ds-gift.ru Open in urlscan Pro
2606:4700:3030::ac43:c2a3  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response ds-gift.ru/	6 KB 4 KB	255ms 202ms	Document text/html	2606:4700:3030::ac43:c2a3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ds-gift.ru/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:c2a3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cb3624441ce437712686f48a2e76a6f6726986120022bc2b8b48643680e6e23e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept access-control-allow-origin * alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 75036e0c5d939c10-FRA content-encoding br content-type text/html; charset=utf-8 date Sun, 25 Sep 2022 11:30:48 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGZlrzL8%2FJFnLSH4LqTKpW42HDpHyDXEWAaPggI7WJGmq9b%2BCUWLJ7p0OgLZkKMDQCx%2B7jKerXEvgAf%2BNdeRJtJE1cuJ9igrEohsK%2BfM%2BROEFPs5TG6NhscyyCUwGd7HUReOKKWg3MQz"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H2	200	script.js Show response ds-gift.ru/0-g/	30 KB 13 KB	226ms 225ms	Script application/javascript	2606:4700:3030::ac43:c2a3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ds-gift.ru/0-g/script.js Requested by Host: ds-gift.ru URL: https://ds-gift.ru/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::ac43:c2a3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 584e53e8b5682f5e244b9ff34ad4cbb7cb61e8be4bfac2d791c2247834c7f659 Request headers accept-language de-DE,de;q=0.9 Referer https://ds-gift.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Sun, 25 Sep 2022 11:30:48 GMT content-encoding br cf-cache-status MISS last-modified Sun, 25 Sep 2022 11:30:48 GMT server cloudflare access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IqZ6d2p9hTMkHOM3E3IcY%2FeP%2BY8pclDRneHsgFFCeEtB9sScWPrdM1eKiBbrwpKaEfy7kmZz2LcCjTU%2Bv2TbuzQi8K%2B2fwqJ6erZ%2BbIrs6GJ2jWIYowAGZ6ffUuGIE90LdQFFP9AM%2BZf"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 75036e0e4a819c10-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	/ Show response ds-gift.ru/0-g/openid/	50 KB 13 KB	170ms 170ms	Fetch text/html	2606:4700:3030::ac43:c2a3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ds-gift.ru/0-g/openid/ Requested by Host: ds-gift.ru URL: https://ds-gift.ru/0-g/script.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:c2a3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13ec36ea0914a14a7e7bec4c4b5f79ab296dca2e2158125f78a5c1e61a8c7b05 Request headers accept-language de-DE,de;q=0.9 Referer https://ds-gift.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Sun, 25 Sep 2022 11:30:49 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5pZdBQ3pztly8CVEfwkdF9swGCyj0%2Fzwf0szNMQSyYhvv0%2BkcjOhpE6xTILcAVBP6TFOA2rSPmqjtZ%2BCN4vaqylZMXrhp%2BG3EY3kTchg5NqX2TyZtrmFJYK0%2FT4qHdOwog5jEs91zzE0"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=utf-8 access-control-allow-origin * cf-ray 75036e0fac5c9bbc-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
POST H3	200	/ Show response ds-gift.ru/	16 B 789 B	157ms 157ms	Fetch application/json	2606:4700:3030::ac43:c2a3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ds-gift.ru/ Requested by Host: ds-gift.ru URL: https://ds-gift.ru/0-g/script.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::ac43:c2a3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Request headers Referer https://ds-gift.ru/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Content-Type application/json Response headers date Sun, 25 Sep 2022 11:30:49 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept etag W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YdghIr9y0GStIV9pk6VDb3INSKERGxtO8ZCz9U3aDgg%2FeJRaGcnRuvRzysy%2FD1pWlYuarY1Tm2Cgweud%2FQaOIzREhCUAZ86SXOahR31chJ9qCj4bROTGyXneg7e6hJH0iFNChaPwYnMG"}],"group":"cf-nel","max_age":604800} content-type application/json; charset=utf-8 access-control-allow-origin * cf-ray 75036e0fac5d9bbc-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 16

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| makeAuthOnClick object| authSettings function| I function| b function| postXHR function| openAuth function| doStat

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ds-gift.ru/	1969-12-31 23:59:59	Name: session Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsaW5rSUQiOjQ1NTA0LCJvd25lciI6MjEwNywiZG9tYWluSUQiOjk2NjUsImRvbWFpbiI6ImRzLWdpZnQucnUiLCJwYXRoIjoiIiwicmVhbElwIjoiMjAwMToxYjYwOjI6MjQwOjMyNDc6OjExIiwiaWF0IjoxNjY0MTA1NDQ4LCJmYWtlX3Zpc2l0Ijp0cnVlfQ.QlhSQiavNq4uY2RwS1kpUMt3_x1qojqcvKozr6SCNJ8

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ds-gift.ru
2606:4700:3030::ac43:c2a3
13ec36ea0914a14a7e7bec4c4b5f79ab296dca2e2158125f78a5c1e61a8c7b05
584e53e8b5682f5e244b9ff34ad4cbb7cb61e8be4bfac2d791c2247834c7f659
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
cb3624441ce437712686f48a2e76a6f6726986120022bc2b8b48643680e6e23e