urlscan.io logo urlscan.io
SecurityTrails logo

traganja.org Open in urlscan Pro
217.182.153.230  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://kutt.it/mexxy1
Effective URL: https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Submission Tags: 7563028
Submission: On June 22 via api from DE — Scanned from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 217.182.153.230, located in France and belongs to OVH, FR. The main domain is traganja.org. The Cisco Umbrella rank of the primary domain is 903936.
TLS certificate: Issued by R3 on May 23rd 2022. Valid for: 3 months.
This is the only time traganja.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online) American Express (Financial)

Domain & IP information

IP Address AS Autonomous System
3 6 2606:4700:303... 13335 (CLOUDFLAR...)
5 217.182.153.230 16276 (OVH)
8 2
Apex Domain
Subdomains		 Transfer
6 kutt.it
kutt.it — Cisco Umbrella Rank: 647988
10 KB
5 traganja.org
traganja.org — Cisco Umbrella Rank: 903936
321 KB
8 2
Domain Requested by
6 kutt.it 3 redirects kutt.it
5 traganja.org traganja.org
8 2

This site contains no links.

Subject Issuer Validity Valid
*.traganja.org
R3		 2022-05-23 -
2022-08-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Frame ID: 93CF8C993ADBDC4E80CF87AA84651EB6
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

American Express : Online Services : Log in

Page URL History Show full URLs

  1. http://kutt.it/mexxy1 Page URL
  2. http://kutt.it/cdn-cgi/phish-bypass?atok=GIy_lTB3fWnHVleqiXUKu78nPNWPP8BYY_42FUT_tao-165591... HTTP 301
    http://kutt.it/mexxy1 HTTP 301
    https://kutt.it/mexxy1 HTTP 302
    https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/ Page URL

Page Statistics

8
Requests

63 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

329 kB
Transfer

347 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://kutt.it/mexxy1 Page URL
  2. http://kutt.it/cdn-cgi/phish-bypass?atok=GIy_lTB3fWnHVleqiXUKu78nPNWPP8BYY_42FUT_tao-1655915289-0-%2Fmexxy1 HTTP 301
    http://kutt.it/mexxy1 HTTP 301
    https://kutt.it/mexxy1 HTTP 302
    https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
mexxy1
kutt.it/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://kutt.it/mexxy1
Protocol
HTTP/1.1
Server
2606:4700:3032::6815:2beb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0c72af5fa04f040e651fc4b3013bfd0153169e8af83620d1ffd275061bc629e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

CF-RAY
71f65afd09cc3751-MXP
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 22 Jun 2022 16:28:09 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gH35IZxvDr7X4fZcsNVZeb2kjw4Prvvn4msd5Te30YcQRQ7BGG833399M8kBCYhUf5ijtxswAR5wbYGM80hL9%2Fg0tffwrtAaw34DT0o0Cmebad99Xlykk%2BQlj%2FFIK68Btk3gIjkk"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf.errors.css
kutt.it/cdn-cgi/styles/ 		23 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://kutt.it/cdn-cgi/styles/cf.errors.css
Requested by
Host: kutt.it
URL: http://kutt.it/mexxy1
Protocol
HTTP/1.1
Server
2606:4700:3032::6815:2beb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efefef4dea8e9c02dc9079fcfe64205b48b0f96ba73dfba169fb7919b8768f1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://kutt.it/mexxy1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 22 Jun 2022 16:28:09 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 14 Jun 2022 16:43:10 GMT
Server
cloudflare
ETag
W/"62a8ba9e-5c8b"
X-Frame-Options
DENY
Content-Type
text/css
Cache-Control
max-age=7200, public
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
71f65afd5a7a3751-MXP
Vary
Accept-Encoding
Expires
Wed, 22 Jun 2022 18:28:09 GMT
icon-exclamation.png
kutt.it/cdn-cgi/images/ 		452 B
889 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://kutt.it/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: kutt.it
URL: http://kutt.it/cdn-cgi/styles/cf.errors.css
Protocol
HTTP/1.1
Server
2606:4700:3032::6815:2beb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
it-IT,it;q=0.9
Referer
http://kutt.it/cdn-cgi/styles/cf.errors.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date
Wed, 22 Jun 2022 16:28:09 GMT
X-Content-Type-Options
nosniff
Last-Modified
Tue, 14 Jun 2022 16:43:10 GMT
Server
cloudflare
ETag
"62a8ba9e-1c4"
X-Frame-Options
DENY
Content-Type
image/png
Cache-Control
max-age=7200, public
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
71f65afd8b083751-MXP
Vary
Accept-Encoding
Content-Length
452
Expires
Wed, 22 Jun 2022 18:28:09 GMT
Primary Request /
traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Redirect Chain
  • http://kutt.it/cdn-cgi/phish-bypass?atok=GIy_lTB3fWnHVleqiXUKu78nPNWPP8BYY_42FUT_tao-1655915289-0-%2Fmexxy1
  • http://kutt.it/mexxy1
  • https://kutt.it/mexxy1
  • https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
217.182.153.230 , France, ASN16276 (OVH, FR),
Reverse DNS
cp214.panet.rs
Software
Apache /
Resource Hash
604433e5e2477c774f81eb276f5ae87d55383a98550c38491929e92726552145

