pposi2.ga
Open in
urlscan Pro
2606:4700:3037::681c:1dd0
Malicious Activity!
Public Scan
Effective URL: https://pposi2.ga/au-tues22dec-1361/Mpx-928571/?[and]gclid=EAIaIQobChMIkd_z_4rj7QIVwY6PCh3aDQKGEAEYASAAEgK8LvD_BwE...
Submission: On December 23 via manual from AU
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 24th 2020. Valid for: a year.
This is the only time pposi2.ga was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 2606:4700:303... 2606:4700:3037::681c:1dd0 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 2 |
Domain | Requested by | |
---|---|---|
9 | pposi2.ga |
pposi2.ga
|
9 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-11-24 - 2021-11-23 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://pposi2.ga/au-tues22dec-1361/Mpx-928571/?[and]gclid=EAIaIQobChMIkd_z_4rj7QIVwY6PCh3aDQKGEAEYASAAEgK8LvD_BwE[and]ept2=20fcdc02-6166-4674-bc9e-f2967c851ab0
Frame ID: 0FCEF4F86AAEE35600BDB4E9F29CB9D3
Requests: 8 HTTP requests in this frame
Frame:
https://pposi2.ga/au-tues22dec-1361/Mpx-928571/beep.mp3
Frame ID: A55BBD4A6EA77C3F768A446946E45A10
Requests: 2 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://pposi2.ga/au-tues22dec-1361/?[and]gclid=EAIaIQobChMIkd_z_4rj7QIVwY6PCh3aDQKGEAEYASAAEg... Page URL
- https://pposi2.ga/au-tues22dec-1361/Mpx-928571/?[and]gclid=EAIaIQobChMIkd_z_4rj7QIVwY6PCh3aDQK... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://pposi2.ga/au-tues22dec-1361/?[and]gclid=EAIaIQobChMIkd_z_4rj7QIVwY6PCh3aDQKGEAEYASAAEgK8LvD_BwE[and]ept2=20fcdc02-6166-4674-bc9e-f2967c851ab0 Page URL
- https://pposi2.ga/au-tues22dec-1361/Mpx-928571/?[and]gclid=EAIaIQobChMIkd_z_4rj7QIVwY6PCh3aDQKGEAEYASAAEgK8LvD_BwE[and]ept2=20fcdc02-6166-4674-bc9e-f2967c851ab0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
pposi2.ga/au-tues22dec-1361/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
pposi2.ga/au-tues22dec-1361/Mpx-928571/ |
15 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
pposi2.ga/au-tues22dec-1361/Mpx-928571/ |
2 KB 816 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.js
pposi2.ga/au-tues22dec-1361/Mpx-928571/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mac.png
pposi2.ga/au-tues22dec-1361/Mpx-928571/ |
128 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beep.mp3
pposi2.ga/au-tues22dec-1361/Mpx-928571/ Frame A55B |
0 0 |
Document
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
239 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
err.mp3
pposi2.ga/au-tues22dec-1361/Mpx-928571/ |
196 KB 197 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beep.mp3
pposi2.ga/au-tues22dec-1361/Mpx-928571/ |
8 KB 9 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beep.mp3
pposi2.ga/au-tues22dec-1361/Mpx-928571/ Frame A55B |
8 KB 9 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Tech Support Scam (Consumer)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| el function| rfs undefined| wscript number| full function| toggleFullScreen string| tollfree string| m1 string| m2 function| myFunction function| rtclickcheck object| msgAudioEl number| playMsgInt object| modal object| btn undefined| span function| addEvent function| get_browser boolean| InternetEx boolean| isIEedge object| browser undefined| msg_ff1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.pposi2.ga/ | Name: __cfduid Value: d56c6bebeda2adc06cc1a67ee649a84491608717771 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
pposi2.ga
2606:4700:3037::681c:1dd0
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
2e2f4900737cbe72c30eddfae23530b0a20cfa2329d738ea12ed4eeeffc76f10
4ffe7794a272f4784dbae4ebdc21cb26cd0bf429862633141b8cd5e678c8697e
6b04413b9d19b6ce2d6575f4e2c4be79e65bbb725637eea7d386fa15d4fbff0d
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
d64f4753d34baef57074d172306c8dae667d5a8890f6e68ec9434eadf19c042d
e84afe8a9e7c481deb801c0461a8dd8107470628fb90069d156b5d04390b4fcd
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65