storm.kllk.tk
Open in
urlscan Pro
185.162.171.120
Malicious Activity!
Public Scan
Effective URL: http://storm.kllk.tk/?lang=en
Submission: On March 25 via automatic, source openphish
Summary
This is the only time storm.kllk.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 185.162.171.120 185.162.171.120 | 60458 (ASN-XTUDI...) (ASN-XTUDIONET) | |
1 | 185.225.208.133 185.225.208.133 | 13213 (UK2NET-AS) (UK2NET-AS) | |
2 | 67.202.94.93 67.202.94.93 | 32748 (STEADFAST) (STEADFAST) | |
9 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
kllk.tk
1 redirects
storm.kllk.tk |
227 KB |
3 |
amung.us
widgets.amung.us whos.amung.us |
4 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
7 | storm.kllk.tk |
1 redirects
storm.kllk.tk
|
2 | whos.amung.us |
widgets.amung.us
|
1 | widgets.amung.us |
storm.kllk.tk
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://storm.kllk.tk/?lang=en
Frame ID: 4AF85C5C714E59571C3B8025C088DA2A
Requests: 10 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://storm.kllk.tk/
HTTP 302
http://storm.kllk.tk/?lang=en Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://storm.kllk.tk/
HTTP 302
http://storm.kllk.tk/?lang=en Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
storm.kllk.tk/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tSOgnJdhTc3.css
storm.kllk.tk/css/ |
30 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
9an7U6cZys0.css
storm.kllk.tk/css/ |
68 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
storm.kllk.tk/css/ |
1 KB 893 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fEZ5x2OZgwl.js
storm.kllk.tk/js/ |
248 KB 71 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
storm.kllk.tk/img/ |
127 KB 127 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
small.js
widgets.amung.us/ |
7 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
whos.amung.us/pingjs/ |
29 B 211 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
whos.amung.us/pingjs/ |
26 B 210 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
439 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate number| __DEV__ function| __annotator function| __bodyWrapper function| __m function| __t function| __w object| babelHelpers function| define function| require function| requireDynamic function| requireLazy function| __d object| ErrorUtils function| ProfilingCounters object| TimeSlice string| cpa string| index function| __updateOrientation undefined| WAU_ren function| WAU_small function| WAU_small_request function| WAU_r_s function| WAU_insert function| WAU_legacy_b function| WAU_la function| WAU_addCommas function| WAU_lrd function| WAU_cps function| docReady object| x string| x1 string| x23 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
storm.kllk.tk/ | Name: detect Value: Mk5mOHpKNG9IOHZQdndVeXpoUWhZMW1PMzB0aElIN01CYW5CdERaQ0J0YmtObDk3OTk3MUpudFVacVRTTzZjemV4cUlMQ3dKMmJmdkFWRUNndFg3YU5FZVFwaklzV2M4RkY1Sz0tMSwyTmY4eko0b0g4dlB2d1V5emhRaFkxbU8zMHRoSUg3TUJhbkJ0RFpDQnRia05sOTc5OTcxSm50VVpxVFNPNmN6ZXhxSUxDd0oyYmZ2QVZFQ2d0WDdhTkVlUXBqSXNXYzhGRjVLPTAsMk5mOHpKNG9IOHZQdndVeXpoUWhZMW1PMzB0aElIN01CYW5CdERaQ0J0YmtObDk3OTk3MUpudFVacVRTTzZjemV4cUlMQ3dKMmJmdkFWRUNndFg3YU5FZVFwaklzV2M4RkY1Sz0xLDJOZjh6SjRvSDh2UHZ3VXl6aFFoWTFtTzMwdGhJSDdNQmFuQnREWkNCdGJrTmw5Nzk5NzFKbnRVWnFUU082Y3pleHFJTEN3SjJiZnZBVkVDZ3RYN2FORWVRcGpJc1djOEZGNUs9MiwyTmY4eko0b0g4dlB2d1V5emhRaFkxbU8zMHRoSUg3TUJhbkJ0RFpDQnRia05sOTc5OTcxSm50VVpxVFNPNmN6ZXhxSUxDd0oyYmZ2QVZFQ2d0WDdhTkVlUXBqSXNXYzhGRjVLPTM= |
|
storm.kllk.tk/ | Name: 2Nf8zJ4oH8vPvwUyzhQhY1mO30thIH7MBanBtDZCBtbkNl979971JntUZqTSO6czexqILCwJ2bfvAVECgtX7aNEeQpjIsWc8FF5K Value: 1 |
|
storm.kllk.tk/ | Name: PHPSESSID Value: 0f6616dd41d39c22925b4eba0f5dd5cf |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
storm.kllk.tk
whos.amung.us
widgets.amung.us
185.162.171.120
185.225.208.133
67.202.94.93
1be72a6fd3de0461f912fe5e59edbb445c57f182c9cdbe96052741384ccefc17
479cb91730eef777856825b3a30f19536770ed45c7120117de44e56b7db826c6
54013fe95d54f0a9fc356042fbdb28f350cd92fa8e879f26510377d8f5f483fc
56b3a78bf4df13e8416cb28e5f1bfa7749c6f27cf7d87cfec5a445eb8d1dbc6d
77511a76a5286c193575f3a0b9e203cba6866ef138edbd2b2448bda51d8fc9d2
b2bc2d6df29af2d1f5b49e5e04f4c1760c94afb93c937a5113caf905b28cea06
cab040fc133814c4dd30f8c70b2dd7d4a7aa5a5f2bc5078b67e4c76c7f715119
d5277f68f39f00f5b9e590e0ffdda661216fc2b8df625236427f582ec5227856
e0d357e1ba7356033c48b227aed69ed26288fb6e1878651e7010971d3204f203
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac