deauth-payment.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://deauth-payment.web.app/
Submission: On August 02 via api (August 2nd 2023, 4:03:39 am UTC) from JP — Scanned from JP

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 14 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is deauth-payment.web.app.
TLS certificate: Issued by GTS CA 1D4 on July 10th 2023. Valid for: 3 months.

This is the only time deauth-payment.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UBank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
9	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2606:4700:20:... 2606:4700:20::681a:e2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	3

9 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

deauth-payment.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:e2 (United States)

ASN13335 (CLOUDFLARENET, US)

api.country.is	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	web.app deauth-payment.web.app	217 KB
1	country.is api.country.is — Cisco Umbrella Rank: 67002	498 B
0	cloudclusters.net Failed nodejsclusters-98107-0.cloudclusters.net Failed
0	ubank.com.au Failed www.ubank.com.au Failed
14	4

	Domain	Requested by
9	deauth-payment.web.app	deauth-payment.web.app
1	api.country.is	deauth-payment.web.app
0	nodejsclusters-98107-0.cloudclusters.net Failed	deauth-payment.web.app
0	www.ubank.com.au Failed	deauth-payment.web.app
14	4

This site contains no links.

Subject Issuer	Validity	Valid
web.app GTS CA 1D4	`2023-07-10` - `2023-10-08`	3 months	crt.sh
country.is GTS CA 1P5	`2023-06-26` - `2023-09-24`	3 months	crt.sh

This page contains 1 frames:

Frame: https://www.ubank.com.au/security
Frame ID: 65F1A2035E0B9487D19F01C5C8F8346A
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

/_nuxt/

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

14
Requests

71 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

317 kB
Transfer

684 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

https://www.ubank.com.au/ HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security HTTP 301
https://www.ubank.com.au/security

14 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
deauth-payment.web.app/ 3 KB
1 KB 73ms
66ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f282dd8b899067cde9af3390320160bd8737c4aa36042f674fe5f9bf3209ee95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 812
content-type: text/html; charset=utf-8
date: Wed, 02 Aug 2023 04:03:34 GMT
etag: "35c002ad043798386672ede87cd68b9bbbf874358f631702cc44c0b5239d5b37-br"
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-tyo11933-TYO
x-timer: S1690949014.388318,VS0,VE65

GET
H2 200 all.css
deauth-payment.web.app/css/ 205 KB
112 KB 189ms
187ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/css/all.css

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

56c54b239ab556fa49b0b0a08e32b8e93163adeb697523f1b5234e7a68e2d20e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11933-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:34 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949014.458349,VS0,VE186
etag: "6ba07394d3f21bb27a7aefe8035e51b20f4162c0e818dcb820cca9d03593ef0a-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 114685
x-cache-hits: 0

GET
H2 200 6.8384127e8a36870ab7710.2647527606916844.js Show response
deauth-payment.web.app/_nuxt/ 2 KB
1 KB 93ms
92ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cf2a978e69af2415f814dfc3ee4bebdf9de3d8206551ea1802eddea0eb76cacf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11933-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:34 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949014.459196,VS0,VE90
etag: "3d86fc93346307f589b0e3e748155ca348b1421598fe36b155c53e7e7d249f3f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1090
x-cache-hits: 0

GET
H2 200 1.bb6f214981248c203ad73.4623347280076144.js Show response
deauth-payment.web.app/_nuxt/ 196 KB
60 KB 130ms
129ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/1.bb6f214981248c203ad73.4623347280076144.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a6d9b88c80a3d59419b6298ec8755d8dc32a6aecbcad7f69a60ec94c9121f4b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11933-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:34 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949014.458895,VS0,VE127
etag: "02e8e0b8a1c553666132af4846e979f25dc6a8871cae922644abec79e5a8f060-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 60787
x-cache-hits: 0

GET
H2 200 7.12dbc447fae6e1151a5e3.4623347280076144.js Show response
deauth-payment.web.app/_nuxt/ 82 KB
20 KB 98ms
98ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/7.12dbc447fae6e1151a5e3.4623347280076144.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cd5df10f18671eabf9ea5602792462061406e4a225d8d7bd394f13b7190751d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11933-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:34 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949014.458627,VS0,VE96
etag: "c7d97d2f8b9f9aec203039eed5638de3deec4f56de918d492c49dfa91fc8ae94-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 20585
x-cache-hits: 0

GET
H2 200 0.d45d2c1f1ac272d9bf5d3.4623347280076144.js Show response
deauth-payment.web.app/_nuxt/ 119 B
226 B 67ms
66ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/0.d45d2c1f1ac272d9bf5d3.4623347280076144.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

29d1fcb647221267dcf98b6872cad8548a12ad476f596b2792e71805b6280df9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11933-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:34 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949014.458742,VS0,VE65
etag: "934661474f9f496307ec1b83e4500207efe2b035cb209768b30b3d26fb35837f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 90
x-cache-hits: 0

GET
H3 200 2.9fbf47f0a7bd2e2b4fad3.4623347280076144.js Show response
deauth-payment.web.app/_nuxt/ 27 KB
9 KB 356ms
356ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/2.9fbf47f0a7bd2e2b4fad3.4623347280076144.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1c2d390c0c023ba77a828697c2f9391c698697e848e72a950b75d684acf2609b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11949-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:35 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949015.691607,VS0,VE352
etag: "5c1a2665f7cce3d72084689ed4b430e5ff23f557dd00e0012838d70d0cd861f2-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9274
x-cache-hits: 0

GET
H3 200 8.f3a13e8873c9d117a6c63.4623347280076144.js Show response
deauth-payment.web.app/_nuxt/ 22 KB
6 KB 318ms
317ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/8.f3a13e8873c9d117a6c63.4623347280076144.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

bde016c14f81018a71651df29f9ecb39391a56e1f0ee57600658a5c70db06405

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11949-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:35 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949015.691897,VS0,VE315
etag: "60cab89b422c17ed6a105efea541d8fdebc7a9cf1e854ad0d29a4b6c3fab2d25-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6174
x-cache-hits: 0

GET
H3 200 5.d7d1f5b32ed5ac6e15113.4623347280076144.js Show response
deauth-payment.web.app/_nuxt/ 46 KB
7 KB 355ms
354ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://deauth-payment.web.app/_nuxt/5.d7d1f5b32ed5ac6e15113.4623347280076144.js

Requested by

Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/_nuxt/6.8384127e8a36870ab7710.2647527606916844.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6f2641d74827177452e73ef87791459898cf1c000df652f9dcb40b16e4384632

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-served-by: cache-tyo11949-TYO
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Wed, 02 Aug 2023 04:03:35 GMT
last-modified: Tue, 01 Aug 2023 22:38:10 GMT
x-timer: S1690949015.691911,VS0,VE351
etag: "3c594afdef962c362e79c6116f596be17f1912ffdf0bde95d529089d39ee352f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6728
x-cache-hits: 0

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 20dfc900c1a420e37d3f927022783b152ee0984233bff9e7455a127d97b9c6f3

Request headers

Referer
Origin: https://deauth-payment.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: font/woff2

GET /
www.ubank.com.au/ 0
0

GET
H2 200 /
api.country.is/ 42 B
498 B 245ms
232ms Fetch
application/json 2606:4700:20::681a:e2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.country.is/
Requested by: Host: deauth-payment.web.app
URL: https://deauth-payment.web.app/_nuxt/5.d7d1f5b32ed5ac6e15113.4623347280076144.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:e2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://deauth-payment.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 04:03:35 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "2a-HN6mWXV4Dh77WT7xqELTkq4Q2HA"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XsL3iMBRYDdu6QlLbib33NVPXMFJI84a6xM6a38DvyDR7OR0lMYNjiaAKIiO6xgeZnWcNT%2FoyGtiN7phwtUQPFOeFz6r97xpXYB4O6vuWg9aMgaVppGB6bA4%2FXNUrWWgk6DvT7D4Mmk%2BtgLD"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
cf-ray: 7f036e905f66b011-NRT
content-length: 42

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d310cc9a575659f46afe99fb7328b3803176a34e7fd02f9a5b9f4d287064536f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 17 KB
17 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07f30e0930956e9c5605b7e23122bb88dc36887e7d8e29a0b9fe81e69be866e0

Request headers

Referer
Origin: https://deauth-payment.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 20 KB
20 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7fc3aa8a33550a9ac7c660b3f7ce1f4367dd9bd6a28cf4a151835a2fc0325ac7

Request headers

Referer
Origin: https://deauth-payment.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: font/woff2

GET sparkle-icons.woff
www.ubank.com.au/welcome/assets/fonts/sparkle-icons/ 0
0

GET
DATA 200
OK truncated
/ 47 KB
47 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 447472d83625235afec8c0378a9116fc457b3519676f999ed1b825d0a6197c6c

Request headers

Referer
Origin: https://deauth-payment.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: font/woff

GET

security
www.ubank.com.au/
Redirect Chain

https://www.ubank.com.au/
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security
https://www.ubank.com.au/security

0
0

GET 2001:ac8:40:1e::2e
nodejsclusters-98107-0.cloudclusters.net/checkIp/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.ubank.com.au
URL: https://www.ubank.com.au/

Domain: www.ubank.com.au
URL: https://www.ubank.com.au/welcome/assets/fonts/sparkle-icons/sparkle-icons.woff

Domain: www.ubank.com.au
URL: https://www.ubank.com.au/security

Domain: nodejsclusters-98107-0.cloudclusters.net
URL: https://nodejsclusters-98107-0.cloudclusters.net/checkIp/2001:ac8:40:1e::2e

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UBank (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ubank.com.au/	1970-01-20 22:28:05	Name: _abck Value: F0B1C5D231661ADD55661E67558EA08A~-1~YAAQoFXcF9qRo4uJAQAAuVdqtAqTKCwIRvsQVPawOMh6SG8spdaAY1JgfpVR5I3STP/1tmRn86HEjJ8ESyTGlooqiVx7ojOCH9a+PK66HrRkUUT+SQaS+jX3nMADG7li69gN0W1i698+8anBMabU0FbripJo/9JN99bzUPzRaa9uaP+Kq9jKelknlx0kq2deVGFv3giOGzkvxcC3esgG9UkIUYn0LxbPJ/sLOYM7Q8t4KFTNDDn785BFuz1LajGtLo/avDyC1O3ZIFa+Bmb6P520Kb60EWErj/hT5fL28hgGVjoUgxph9vhPhUCz8z25zMvFAdARFArheJjQZI6zbqNMcn0gzUti9YNuo7qs6OB0hVOvG0DoWOxRjAnHqw==~-1~-1~-1
			.ubank.com.au/	1970-01-20 13:42:43	Name: bm_sz Value: 94988BDD1F0E93B4409807AF3B49042C~YAAQoFXcF9yRo4uJAQAAuVdqtBS4VTG5tplLLbIuK7QwWWzMCW0+gSpHEvsNXEZ1seoKe4iLILsgJg5ixBrg0vYRBGm64Om1IcXHP99teipdbZm/eoDQlc6phBpfYGsgSDgvI1wcf/8f82JX4SF+HiTP1i951A/Dv7ugb7VycQxqGUHZuQdd/L4GNTBJVSv7gwJ+j0FBXJIf2IafmlmGL+ZXUWjvC8GiNZRBYxgqqe7/i70m9S4ArM0jC8B/auw8/TK8nbrEj6NS1xpu5JqYyXLsMbziUj79n28KGAmrtKQ10rIeuQ==~3159606~3682625

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://deauth-payment.web.app/ Message: Access to font at 'https://www.ubank.com.au/welcome/assets/fonts/sparkle-icons/sparkle-icons.woff' from origin 'https://deauth-payment.web.app' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.ubank.com.au/welcome/assets/fonts/sparkle-icons/sparkle-icons.woff Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.country.is
deauth-payment.web.app
nodejsclusters-98107-0.cloudclusters.net
www.ubank.com.au
nodejsclusters-98107-0.cloudclusters.net
www.ubank.com.au
2606:4700:20::681a:e2
2620:0:890::100
07f30e0930956e9c5605b7e23122bb88dc36887e7d8e29a0b9fe81e69be866e0
1c2d390c0c023ba77a828697c2f9391c698697e848e72a950b75d684acf2609b
20dfc900c1a420e37d3f927022783b152ee0984233bff9e7455a127d97b9c6f3
29d1fcb647221267dcf98b6872cad8548a12ad476f596b2792e71805b6280df9
447472d83625235afec8c0378a9116fc457b3519676f999ed1b825d0a6197c6c
56c54b239ab556fa49b0b0a08e32b8e93163adeb697523f1b5234e7a68e2d20e
6f2641d74827177452e73ef87791459898cf1c000df652f9dcb40b16e4384632
7fc3aa8a33550a9ac7c660b3f7ce1f4367dd9bd6a28cf4a151835a2fc0325ac7
a6d9b88c80a3d59419b6298ec8755d8dc32a6aecbcad7f69a60ec94c9121f4b0
bde016c14f81018a71651df29f9ecb39391a56e1f0ee57600658a5c70db06405
cd5df10f18671eabf9ea5602792462061406e4a225d8d7bd394f13b7190751d5
cf2a978e69af2415f814dfc3ee4bebdf9de3d8206551ea1802eddea0eb76cacf
d310cc9a575659f46afe99fb7328b3803176a34e7fd02f9a5b9f4d287064536f
f282dd8b899067cde9af3390320160bd8737c4aa36042f674fe5f9bf3209ee95

deauth-payment.web.app Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

71 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

317 kBTransfer

684 kBSize

2 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

2 Console Messages

Security Headers

Indicators

deauth-payment.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

71 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

317 kB
Transfer

684 kB
Size

2
Cookies

14 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!