Request headers

Referer
http://kutt.it/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

cache-control
max-age=2592000
content-encoding
gzip
content-length
891
content-type
text/html; charset=UTF-8
date
Wed, 22 Jun 2022 16:28:09 GMT
expires
Fri, 22 Jul 2022 16:28:09 GMT
server
Apache
vary
Accept-Encoding,User-Agent

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
71f65b185c590e1e-MXP
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests default-src 'self' http: https: data: blob: 'unsafe-inline'
content-type
text/html; charset=utf-8
date
Wed, 22 Jun 2022 16:28:14 GMT
expect-ct
max-age=0
location
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
no-referrer no-referrer-when-downgrade
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7MPB1u17YgK7Og7TgycXbiCSwSiEiZ3ZBpQblNfXD0kCT3ASqly8%2B8iJPzFJLfKCmR5HOIi1Ws%2Fh7BV4CN%2Bj066lpbrDdqkyfVxcPE7SQe8FUsxgGYJIhvJI1T87xPVBFXGyFE%2Fa"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains max-age=31536000; includeSubDomains; preload
vary
Accept
x-content-type-options
nosniff nosniff
x-dns-prefetch-control
off
x-download-options
noopen
x-frame-options
SAMEORIGIN SAMEORIGIN
x-permitted-cross-domain-policies
none
x-xss-protection
0 1; mode=block
head.PNG
traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/head.PNG
Requested by
Host: traganja.org
URL: https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
217.182.153.230 , France, ASN16276 (OVH, FR),
Reverse DNS
cp214.panet.rs
Software
Apache /
Resource Hash
38d24ecdfeb3ccc75c799de1e034772a46e258c658a911e1fe029329eebe672e

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 16:28:19 GMT
last-modified
Tue, 21 Jun 2022 00:08:18 GMT
server
Apache
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
8182
expires
Fri, 22 Jul 2022 16:28:19 GMT
main.PNG
traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/ 		241 KB
243 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/main.PNG
Requested by
Host: traganja.org
URL: https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
217.182.153.230 , France, ASN16276 (OVH, FR),
Reverse DNS
cp214.panet.rs
Software
Apache /
Resource Hash
f3381d0d3c26b613f3bef7c554127a6c7043b81650b5bfb34203ad225356add9

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 16:28:19 GMT
last-modified
Tue, 21 Jun 2022 00:08:18 GMT
server
Apache
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
247287
expires
Fri, 22 Jul 2022 16:28:19 GMT
sign.PNG
traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/sign.PNG
Requested by
Host: traganja.org
URL: https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
217.182.153.230 , France, ASN16276 (OVH, FR),
Reverse DNS
cp214.panet.rs
Software
Apache /
Resource Hash
5feada6664eee041d84e1ee25ff66df39b1e9322730ac2e573e76aa8bad5269e

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 16:28:19 GMT
last-modified
Tue, 21 Jun 2022 00:08:18 GMT
server
Apache
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1363
expires
Fri, 22 Jul 2022 16:28:19 GMT
footer.PNG
traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/ 		66 KB
67 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/images/footer.PNG
Requested by
Host: traganja.org
URL: https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
217.182.153.230 , France, ASN16276 (OVH, FR),
Reverse DNS
cp214.panet.rs
Software
Apache /
Resource Hash
bd09c68a0c48de06d4bd56444551f4c536966eecc6d3219bb141da367960215e

Request headers

accept-language
it-IT,it;q=0.9
Referer
https://traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 16:28:19 GMT
last-modified
Tue, 21 Jun 2022 00:08:18 GMT
server
Apache
content-type
image/png
cache-control
max-age=2592000
accept-ranges
bytes
content-length
68010
expires
Fri, 22 Jul 2022 16:28:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online) American Express (Financial)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| unhideBody

2 Cookies

Domain/Path Name / Value
traganja.org/donacije/haoyis/am/americanexpress.com-login/AMEX/Amex/home Name: mycounter
Value: Checked
.kutt.it/ Name: __cf_mw_byp
Value: GIy_lTB3fWnHVleqiXUKu78nPNWPP8BYY_42FUT_tao-1655915289-0-/mexxy1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN