![](/screenshots/f2b0e9b1-6b3f-496e-8fd0-134b36fc7956.png)
itsuni.zyrosite.com
Open in
urlscan Pro
2606:4700:4400::ac40:9a64
Malicious Activity!
Public Scan
Effective URL: https://itsuni.zyrosite.com/
Submission: On August 21 via manual from PL — Scanned from DK
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on July 3rd 2023. Valid for: a year.
This is the only time itsuni.zyrosite.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 5 | 2606:4700:440... 2606:4700:4400::6812:219c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:440... 2606:4700:4400::ac40:9a64 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::2003 | 15169 (GOOGLE) (GOOGLE) | |
6 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
zyrosite.com
2 redirects
itsuni.zyrosite.com |
35 KB |
1 |
gstatic.com
fonts.gstatic.com |
27 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 73 |
809 B |
6 | 3 |
Domain | Requested by | |
---|---|---|
6 | itsuni.zyrosite.com |
2 redirects
itsuni.zyrosite.com
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
itsuni.zyrosite.com
|
6 | 3 |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.zyrosite.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-31 - 2023-10-23 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-31 - 2023-10-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://itsuni.zyrosite.com/
Frame ID: BAA17DB26CE069AAE129BE1CB31E82BC
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/f2b0e9b1-6b3f-496e-8fd0-134b36fc7956.png)
Page Title
Site SuspendedPage URL History Show full URLs
- http://itsuni.zyrosite.com/ Page URL
-
http://itsuni.zyrosite.com/cdn-cgi/phish-bypass?atok=JZTd.7dbdpo3nWf3uwMcXNwFttf2Kd.kK.skU3TX84E-169264...
HTTP 301
http://itsuni.zyrosite.com/ HTTP 301
https://itsuni.zyrosite.com/ Page URL
Detected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://itsuni.zyrosite.com/ Page URL
-
http://itsuni.zyrosite.com/cdn-cgi/phish-bypass?atok=JZTd.7dbdpo3nWf3uwMcXNwFttf2Kd.kK.skU3TX84E-1692646150-0-%2F
HTTP 301
http://itsuni.zyrosite.com/ HTTP 301
https://itsuni.zyrosite.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
itsuni.zyrosite.com/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
itsuni.zyrosite.com/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
itsuni.zyrosite.com/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
itsuni.zyrosite.com/ Redirect Chain
|
76 KB 26 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 809 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
29 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
825 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
843 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NGS6v5_NC0k9P9H2TbE.woff2
fonts.gstatic.com/s/heebo/v21/ |
26 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.itsuni.zyrosite.com/ | Name: __cf_mw_byp Value: JZTd.7dbdpo3nWf3uwMcXNwFttf2Kd.kK.skU3TX84E-1692646150-0-/ |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
itsuni.zyrosite.com
2606:4700:4400::6812:219c
2606:4700:4400::ac40:9a64
2a00:1450:4001:800::200a
2a00:1450:4001:82f::2003
01fe5829031448f554a793ec974108e4e57df11249caa0853943f7cd7ae4deed
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
33a75a1213aeb402a6df476e9e35275df09ec1c3382affc5a04b6a0bb5721cb2
36337167bffb0bc89b876618af29a0e6789a3ce88e574696735f11d775050f0b
4c0357b0fd41ac43e601b4d3212dfe1fc7472596ef39c6f490f35cd28b9ee3d2
54a0a7ef1de90e1eb0069d197e3c15a133ac3dd37e1e5d933883ae4d424c5c1f
7c5dcff41d74e16467b76e52fc818b6f6294a025b14123f7a9ac993382dd11a6
9ccdc2891d1dbbb4749d422e40f93166f48c2cf9b40046856c52396176e6d6ae
a6ccc3b86fc15c97af4ead50cb5ffa4b4ec800bf8ef28770c77998ffd5bf51d6
aa65448b10cffda984a5fea169d4fbbc9b4999144f6e98ab467c1bee34a53bab
b38977ea35fde92fe200fa14ac7cc55e2edce54b998ce9a08734ba1dd9053fed
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f92a647d0fdc8ad02c6faa862b676eb902d8f6ba4f4d153df7d64a3078769f2f