCQs03Y3OvI7VuY4FKQtAu2PuvrawvITE0pQ9u1gVwP%2FMOwWgWSOyVMaNh0ONZhPvcd9uu%2BgRxH9aR4U6PjH6Cw1rIphRE1I13U0IcH%2Fp9XMYRq4PkrEgMwMMizC%2BgX3dBN77V%2B2iP6szk"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
840043eb1a72bb89-FRA
expires
Tue, 24 Dec 2024 03:06:23 GMT
digi.js
digital-mystery.glitch.me/
10 KB
10 KB
Script
General
Full URL
https://digital-mystery.glitch.me/digi.js
Requested by
Host: valledellunarejo.uy
URL: https://valledellunarejo.uy/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.194.150.97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-194-150-97.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
3607143b97b2a691dc5ac4a1c61015dd786b7461caa6e19801bc6331fd5852ba

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://valledellunarejo.uy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Thu, 04 Jan 2024 03:06:24 GMT
x-amz-version-id
sAja2_A1STBquXPw2Sdt4sTwr90Wwuz9
last-modified
Tue, 12 Oct 2021 17:42:32 GMT
server
AmazonS3
x-amz-request-id
EYDQ2CSYF05VJTDE
etag
"e42989f3d5d0feb6a5b1bd2df8c77e98"
content-type
application/javascript; charset=utf-8
cache-control
no-cache
accept-ranges
bytes
content-length
9746
x-amz-id-2
GYu9PMshgggKb4A8mY0ERx/L6lLfWsQkg34djeKj+kiTjdNurni8r5fb/MA8zY1H9C7pYskSFOdcUo2VMpbFAg==
AQR7NVbRa9gJBaNG49wQ1V_9oEsMvlPZLOlptofoslcYHfIfrtuLUD7YjaVWp4YpDGpJyThMtH1xSbpDwRCuClKD0GKXbTRlF3l6V_Vr5BR97DcKVuXg4C4hholmbxH45F6MzD7hdsv-oyPOiRHE4aN_fIMI2zJarj0avEcXWfs.mp4
pouch.jumpshare.com/preview/
0
0
Media
General
Full URL
https://pouch.jumpshare.com/preview/AQR7NVbRa9gJBaNG49wQ1V_9oEsMvlPZLOlptofoslcYHfIfrtuLUD7YjaVWp4YpDGpJyThMtH1xSbpDwRCuClKD0GKXbTRlF3l6V_Vr5BR97DcKVuXg4C4hholmbxH45F6MzD7hdsv-oyPOiRHE4aN_fIMI2zJarj0avEcXWfs.mp4
Requested by
Host: valledellunarejo.uy
URL: https://valledellunarejo.uy/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.214.211.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-214-211-92.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://valledellunarejo.uy/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Range
bytes=0-

Response headers

shahmen-mark_(indirdur.ist).mp3
cdn.indirdur.ist/dld/RUIrb0dtdTdmV1d4VFgvK25DVklHZz/
0
0
Media
General
Full URL
https://cdn.indirdur.ist/dld/RUIrb0dtdTdmV1d4VFgvK25DVklHZz/shahmen-mark_(indirdur.ist).mp3
Requested by
Host: valledellunarejo.uy
URL: https://valledellunarejo.uy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:8615 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://valledellunarejo.uy/
Accept-Encoding
identity;q=1, *;q=0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Range
bytes=0-

Response headers

jofphxw.png
i.hizliresim.com/
1 KB
2 KB
Image
General
Full URL
https://i.hizliresim.com/jofphxw.png
Requested by
Host: valledellunarejo.uy
URL: https://valledellunarejo.uy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:524a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d8ea8caa548df005fc23d3336e2dae0344ad8298d8b82fcd4c5e1f2b24ef7a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://valledellunarejo.uy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Thu, 04 Jan 2024 03:06:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
C54CE90E8C16A9AA:A
alt-svc
h3=":443"; ma=86400
content-length
1491
x-amz-id-2
H0IoAP/sLUq5GU00HBbnapFB7LAYTlLsK0BMlVliX5nW5tvf9lBm21UmfhKMePptRbBvjjmFjkdE
x-xss-protection
1; mode=block
referrer-policy
same-origin
last-modified
Sat, 25 Sep 2021 08:25:53 GMT
server
cloudflare
etag
"3413a0b731c5a9160b9a7b9882e7e83d"
expect-ct
max-age=86400, enforce
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AP2ioxCLU2E1PtDvnpMtt3GtKE6KGPwRU79imSIHxOGwh6LuMMblOMACMuDIu5zgx8%2BXlYVp40LnZOjPN6R7Rxzpq5G5ApIUg%2BOCY4GeWnCSsdjZTkhHDPtbWDMWRDZ%2BM%2FJhiiUeEcaiL%2BcUaWVW"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
x-frame-options
SAMEORIGIN
cache-control
max-age=31556926
accept-ranges
bytes
cf-ray
840043ef4df06f2d-CDG

Verdicts & Comments Add Verdict or Comment

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery object| music object| next1s object| video object| ret object| msbox object| messbox1 object| messbox2 object| messbox3 object| messbox4 object| messbox5 object| messbox6 object| boxstart object| boxend function| nexted object| doodle function| Stats

1 Cookies

Domain/Path Name / Value
valledellunarejo.uy/ Name: WP_SESSION_COOKIE
Value: 4366e35dce022f8dcddf874764eaecf3%7C%7C1704339383%7C%7C1704339023

2 Console Messages

Source Level URL
Text
network error URL: https://pouch.jumpshare.com/preview/AQR7NVbRa9gJBaNG49wQ1V_9oEsMvlPZLOlptofoslcYHfIfrtuLUD7YjaVWp4YpDGpJyThMtH1xSbpDwRCuClKD0GKXbTRlF3l6V_Vr5BR97DcKVuXg4C4hholmbxH45F6MzD7hdsv-oyPOiRHE4aN_fIMI2zJarj0avEcXWfs.mp4
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://cdn.indirdur.ist/dld/RUIrb0dtdTdmV1d4VFgvK25DVklHZz/shahmen-mark_(indirdur.ist).mp3
Message:
Failed to load resource: the server responded with a status of 404 ()