heaven.od.ua Open in urlscan Pro
91.194.72.17 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://heaven.od.ua/Protonmail/index.php
Submission Tags: https://phish.report @phish_report Search All
Submission: On March 07 via api (March 7th 2023, 4:05:24 pm UTC) from FI — Scanned from FI

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 12 HTTP transactions. The main IP is 91.194.72.17, located in Ukraine and belongs to ONETELECOM-AS, UA. The main domain is heaven.od.ua.

This is the only time heaven.od.ua was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Protonmail (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	91.194.72.17 91.194.72.17	43103 (ONETELECO...) (ONETELECOM-AS)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
12	4

9 91.194.72.17 (Ukraine)

ASN43103 (ONETELECOM-AS, UA)
PTR: cpanel.onetelecom.od.ua

heaven.od.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	heaven.od.ua heaven.od.ua	97 KB
1	gstatic.com fonts.gstatic.com	38 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	1 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 195	27 KB
12	4

	Domain	Requested by
9	heaven.od.ua	heaven.od.ua
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	heaven.od.ua
1	cdnjs.cloudflare.com	heaven.od.ua
12	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-20` - `2023-05-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://heaven.od.ua/Protonmail/index.php
Frame ID: EBEA8442F695EA8CF9FB53365249CE8C
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in | Proton Account - Access Proton Mail, Drive, and more

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

25 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

163 kB
Transfer

236 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request index.php Show response
heaven.od.ua/Protonmail/ 16 KB
17 KB 227ms
99ms Document
text/html 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: 8dd6a78b9de6b144f6a8b781fcd7d62528dbb5e9b04ceb377f636718d4f85136

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: fi-FI,fi;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 07 Mar 2023 16:05:19 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H/1.1 200
OK style.css
heaven.od.ua/Protonmail/assets/css/ 21 KB
21 KB 144ms
77ms Stylesheet
text/css 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://heaven.od.ua/Protonmail/assets/css/style.css
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: d86ce539ea4bd7f259e62d9d00e1837404cf4a825ec5a88931764158446f16e4

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Wed, 22 Jun 2022 15:06:10 GMT
Server: Apache
ETag: "2e8003a-53f8-5e20aad623c80"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 21496

GET
H/1.1 200
OK logo.svg
heaven.od.ua/Protonmail/assets/img/ 2 KB
2 KB 164ms
87ms Image
image/svg+xml 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/logo.svg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: 0b2603c4942b4b4b749cf81eb8bd972cf2d2ba6cebfe8feb84ddb5107cd3f66e

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 21:12:18 GMT
Server: Apache
ETag: "2e80043-7bf-5e1fbaceff080"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1983

GET
H/1.1 200
OK loading.svg
heaven.od.ua/Protonmail/assets/img/ 1 KB
2 KB 127ms
87ms Image
image/svg+xml 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/loading.svg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: 13088502d212eb7dcdd14bb1ee9b5691f912da253ad448565340d36ac91a56db

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 09:18:02 GMT
Server: Apache
ETag: "2e80042-56a-5e1f1b2854680"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1386

GET
H/1.1 200
OK icon1.svg
heaven.od.ua/Protonmail/assets/img/ 1 KB
1 KB 154ms
77ms Image
image/svg+xml 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/icon1.svg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: 6145cffc090925161f3aebe7f4bcb15d5fbe8070e29691394128f5015b06127f

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 09:25:00 GMT
Server: Apache
ETag: "2e8003e-4cd-5e1f1cb6f7300"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1229

GET
H/1.1 200
OK icon2.svg
heaven.od.ua/Protonmail/assets/img/ 2 KB
2 KB 156ms
79ms Image
image/svg+xml 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/icon2.svg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: a09b137b91d8656687ed0d0d4825c64c0e5c29cc5edf997f5d9ff761362363ae

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 09:26:30 GMT
Server: Apache
ETag: "2e8003f-7d2-5e1f1d0ccbd80"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2002

GET
H/1.1 200
OK icon3.svg
heaven.od.ua/Protonmail/assets/img/ 2 KB
2 KB 159ms
81ms Image
image/svg+xml 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/icon3.svg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: 4fa1f81361012863eb46b94eeda55a4245c772b84573b64e9e8a89a4cb54fdcf

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 09:27:12 GMT
Server: Apache
ETag: "2e80040-6ef-5e1f1d34d9c00"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1775

GET
H/1.1 200
OK icon4.svg
heaven.od.ua/Protonmail/assets/img/ 1 KB
2 KB 93ms
93ms Image
image/svg+xml 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/icon4.svg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: 3d06d0095f86402e03299031cd90ac6c6af07a3ecdc97268d66bebb3ce7a3ccd

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/index.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 09:27:38 GMT
Server: Apache
ETag: "2e80041-52a-5e1f1d4da5680"
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1322

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/ 85 KB
27 KB 111ms
45ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Requested by

Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/index.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Tue, 07 Mar 2023 16:05:19 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4010907
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27277
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15283"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d%2FwaagFRtYDjwhTQx7NeRFC4FNCHcI0YBXJUrJwBtYabSMAft398oo5EloXdbPv0uoIZ9S7bF9a%2FAYGmrT9YSGgAuh8NwGCUqq3xmBEct2M4BbAXgmgM%2FvsFSvUZHafa3qwMOdf1m%2B5tQeLhodemeb2%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7a44144c3a89fe50-HEL
expires: Sun, 25 Feb 2024 16:05:19 GMT

GET
H2 200 css2
fonts.googleapis.com/ 20 KB
1 KB 202ms
70ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Requested by

Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/assets/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b2dc460864a60ac3ce89c4c6fab1c62ef9171ac1365cc47aa8aca95ecb06f0cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Mar 2023 16:05:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 07 Mar 2023 15:56:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Mar 2023 16:05:19 GMT

GET
H/1.1 200
OK desktop.jpg
heaven.od.ua/Protonmail/assets/img/ 48 KB
48 KB 83ms
82ms Image
image/jpeg 91.194.72.17
ONETELECOM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://heaven.od.ua/Protonmail/assets/img/desktop.jpg
Requested by: Host: heaven.od.ua
URL: http://heaven.od.ua/Protonmail/assets/css/style.css
Protocol: HTTP/1.1
Server: 91.194.72.17 , Ukraine, ASN43103 (ONETELECOM-AS, UA),
Reverse DNS: cpanel.onetelecom.od.ua
Software: Apache /
Resource Hash: d820d682b74850a914de5b88484ff3c628fe34ca6897c9f0a22dd828459665b6

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: http://heaven.od.ua/Protonmail/assets/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Tue, 07 Mar 2023 16:05:19 GMT
Last-Modified: Tue, 21 Jun 2022 21:47:38 GMT
Server: Apache
ETag: "2e8003c-be44-5e1fc2b4c9280"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 48708

GET
H2 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v12/ 37 KB
38 KB 194ms
61ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://heaven.od.ua
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 09:17:36 GMT
x-content-type-options: nosniff
age: 456463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37924
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 20:54:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Mar 2024 09:17:36 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Protonmail (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery function| loadForm

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
heaven.od.ua
2606:4700::6811:180e
2a00:1450:4001:803::200a
2a00:1450:4001:812::2003
91.194.72.17
0b2603c4942b4b4b749cf81eb8bd972cf2d2ba6cebfe8feb84ddb5107cd3f66e
13088502d212eb7dcdd14bb1ee9b5691f912da253ad448565340d36ac91a56db
3d06d0095f86402e03299031cd90ac6c6af07a3ecdc97268d66bebb3ce7a3ccd
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
4fa1f81361012863eb46b94eeda55a4245c772b84573b64e9e8a89a4cb54fdcf
6145cffc090925161f3aebe7f4bcb15d5fbe8070e29691394128f5015b06127f
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8dd6a78b9de6b144f6a8b781fcd7d62528dbb5e9b04ceb377f636718d4f85136
a09b137b91d8656687ed0d0d4825c64c0e5c29cc5edf997f5d9ff761362363ae
b2dc460864a60ac3ce89c4c6fab1c62ef9171ac1365cc47aa8aca95ecb06f0cf
d820d682b74850a914de5b88484ff3c628fe34ca6897c9f0a22dd828459665b6
d86ce539ea4bd7f259e62d9d00e1837404cf4a825ec5a88931764158446f16e4

heaven.od.ua Open in urlscan Pro 91.194.72.17 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

25 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

163 kBTransfer

236 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

heaven.od.ua Open in urlscan Pro
91.194.72.17 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

25 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

163 kB
Transfer

236 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!