lokalnykurier.cloud Open in urlscan Pro
104.21.51.206 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://lokalnykurier.cloud/921747
Effective URL:
https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo
Submission: On October 17 via manual (October 17th 2023, 10:57:35 pm UTC) from PL — Scanned from PL

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 11 HTTP transactions. The main IP is 104.21.51.206, located in and belongs to CLOUDFLARENET, US. The main domain is lokalnykurier.cloud.
TLS certificate: Issued by E1 on October 16th 2023. Valid for: 3 months.

This is the only time lokalnykurier.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayU (Financial)

Domain & IP information

	IP Address		AS Autonomous System
1 12	104.21.51.206 104.21.51.206		13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	1

12 104.21.51.206 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

lokalnykurier.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	lokalnykurier.cloud 1 redirects lokalnykurier.cloud	646 KB
11	1

	Domain	Requested by
12	lokalnykurier.cloud	1 redirects lokalnykurier.cloud
11	1

This site contains no links.

Subject Issuer	Validity	Valid
lokalnykurier.cloud E1	`2023-10-16` - `2024-01-14`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo
Frame ID: C45D28B921AFAD9CF34B5E79E3E06E78
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

PayU

Page URL History Show full URLs

https://lokalnykurier.cloud/921747 HTTP 302
https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

646 kB
Transfer

740 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://lokalnykurier.cloud/921747 HTTP 302
https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 1eirNo Show response lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/ Redirect Chain https://lokalnykurier.cloud/921747 https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo	13 KB 4 KB	104ms 102ms	Document text/html	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `e065ac50ef260053b72234da18798e2dc2949cb092a18d98fd67b200ebd3609a` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language pl-PL,pl;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-cache-status DYNAMIC cf-ray 817c2411bf8434c8-WAW content-encoding br content-type text/html; charset=UTF-8 date Tue, 17 Oct 2023 22:57:29 GMT expires Thu, 19 Nov 1981 08:52:00 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rZhgrn8scLDP2WsokyfNGCi9fZ4kC4IfKREeKZIenhTLwGfnZD3GiSZOO3MAEUfl6gsi%2Byc%2FjiW1Aq91lBLGdlyxgw2ZOLhKlzhJM7wWcIw0UROpIS8PtezrGRtloJKAmW0g8u5P"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-powered-by PHP/5.4.16 Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 817c2410cf0034c8-WAW content-type text/html; charset=UTF-8 date Tue, 17 Oct 2023 22:57:29 GMT location https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7IJp9%2FIRISw2P4GcBM%2BMoxduhzaBDWZl9xqlZzsAVaYeqi9GdgCbOORCxmwQnPoid17G%2BYO45EOsylqTA8ymWuWERaYcq3N1xE8TETz6596m74WdZcQ1eWBpRw%2B91DZ68ddSc3Uy"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/5.4.16
GET H3	200	c049f01b39fc7491046aaaff5f8d85642.css lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/	38 KB 10 KB	135ms 134ms	Stylesheet text/css	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `eaf5784ad006c8ba4b1b2d5e5ab6a5878e1101ba1a1ae57d2514097d062033b0` Request headers accept-language pl-PL,pl;q=0.9 Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Tue, 17 Oct 2023 22:57:30 GMT content-encoding br cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/5.4.16 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WoG6rwihBYwsVJQOsKqR1BgiDtI4dI1BkSU1uSXFtS6ah1WWQrkPjfwev%2Bst5mS7k9FtvgzUiLg2MEJbMcldlqHo7rbHgso9jCA2JrTju77FQNMT4xJPF54ooV%2BLy3K2C%2Fq%2BnDHC"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 817c241279043488-WAW alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	jquery.js Show response lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/	86 KB 31 KB	43ms 41ms	Script application/javascript	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/jquery.js Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a` Request headers accept-language pl-PL,pl;q=0.9 Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/1eirNo User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Tue, 17 Oct 2023 22:57:30 GMT content-encoding br cf-cache-status HIT last-modified Thu, 21 Sep 2023 14:00:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 110586 etag W/"650c4c64-15851" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HjvqF1lgkp%2FzxzmraJSV6KTUQtfi0uIkynD8MuDbYRt9bzskgb772n9vcRumU1QlOXsrzAp0koE%2BlRTkVVuOJZoMZWSb4jf07UBnLyVUXyK12FDIRnnJfCCnkMbd1SRjIzdAkDT7"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=315360000 cf-ray 817c241279053488-WAW alt-svc h3=":443"; ma=86400 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H3	200	a45eb525d77a22a99f23da82897186e7.jpg lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/	59 KB 60 KB	154ms 154ms	Image image/jpeg	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/a45eb525d77a22a99f23da82897186e7.jpg Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `6dc4241ba04fd5b7a9f6dbe57b2af4bcae1f5b82adbaabc7c6db63c356d6b111` Request headers accept-language pl-PL,pl;q=0.9 Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Tue, 17 Oct 2023 22:57:30 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/5.4.16 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oir7vyK9qG9noIGwCmKT59bvSX0gO%2B1b3bGV0Jif84qny%2F9lOaexdotL%2BEiUntB3J4MOIoS64ctnVGIAdNfvjc9rPFkwvp%2FqSWtFVPe1Z1wJTZyoOOKvn5EYWGO8O%2BSmuVhBfZvn"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 817c241369723488-WAW alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	5830a42186f281f7a967c87b9af56705.png lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/	5 KB 6 KB	128ms 127ms	Image image/png	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/5830a42186f281f7a967c87b9af56705.png Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `f0a8690962dac7aa730a03e302b792c2fee70bf021d2b4ccb10582895daf8979` Request headers accept-language pl-PL,pl;q=0.9 Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Tue, 17 Oct 2023 22:57:30 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/5.4.16 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4yUJG3XRKnwD0aCzAKcqyK92O25SPspFSFE6Yk2%2FpP%2BmQ6Y%2BM%2Frv01RzjCSBAjl0ZM1Qn6X3brx%2Fyxk5yU1ZWouYZQNCcDANH1DlMa5LcQan%2FiVr4NNto55mmIt%2F3uhaY0QxNwmL"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 accept-ranges bytes cf-ray 817c241369743488-WAW alt-svc h3=":443"; ma=86400 content-length 5442 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	1e2c620a41d1d7587499df1dd36ad65b.png lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/	135 KB 135 KB	191ms 190ms	Image image/png	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/1e2c620a41d1d7587499df1dd36ad65b.png Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `c962b6abca626bf4978f37dbdfcc0de08f212e52b567fd9db254a1e2f9359caf` Request headers accept-language pl-PL,pl;q=0.9 Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Tue, 17 Oct 2023 22:57:30 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/5.4.16 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GNUgOZIE8WgjUvPXg%2B8SzRf1TXNYfeU1pWnJt5PDpeteF11RL6%2FTvKqo3orHKVtlX6h%2BGLHJeyRETBbi9ZiWqatFOvCQ3bGOoHXMjk9u%2BS9H8bGai0QQTTEcwZNQCsMAa1gwhBv6"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 817c241369753488-WAW alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	5f4646f63312f0a6b1b19048f82f4d15.png lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/	1 KB 2 KB	125ms 125ms	Image image/png	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/5f4646f63312f0a6b1b19048f82f4d15.png Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `75b5333310f590b043b28690a8eb80ca2bd766c9345ff5ce9eb0544d83892ffe` Request headers accept-language pl-PL,pl;q=0.9 Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers pragma no-cache date Tue, 17 Oct 2023 22:57:30 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/5.4.16 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2FOVPXyRphAi%2BoZwd76WmDJkQw82dkeW%2BSNbw15mcML%2FfCOCrJnDulCEKeIputZIRQhecPU1YQ9ziqmo1AD8xIoJ8cQRLvKuVQENKwwGf7sz2lM3taanuItHjYkHVdJ4wVkikN8O"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 accept-ranges bytes cf-ray 817c241369763488-WAW alt-svc h3=":443"; ma=86400 content-length 1393 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	opensans-regular-webfont.woff lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/	87 KB 88 KB	68ms 67ms	Font application/font-woff	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/opensans-regular-webfont.woff Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `9650a5ba277274205e90974e7fb4183289ca51653c33fc291ad064bf8dd998e1` Request headers Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Origin https://lokalnykurier.cloud accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Tue, 17 Oct 2023 22:57:30 GMT content-encoding br cf-cache-status HIT last-modified Thu, 21 Sep 2023 14:00:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1448 etag W/"15de8-605dee8af0e65" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LQYa3YX2bgRF4hRA1FoaN7TMm91GcE6WS2tMCPF4T2DMmdEK12IkMld7f44jJGhKULYpO%2BcKMPnerejhNLmvFOCRgQx5ozHaUTB1AV%2Fd3u2XEbcSsQRp%2FkGvmNkJRvfgs%2FGt4150"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 817c241369783488-WAW alt-svc h3=":443"; ma=86400
GET H3	200	opensans-light-webfont.woff lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/	84 KB 84 KB	95ms 94ms	Font application/font-woff	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/opensans-light-webfont.woff Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0fe491e2047389b9deb7a06fd36de7fec03af2791ec29461be02571cbebdb4ab` Request headers Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Origin https://lokalnykurier.cloud accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Tue, 17 Oct 2023 22:57:30 GMT content-encoding br cf-cache-status HIT last-modified Thu, 21 Sep 2023 14:00:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1448 etag W/"15000-605dee8af02ad" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ro%2B4JVo9ixtCyNT%2FONMMg8FacPs5oEUsnRFtf8WWCdq43e2JMVKjv9H0RayahUGb7utTMq%2BfXo%2F5swnZipbJ5yKYOFx9OlsoESP%2FbBgwBgwFLboqFb%2BttASg2GJl4zlEZyFFFJx7"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 817c2413697a3488-WAW alt-svc h3=":443"; ma=86400
GET H3	200	opensans-semibold-webfont.woff lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/	89 KB 90 KB	37ms 36ms	Font application/font-woff	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/opensans-semibold-webfont.woff Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `431817115e31ff8604ab76a86ce6ed55d02cd5ea7332bd0ed3d15d9b5bf9aaae` Request headers Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Origin https://lokalnykurier.cloud accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Tue, 17 Oct 2023 22:57:30 GMT content-encoding br cf-cache-status HIT last-modified Thu, 21 Sep 2023 14:00:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1448 etag W/"16420-605dee8af1a1d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=72%2BIsH%2F0JMKEuxJqZnaQ6IEqy4uRWt8%2BLAMzPWf86Kq2RVOaHdrLHb6KAeJQb0kK9HiVmZiydT1IdAu8FSNxpJohSFboNJzGoeyXTA8eRg5Be6vNmDp6lqHMBgwX99ETbGh7zG%2BV"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 817c2413697b3488-WAW alt-svc h3=":443"; ma=86400
GET H3	200	PFBeauSansPro-Bold.woff lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/	142 KB 136 KB	135ms 134ms	Font application/font-woff	104.21.51.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/fonts/PFBeauSansPro-Bold.woff Requested by Host: lokalnykurier.cloud URL: https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.21.51.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c8b380cdc92601f7195d0cd34c777bcdee7dcd285e110534a8cf48bfa7d8b2e8` Request headers Referer https://lokalnykurier.cloud/RNhd129BmmrUGOmc4uG/css/c049f01b39fc7491046aaaff5f8d85642.css Origin https://lokalnykurier.cloud accept-language pl-PL,pl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Tue, 17 Oct 2023 22:57:30 GMT content-encoding br cf-cache-status HIT last-modified Thu, 21 Sep 2023 14:00:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1448 etag W/"2374c-605dee8af412d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WFKikhbHXuGBo6FHoY8C6xwI3pPuojvKLkUmVYPn%2BY0toGhYqR0%2BQKOSIAkI92G6TMjLZZgUqt%2BLxLGHOIyzYyKco1xUgkLcNVltpRlM5B25XYVaVDwWCEvFEHCPst9UgmgZhDlF"}],"group":"cf-nel","max_age":604800} content-type application/font-woff cache-control max-age=14400 cf-ray 817c2413697c3488-WAW alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayU (Financial)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| u95bfbc13 function| online

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
lokalnykurier.cloud/RNhd129BmmrUGOmc4uG	1970-01-20 15:33:06	Name: 283b556ac9a445b11aabd5c7b2a3fc0f Value: 986626460
lokalnykurier.cloud/RNhd129BmmrUGOmc4uG	1970-01-20 15:33:06	Name: 19198872757ca7d0cb76bfb8dd073c3f Value: 2487805493
lokalnykurier.cloud/RNhd129BmmrUGOmc4uG	1970-01-20 15:33:06	Name: 2417390bcbc304d9de4d072c7dd64bdc Value: 3755720856
lokalnykurier.cloud/RNhd129BmmrUGOmc4uG	1970-01-20 15:33:06	Name: 1d5bad65b9eedadf18e7f6e1f0c8eb5a Value: 986626460
lokalnykurier.cloud/	1969-12-31 23:59:59	Name: PHPSESSID Value: 9mbh6bfvqmdk9j60rkv6q0top6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lokalnykurier.cloud
104.21.51.206
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0fe491e2047389b9deb7a06fd36de7fec03af2791ec29461be02571cbebdb4ab
431817115e31ff8604ab76a86ce6ed55d02cd5ea7332bd0ed3d15d9b5bf9aaae
6dc4241ba04fd5b7a9f6dbe57b2af4bcae1f5b82adbaabc7c6db63c356d6b111
75b5333310f590b043b28690a8eb80ca2bd766c9345ff5ce9eb0544d83892ffe
9650a5ba277274205e90974e7fb4183289ca51653c33fc291ad064bf8dd998e1
c8b380cdc92601f7195d0cd34c777bcdee7dcd285e110534a8cf48bfa7d8b2e8
c962b6abca626bf4978f37dbdfcc0de08f212e52b567fd9db254a1e2f9359caf
e065ac50ef260053b72234da18798e2dc2949cb092a18d98fd67b200ebd3609a
eaf5784ad006c8ba4b1b2d5e5ab6a5878e1101ba1a1ae57d2514097d062033b0
f0a8690962dac7aa730a03e302b792c2fee70bf021d2b4ccb10582895daf8979

lokalnykurier.cloud Open in urlscan Pro 104.21.51.206 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

646 kBTransfer

740 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

5 Cookies

Indicators

lokalnykurier.cloud Open in urlscan Pro
104.21.51.206 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

646 kB
Transfer

740 kB
Size

5
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!