coldingveirfyguards.xyz
Open in
urlscan Pro
45.83.122.3
Malicious Activity!
Public Scan
URL:
http://coldingveirfyguards.xyz/eskitelifvs/
Submission: On January 15 via automatic, source openphish — Scanned from DE
Submission: On January 15 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 12 HTTP transactions.
The main IP is 45.83.122.3, located in
Seychelles and
belongs to INTERNET-IT, SC.
The main domain is coldingveirfyguards.xyz.
This is the only time coldingveirfyguards.xyz was scanned on urlscan.io!
This is the only time coldingveirfyguards.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Instagram (Social Network)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 10 | 45.83.122.3 45.83.122.3 | 200313 (INTERNET-IT) (INTERNET-IT) | |
| 2 | 2606:4700:303... 2606:4700:3033::ac43:c56d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 12 | 2 |
10
45.83.122.3
(Seychelles)
ASN200313 (INTERNET-IT, SC)
PTR: web1.scooterbooking.com
ASN200313 (INTERNET-IT, SC)
PTR: web1.scooterbooking.com
| coldingveirfyguards.xyz |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
coldingveirfyguards.xyz
coldingveirfyguards.xyz |
688 KB |
| 2 |
fontawesome.com
kit-free.fontawesome.com — Cisco Umbrella Rank: 21939 |
91 KB |
| 12 | 2 |
| Domain | Requested by | |
|---|---|---|
| 10 | coldingveirfyguards.xyz |
coldingveirfyguards.xyz
|
| 2 | kit-free.fontawesome.com |
coldingveirfyguards.xyz
kit-free.fontawesome.com |
| 12 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-08 - 2022-07-07 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://coldingveirfyguards.xyz/eskitelifvs/
Frame ID: AB300796B8950E9FA7939ADB0694DD65
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
lnstagram | Help CenterDetected technologies
Font Awesome
(Font Scripts)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
coldingveirfyguards.xyz/eskitelifvs/ |
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.css
coldingveirfyguards.xyz/eskitelifvs/css/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
free.min.css
kit-free.fontawesome.com/releases/latest/css/ |
59 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
chax.css
coldingveirfyguards.xyz/eskitelifvs/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xss.css
coldingveirfyguards.xyz/eskitelifvs/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb1.jpg
coldingveirfyguards.xyz/eskitelifvs/image/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Logo242.gif
coldingveirfyguards.xyz/eskitelifvs/image/ |
120 KB 120 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PicsArt_03-14-07.13.52.png
coldingveirfyguards.xyz/eskitelifvs/image/ |
415 KB 415 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bottom.jpeg
coldingveirfyguards.xyz/eskitelifvs/image/ |
10 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
fb.png
coldingveirfyguards.xyz/eskitelifvs/image/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
MhMmoO.jpg
coldingveirfyguards.xyz/eskitelifvs/image/ |
123 KB 123 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H3 |
free-fa-solid-900.woff2
kit-free.fontawesome.com/releases/latest/webfonts/ |
76 KB 77 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Instagram (Social Network)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onsecuritypolicyviolation object| onslotchange0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
coldingveirfyguards.xyz
kit-free.fontawesome.com
2606:4700:3033::ac43:c56d
45.83.122.3
316bc776a4353b2b3758050b4e74223b1e9caa710c3e0b0a20de445f4045c10a
32557de2958d880e422bcf1751903bfbca08e73ffae522866548fefb1a371e33
48644616798751e8822e78247a42a79aa85e006839c99c5ffc32f3d370d2cb5c
73528ca52a08779113ecc155e23f16fa2a5de6b6d0140c63007511ee2a472851
970d882edfdcfb86798f2c0f8729d9387662fa4eba6f64e1f2467ca6121ce58a
ab71a3b0b4d28ccc28d0ac6e0495f5ae64e1a4e566e6601880fef77c81873daa
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7
cc57a0c76b535091457259cdd8be95cb238cc4c1686b961e1bdd75bbda14c128
cdf3e8ad3500ce54e291c9e47c3e18de8b7d870353be893d43cad603c989d9eb
e213691b6a16bdc3bcf7f4c680f4bf4135f4ebc4d4a8a4a3ef7fcd7d78972624
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda