donat-maill.ru Open in urlscan Pro
2400:cb00:2048:1::681b:be7b  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response donat-maill.ru/vk/	3 KB 2 KB	79ms 73ms	Document text/html	2400:cb00:2048:1::681b:be7b Cloudflare
General Check archive.org Show headers Download Go to Full URL http://donat-maill.ru/vk/ Protocol HTTP/1.1 Server 2400:cb00:2048:1::681b:be7b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e1a4a4af35b61c2c9ae6f9c4273e0cc2bbced0d556ea7905becf4f586cba1893 Request headers Host donat-maill.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 22 Sep 2018 13:17:16 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=dc26ff8aecabb4cef293fe3bb301dbf2e1537622236; expires=Sun, 22-Sep-19 13:17:16 GMT; path=/; domain=.donat-maill.ru; HttpOnly Server cloudflare CF-RAY 45e50cff63d397c2-FRA Content-Encoding gzip
GET S	200	fonts_cnt.css vk.com/css/al/	643 KB 486 KB	133ms 43ms	Stylesheet text/css	87.240.180.136 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/css/al/fonts_cnt.css Requested by Host: donat-maill.ru URL: http://donat-maill.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.180.136 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv136-180-240-87.vk.com Software nginx / Resource Hash 37d2493a71736e52813d0701f573a0b048c5cbaffb174d21ebe5984be478147e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer http://donat-maill.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 22 Sep 2018 13:17:16 GMT content-encoding gzip x-frontend front504219 last-modified Mon, 10 Sep 2018 15:17:58 GMT server nginx etag W/"5b968b26-a0d58" strict-transport-security max-age=15768000 content-type text/css status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Wed, 26 Sep 2018 13:17:16 GMT
GET S	200	common.css vk.com/css/al/	315 KB 74 KB	218ms 129ms	Stylesheet text/css	87.240.180.136 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/css/al/common.css Requested by Host: donat-maill.ru URL: http://donat-maill.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.180.136 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv136-180-240-87.vk.com Software nginx / Resource Hash 76c0e8b480008b7b0ce845536069aa7d12b87b4b53de344232c54dc1d345a1a6 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer http://donat-maill.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 22 Sep 2018 13:17:16 GMT content-encoding gzip x-frontend front504219 last-modified Wed, 12 Sep 2018 10:38:57 GMT server nginx etag W/"5b98ecc1-4ed6d" strict-transport-security max-age=15768000 content-type text/css status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Wed, 26 Sep 2018 13:17:16 GMT
GET S	200	oauth_popup.css vk.com/css/api/	4 KB 2 KB	218ms 129ms	Stylesheet text/css	87.240.180.136 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/css/api/oauth_popup.css Requested by Host: donat-maill.ru URL: http://donat-maill.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.180.136 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv136-180-240-87.vk.com Software nginx / Resource Hash 83971bd09fced7ef47878abf75dfcba48e0b57341b131a6948513eb0235d0406 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer http://donat-maill.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 22 Sep 2018 13:17:16 GMT content-encoding gzip x-frontend front504219 last-modified Wed, 12 Sep 2018 10:39:09 GMT server nginx etag W/"5b98eccd-10cc" strict-transport-security max-age=15768000 content-type text/css status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Wed, 26 Sep 2018 13:17:16 GMT
GET S	200	common_light.js Show response vk.com/js/api/	3 KB 1 KB	218ms 129ms	Script application/x-javascript	87.240.180.136 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Full URL https://vk.com/js/api/common_light.js Requested by Host: donat-maill.ru URL: http://donat-maill.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.180.136 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv136-180-240-87.vk.com Software nginx / Resource Hash 8d51d3444a0bd5851bc1213cad24cd54d73809210961891c3d9525c03c2206e5 Request headers Referer http://donat-maill.ru/vk/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 22 Sep 2018 13:17:16 GMT content-encoding gzip x-frontend front504219 last-modified Sat, 02 Jun 2018 00:06:22 GMT server nginx etag W/"5b11df7e-db1" content-type application/x-javascript status 200 access-control-expose-headers X-Frontend cache-control max-age=345600 expires Wed, 26 Sep 2018 13:17:16 GMT
GET DATA	200 OK	truncated /	88 KB 0		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ba3627978bd7d98b4294876d73a52f2e74cc4201cdbdaf043cb647042fba699d Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin http://donat-maill.ru Response headers Access-Control-Allow-Origin * Content-Type font/woff
GET S	200	logo_vk.png vk.com/images/	493 B 747 B	43ms 43ms	Image image/png	87.240.180.136 VKONTAKTE-SPB-AS ...
General Check archive.org Show headers Download Go to Show image Full URL https://vk.com/images/logo_vk.png Requested by Host: donat-maill.ru URL: http://donat-maill.ru/vk/ Protocol SPDY Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 87.240.180.136 , Russian Federation, ASN47541 (VKONTAKTE-SPB-AS http://vk.com, RU), Reverse DNS srv136-180-240-87.vk.com Software nginx / Resource Hash e7de505c1c69628c07120cc5e298f89e1a2d90370ead5fb0acde8e518c58a88e Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer https://vk.com/css/api/oauth_popup.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 22 Sep 2018 13:17:16 GMT x-frontend front504219 last-modified Sat, 02 Jun 2018 00:06:22 GMT server nginx etag "5b11df7e-1ed" strict-transport-security max-age=15768000 content-type image/png status 200 access-control-expose-headers X-Frontend cache-control max-age=604800 accept-ranges bytes content-length 493 expires Sat, 29 Sep 2018 13:17:16 GMT
GET DATA	200 OK	truncated /	87 KB 0		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash da4929f143ad03e5465455bb1cf1333bf060ae7641f0fcf115ea65a30793e180 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin http://donat-maill.ru Response headers Access-Control-Allow-Origin * Content-Type font/woff
GET DATA	200 OK	truncated /	88 KB 0		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a8968be35c05d541ccd4eb1c4af41cb3b27f470986c85cb23062ace8938828a9 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Origin http://donat-maill.ru Response headers Access-Control-Allow-Origin * Content-Type font/woff

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Vkontakte (Social Network)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| ge function| trim function| hasClass function| addClass function| removeClass function| isChecked function| checkbox function| parseJSON function| show function| hide function| domInsertBefore function| showProgress function| re function| hideProgress function| lockButton function| unlockButton function| isButtonLocked

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.donat-maill.ru/	1970-01-19 03:52:38	Name: __cfduid Value: dc26ff8aecabb4cef293fe3bb301dbf2e1537622236

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

donat-maill.ru
vk.com
2400:cb00:2048:1::681b:be7b
87.240.180.136
37d2493a71736e52813d0701f573a0b048c5cbaffb174d21ebe5984be478147e
76c0e8b480008b7b0ce845536069aa7d12b87b4b53de344232c54dc1d345a1a6
83971bd09fced7ef47878abf75dfcba48e0b57341b131a6948513eb0235d0406
8d51d3444a0bd5851bc1213cad24cd54d73809210961891c3d9525c03c2206e5
a8968be35c05d541ccd4eb1c4af41cb3b27f470986c85cb23062ace8938828a9
ba3627978bd7d98b4294876d73a52f2e74cc4201cdbdaf043cb647042fba699d
da4929f143ad03e5465455bb1cf1333bf060ae7641f0fcf115ea65a30793e180
e1a4a4af35b61c2c9ae6f9c4273e0cc2bbced0d556ea7905becf4f586cba1893
e7de505c1c69628c07120cc5e298f89e1a2d90370ead5fb0acde8e518c58a88e