claim-gifts.review
Open in
urlscan Pro
104.31.94.230
Malicious Activity!
Public Scan
Submission: On February 07 via manual from US
Summary
This is the only time claim-gifts.review was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.31.94.230 104.31.94.230 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 94.31.29.54 94.31.29.54 | 6461 (ZAYO-6461) (ZAYO-6461 - Zayo Bandwidth) | |
1 | 107.154.165.106 107.154.165.106 | 19551 (INCAPSULA) (INCAPSULA - Incapsula Inc) | |
5 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
11 | 104.31.91.126 104.31.91.126 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 172.217.16.180 172.217.16.180 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 172.217.22.106 172.217.22.106 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 67.202.94.94 67.202.94.94 | 32748 (STEADFAST) (STEADFAST - Steadfast) | |
1 | 146.185.16.146 146.185.16.146 | 13213 (UK2NET-AS) (UK2NET-AS) | |
22 | 8 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
claim-gifts.review |
ASN6461 (ZAYO-6461 - Zayo Bandwidth, US)
PTR: 94.31.29.54.IPYX-077437-ZYO.above.net
code.jquery.com |
ASN19551 (INCAPSULA - Incapsula Inc, US)
PTR: 107.154.165.106.ip.incapdns.net
airlines-airports.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
randomuser.me |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f20.1e100.net
geoapi123.appspot.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s18-in-f106.1e100.net
ajax.googleapis.com |
ASN32748 (STEADFAST - Steadfast, US)
PTR: amung.us
whos.amung.us |
ASN13213 (UK2NET-AS, GB)
PTR: 92b91092.rdns.100tb.com
widgets.amung.us |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
randomuser.me
randomuser.me |
71 KB |
5 |
imgur.com
i.imgur.com |
143 KB |
2 |
amung.us
1 redirects
whos.amung.us widgets.amung.us |
2 KB |
1 |
googleapis.com
ajax.googleapis.com |
33 KB |
1 |
appspot.com
geoapi123.appspot.com |
417 B |
1 |
airlines-airports.com
airlines-airports.com |
105 KB |
1 |
jquery.com
code.jquery.com |
34 KB |
1 |
claim-gifts.review
claim-gifts.review |
7 KB |
22 | 8 |
Domain | Requested by | |
---|---|---|
11 | randomuser.me |
claim-gifts.review
|
5 | i.imgur.com |
claim-gifts.review
|
1 | widgets.amung.us |
claim-gifts.review
|
1 | whos.amung.us | 1 redirects |
1 | ajax.googleapis.com |
claim-gifts.review
|
1 | geoapi123.appspot.com |
claim-gifts.review
|
1 | airlines-airports.com |
claim-gifts.review
|
1 | code.jquery.com |
claim-gifts.review
|
1 | claim-gifts.review | |
22 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://claim-gifts.review/delta//?l
Frame ID: (D23F828BC44B2A94CF4EE192C4C7BD93)
Requests: 22 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 20- http://whos.amung.us/widget/deltafinal1 HTTP 307
- http://widgets.amung.us/classic/00/75.png
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
claim-gifts.review/delta// |
22 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.5.1.min.js
code.jquery.com/ |
83 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Delta-Air-Lines-logo.jpg
airlines-airports.com/wp-content/uploads/2016/07/ |
104 KB 105 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xcAdbtq.gif
i.imgur.com/ |
5 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
KbJ6bam.png
i.imgur.com/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Vq7vSEu.png
i.imgur.com/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
UConVQT.gif
i.imgur.com/ |
125 KB 125 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cpxkri0.jpg
i.imgur.com/ |
537 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
54.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
32.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
24.jpg
randomuser.me/api/portraits/men/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
21.jpg
randomuser.me/api/portraits/women/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
73.jpg
randomuser.me/api/portraits/women/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
2.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
99.jpg
randomuser.me/api/portraits/men/ |
5 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
53.jpg
randomuser.me/api/portraits/women/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
46.jpg
randomuser.me/api/portraits/women/ |
6 KB 6 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
89.jpg
randomuser.me/api/portraits/women/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
61.jpg
randomuser.me/api/portraits/women/ |
7 KB 7 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
geoapi123.appspot.com/ |
391 B 417 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.1/ |
94 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
75.png
widgets.amung.us/classic/00/ Redirect Chain
|
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| randomString function| get_random_number number| x object| links number| randno string| link function| geoip_country_code function| geoip_country_name function| geoip_city function| geoip_region function| geoip_region_name function| geoip_latitude function| geoip_longitude function| geoip_postal_code function| geoip_area_code function| geoip_metro_code function| date function| addCom function| FBcom1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.claim-gifts.review/ | Name: __cfduid Value: d266cf17658eb05013014f9764cf320691518031843 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
airlines-airports.com
ajax.googleapis.com
claim-gifts.review
code.jquery.com
geoapi123.appspot.com
i.imgur.com
randomuser.me
whos.amung.us
widgets.amung.us
104.31.91.126
104.31.94.230
107.154.165.106
146.185.16.146
151.101.112.193
172.217.16.180
172.217.22.106
67.202.94.94
94.31.29.54
11d956f8b1bf14c55157948c614aab760383cc7685163ed43e25609c7c050266
2be78802f189696b75d57cbd259031c2b07c992e1ca4ed4fa06b17338e8f5d0e
4aecd2756ae2ed682f204b0f81ca0f478d5a870f3dfa771e8cb30b567715fcfd
4fdbe15e1646fe5e84abdd1e7ab3b10d942864879022c3917c0c866a4a9c563f
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
716cfb40836039a4e9e34d89320b6398ba7871ea7882e32b7397029586f6dda7
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
7ac9690d5ebad97785c1c5c2a5f69e1cc6ea703b9e1c2674bb32b895247bf59b
88445d944fdf0bc52a4f79ddf5cffde16e42eec01bdd3e32ab6234cef44411b3
8d0417f0910586650f889adf5f72fb8ad336f07247cbfd9da9dd6db02546dd00
969b1e6a272f2703af857c5f21ac80f1279a900991da8153942df4897dce1525
a38c7997fe17f718915694f3e76ab9d0119d861886ac9869ee27b2428652b86e
a634d4f02fe5b77804943c1d74b8d70e35ffe26454e0e9af9717432a2c72bfde
aa71ceacc335c50de5d72536473637050da921b5439ea9b4fb289b8f76c5720e
cde29d218b496e372446b582db01150b1faa86fda0e724dbf0fb373bda6a6f30
d0b87af5e8829d02563fdf445c32a54792483fa6227c2d88e60942095303cf60
d1a3e08d4e37d6ee2b7de1db8df87c1dc7acd8ffb004caaf980917de518a60c9
eaa81a78d6ab29a12b5b86e349f7d77abe19946f0d597e1b5191ad1845c4effd
eb0d14c51d571b63ba1aa4050367d192f71c8e9d5c1aa15cd6de9aacae05b2a1
efdb6ee589c3b1c29cbed18fe546fe8d9e2764f92cfa9a27bcb2d95b4f402e13
f758b7302ee2600a88ec2de0b12361fe33027355c7c32ce43d65e00b85c1cfc7
f8f2ddc445b6b2318430260bdebb665c9415865827230565aa42f57c9c794baf