connect4dias-truist.com Open in urlscan Pro
2606:4700:3032::6815:18d8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://paramithoupoli.com/wxufi3au
Effective URL:
https://connect4dias-truist.com/obi/truist.php
Submission: On July 23 via manual (July 23rd 2023, 3:29:07 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3032::6815:18d8, located in United States and belongs to CLOUDFLARENET, US. The main domain is connect4dias-truist.com.
TLS certificate: Issued by GTS CA 1P5 on July 15th 2023. Valid for: 3 months.

This is the only time connect4dias-truist.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

	IP Address	AS Autonomous System
1 2	185.138.42.145 185.138.42.145	199246 (TOPHOST) (TOPHOST)
5	2606:4700:303... 2606:4700:3032::6815:18d8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6811:3b8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	4

2 185.138.42.145 (Greece) 1 redirects

ASN199246 (TOPHOST, GR)
PTR: server14.prohoster.gr

paramithoupoli.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:3032::6815:18d8 (United States)

ASN13335 (CLOUDFLARENET, US)

connect4dias-truist.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:3b8 (United States)

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	connect4dias-truist.com connect4dias-truist.com	71 KB
4	cloudflare.com challenges.cloudflare.com — Cisco Umbrella Rank: 6132	202 KB
2	paramithoupoli.com 1 redirects paramithoupoli.com	597 B
13	3

	Domain	Requested by
5	connect4dias-truist.com	connect4dias-truist.com
4	challenges.cloudflare.com	connect4dias-truist.com challenges.cloudflare.com
2	paramithoupoli.com	1 redirects
13	3

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
connect4dias-truist.com GTS CA 1P5	`2023-07-15` - `2023-10-13`	3 months	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2022-09-18` - `2023-09-17`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://connect4dias-truist.com/obi/truist.php
Frame ID: 9C748EB5F575AA57E54F11CAF8BE2925
Requests: 9 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: 971DCCE67C6D2DF676C1C5E4FCAAEA49
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

http://paramithoupoli.com/wxufi3au HTTP 302
http://paramithoupoli.com/media/ Page URL
https://connect4dias-truist.com/obi/truist.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

13
Requests

69 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

273 kB
Transfer

572 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://paramithoupoli.com/wxufi3au HTTP 302
http://paramithoupoli.com/media/ Page URL
https://connect4dias-truist.com/obi/truist.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://paramithoupoli.com/wxufi3au HTTP 302
http://paramithoupoli.com/media/

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
paramithoupoli.com/media/
Redirect Chain

http://paramithoupoli.com/wxufi3au
http://paramithoupoli.com/media/

93 B
356 B

177ms
177ms

Document
text/html

185.138.42.145
TOPHOST

General

Check archive.org

Show headers Download Go to

Full URL: http://paramithoupoli.com/media/
Protocol: HTTP/1.1
Server: 185.138.42.145 , Greece, ASN199246 (TOPHOST, GR),
Reverse DNS: server14.prohoster.gr
Software: Apache /
Resource Hash: aac2f0ab553d38bb57b12796dc749e9c2f1bf0e7f1309a14c387517a1a2df5ca

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 93
Content-Type: text/html
Date: Sun, 23 Jul 2023 15:29:02 GMT
Keep-Alive: timeout=5, max=99
Last-Modified: Fri, 21 Jul 2023 15:43:57 GMT
Server: Apache
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 216
Content-Type: text/html; charset=iso-8859-1
Date: Sun, 23 Jul 2023 15:29:02 GMT
Keep-Alive: timeout=5, max=100
Location: http://paramithoupoli.com/media/
Server: Apache

GET
H2 403 Primary Request truist.php Show response
connect4dias-truist.com/obi/ 7 KB
5 KB 82ms
14ms Document
text/html 2606:4700:3032::6815:18d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://connect4dias-truist.com/obi/truist.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6815:18d8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4eab747330c14cc7157db1c730db06b55c061cc75e3d2b18faf0a4ce40f3ae99

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: http://paramithoupoli.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated: challenge
cf-ray: 7eb4f4ed3e7a364a-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Sun, 23 Jul 2023 15:29:03 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V7bLQ%2Ffnk75GRpkKk3ZFH2EwpTlIIoV75QKK5VFoWiUJct05ngh%2FW5EMLEcGdIZBO2euJ%2B04a7GnC3aUPOMqvdT43%2Fauw%2BSL8Ud%2BYSFaBUoMB2Gu4aVPhRjF5QUzPAm05sAg65Vxl0x%2BJf8L2kPGuj1HTYc6Hg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 challenges.css
connect4dias-truist.com/cdn-cgi/styles/ 6 KB
3 KB 11ms
9ms Stylesheet
text/css 2606:4700:3032::6815:18d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://connect4dias-truist.com/cdn-cgi/styles/challenges.css

Requested by

Host: connect4dias-truist.com
URL: https://connect4dias-truist.com/obi/truist.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6815:18d8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://connect4dias-truist.com/obi/truist.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 15:29:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 Jul 2023 17:37:51 GMT
server: cloudflare
etag: W/"64b6cdef-19c8"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 7eb4f4ed7eeb364a-FRA
expires: Sun, 23 Jul 2023 17:29:03 GMT

GET
H2 200 v1 Show response
connect4dias-truist.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/ 161 KB
56 KB 18ms
17ms Script
application/javascript 2606:4700:3032::6815:18d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://connect4dias-truist.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7eb4f4ed3e7a364a
Requested by: Host: connect4dias-truist.com
URL: https://connect4dias-truist.com/obi/truist.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:18d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29af0a5024efe90405bf9687c99ff4b3135cc46100eee35ade9b2495abf4adb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://connect4dias-truist.com/obi/truist.php?__cf_chl_rt_tk=50FqePgS7wShHrhokq90uPO6bTvczYM71WfH5Ac60UQ-1690126143-0-gaNycGzNC1A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 15:29:03 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YeE%2BuleNqIGrgVvHbx7RLNufQCjQZ8Ua3f0n%2Fx0p8%2Fm66p0MtRPF%2BX0OlNXSHNsx53%2BqiJO3ryk8L2fKBkwRsQ7UTWoHlpqXfauyzoPeX4pxR7CrGFeHNW4%2BqybBiqQQXPBak1yOxsYaVfSZSaxxMej10Wrxow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, must-revalidate
cf-ray: 7eb4f4ed9f1d364a-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/b/e6489737/ 23 KB
8 KB 66ms
33ms Script
application/javascript 2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/e6489737/api.js?onload=PyE3&render=explicit
Requested by: Host: connect4dias-truist.com
URL: https://connect4dias-truist.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7eb4f4ed3e7a364a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36ceba7b5f9c16d9df8f530ff55e234f1b6ca7e8d1bc32d4810581dc605e9d30

Request headers

Referer
Origin: https://connect4dias-truist.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 15:29:03 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 7eb4f4ee1e156901-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 404 favicon.ico
connect4dias-truist.com/ 315 B
315 B 47ms
47ms Image
text/html 2606:4700:3032::6815:18d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://connect4dias-truist.com/favicon.ico
Requested by: Host: connect4dias-truist.com
URL: https://connect4dias-truist.com/obi/truist.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:18d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://connect4dias-truist.com/obi/truist.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 15:29:03 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6JY49F1z%2B0A%2BhI8D4YODizmoKFk8RQk23dgGJk1ulxH1SBOJ%2FV9r3mGJkiAQoanzc0mConBHTIMPvIA%2BnZNstXJyXJen%2FM1G%2FZ2GP1cPw%2B%2BdeYRPEfi7Rb2b2TWnw%2Fi5TBwZfIgdF%2BhZMuSxCs6hojvMki%2BV7w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 7eb4f4eddd9c30d6-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 586 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Type: image/png

GET
BLOB 200
OK 9e768906-c40a-4c1a-9657-c1c558919736
https://connect4dias-truist.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://connect4dias-truist.com/9e768906-c40a-4c1a-9657-c1c558919736
Requested by: Host: connect4dias-truist.com
URL: https://connect4dias-truist.com/obi/truist.php
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://connect4dias-truist.com/obi/truist.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H3 200 6c59fd4fce694f8 Show response
connect4dias-truist.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1042722255:1690124851:oTpNczzpyQ40WqwZmgQF0XPVRTPuYMsOpLBI67_kDNQ/7eb4f4ed3e7a364a/ 9 KB
8 KB 29ms
26ms XHR
text/plain 2606:4700:3032::6815:18d8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://connect4dias-truist.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1042722255:1690124851:oTpNczzpyQ40WqwZmgQF0XPVRTPuYMsOpLBI67_kDNQ/7eb4f4ed3e7a364a/6c59fd4fce694f8
Requested by: Host: connect4dias-truist.com
URL: https://connect4dias-truist.com/cdn-cgi/challenge-platform/h/b/orchestrate/managed/v1?ray=7eb4f4ed3e7a364a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:18d8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 599d43df67681fcad67ef953583a9d64644950ca5238ff59d3c9e36c460b66d1

Request headers

Referer: https://connect4dias-truist.com/obi/truist.php
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
CF-Challenge: 6c59fd4fce694f8
Content-type: application/x-www-form-urlencoded

Response headers

date: Sun, 23 Jul 2023 15:29:03 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WY%2Fr7%2B2lKnCAhklFoihLgqVK%2BZyHDfaKN%2Bn0X3b3UfFEGogit5al0jtUzAKhMYLEOcI7DDcHyMe%2BPD6p%2Fp86ioBW%2BgcLW%2BL13RB9kkdl0ndGhgz2Bw2CTaKfdSC5vGjXJxKLzShPRuiG5d8r0AH6Xx97ArcC%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7eb4f4ee9e8d30d6-FRA
alt-svc: h3=":443"; ma=86400
cf-chl-gen: rMXztXKxyAXg9Ao5JB2JYDe2k165ZMcl5mFFqXx5aXpkwu0uAeEhi49R3RvpBBeA$84fdiTXQeDj1CLj21Hy84g==

GET
H3 200 normal Show response
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 971D 24 KB
8 KB 37ms
18ms Document
text/html 2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/e6489737/api.js?onload=PyE3&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87f3d88549db2ea60b9aa07afc75e61ec2e11bc18a63519a6b6c3b05c9a2cead

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=0, must-revalidate
cf-ray: 7eb4f4ef0df1bb65-FRA
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Sun, 23 Jul 2023 15:29:03 GMT
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

GET
H3 200 v1 Show response
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/ Frame 971D 171 KB
60 KB 19ms
18ms Script
application/javascript 2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7eb4f4ef0df1bb65
Requested by: Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a1d3dad3977015dc7037f1f83f5a1d635b8c2121285dbbb53430d76d487d53f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 15:29:03 GMT
cache-control: max-age=0, must-revalidate
content-encoding: br
server: cloudflare
cf-ray: 7eb4f4ef6e7dbb65-FRA
alt-svc: h3=":443"; ma=86400
content-type: application/javascript; charset=UTF-8

GET
BLOB 200
OK c0c6a912-c9b1-48a0-b385-ba322c0e07da
https://challenges.cloudflare.com/ Frame 971D 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://challenges.cloudflare.com/c0c6a912-c9b1-48a0-b385-ba322c0e07da
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H3 200 34912e225c36f0b Show response
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1527895781:1690124880:c0vkyxfUlHSUIbQPLQ-9xpclvy-dS3WpVaohLv6n6rk/7eb4f4ef0df1bb65/ Frame 971D 169 KB
126 KB 119ms
119ms XHR
text/plain 2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1527895781:1690124880:c0vkyxfUlHSUIbQPLQ-9xpclvy-dS3WpVaohLv6n6rk/7eb4f4ef0df1bb65/34912e225c36f0b
Requested by: Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=7eb4f4ef0df1bb65
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c22f69491e35148f9c17bcd5adb2c8d41bac97bad62c4d9c908ce0eca2776ed

Request headers

Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/mbu3d/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36
CF-Challenge: 34912e225c36f0b
Content-type: application/x-www-form-urlencoded

Response headers

cf-chl-gen: y0WvYCSJdTZpk3Jxv0xCp/GElrh7TaQ1IbKavCUhdYnGGQm0nAS+2pqUrB18yr2AlB2fF3/upawra40WLVh/IEaZ9MpYseBfhd1me4C14/N1lvDFI7289IfbGwGMCoas93u4lPjl+Lkh/qddcjPwxeiYNJQNsHF8qpKoEkal2KxE1YLGasOIy7xVMCBdCE3Q1EblIbKF4skrmP6bUGUi6WKaak6CNCPA1E4AektQ5aMKcRgENPymT9WDXEkwFIeBJGXZQnNnB9WJPGzsdGvG+V117bWl8in0d508p0Gulze8LVZfjPAGLGrkKXxcpX/IVrnxwzLan2mdlOye0z/ad55qWbjImdxqj1+bSMs5Gk+B4Dnsgfq89PhqgvohNjRvCw8+iuleHyC+UR5XcuNUjT4+xzB9cfdqaulh8CzHsFfevryAdnfFN2MDRyxUDW5021Xmx8LHAAskX2LOg4qxlg==$ngMRnv+fvvxQXXe08e+0SQ==
date: Sun, 23 Jul 2023 15:29:04 GMT
content-encoding: br
server: cloudflare
cf-ray: 7eb4f4f0780abb65-FRA
alt-svc: h3=":443"; ma=86400
content-type: text/plain; charset=UTF-8

GET 7Y4mKOnOzsjQahd
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/7eb4f4ef0df1bb65/1690126144089/ Frame 971D 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/7eb4f4ef0df1bb65/1690126144089/7Y4mKOnOzsjQahd

Verdicts & Comments Add Verdict or Comment

Malicious task.url
Submitted on July 23rd 2023, 3:39:08 pm UTC — From United States

Threats: Phishing
Brands: Truist Bank US
Comment: This is a phishing URL pretending to be Truist Bank.

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			connect4dias-truist.com/	1970-01-20 13:28:49	Name: cf_chl_2 Value: 6c59fd4fce694f8

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://connect4dias-truist.com/obi/truist.php Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://connect4dias-truist.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://challenges.cloudflare.com/turnstile/v0/b/e6489737/api.js?onload=PyE3&render=explicit Message: Unrecognized origin: 'fullscreen'.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
connect4dias-truist.com
paramithoupoli.com
challenges.cloudflare.com
185.138.42.145
2606:4700:3032::6815:18d8
2606:4700::6811:3b8
29af0a5024efe90405bf9687c99ff4b3135cc46100eee35ade9b2495abf4adb1
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
36ceba7b5f9c16d9df8f530ff55e234f1b6ca7e8d1bc32d4810581dc605e9d30
4eab747330c14cc7157db1c730db06b55c061cc75e3d2b18faf0a4ce40f3ae99
599d43df67681fcad67ef953583a9d64644950ca5238ff59d3c9e36c460b66d1
5a1d3dad3977015dc7037f1f83f5a1d635b8c2121285dbbb53430d76d487d53f
87f3d88549db2ea60b9aa07afc75e61ec2e11bc18a63519a6b6c3b05c9a2cead
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
8c22f69491e35148f9c17bcd5adb2c8d41bac97bad62c4d9c908ce0eca2776ed
aac2f0ab553d38bb57b12796dc749e9c2f1bf0e7f1309a14c387517a1a2df5ca
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

connect4dias-truist.com Open in urlscan Pro 2606:4700:3032::6815:18d8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious — 1 votes Show Verdicts

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

69 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

273 kBTransfer

572 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Malicious task.url Submitted on July 23rd 2023, 3:39:08 pm UTC — From United States

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

15 JavaScript Global Variables

1 Cookies

5 Console Messages

Indicators

connect4dias-truist.com Open in urlscan Pro
2606:4700:3032::6815:18d8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

69 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

273 kB
Transfer

572 kB
Size

1
Cookies

13 HTTP transactions
1 data transactions

Malicious task.url
Submitted on July 23rd 2023, 3:39:08 pm UTC — From United States

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!