register.delta-holder.net
Open in
urlscan Pro
2606:4700:3035::6815:3d39
Malicious Activity!
Public Scan
Effective URL: https://register.delta-holder.net/qjhld/fr/?aid=ezYB1VXZv3CZQY6Yd&v=sport&var4=agn_255&hobj=eyJoc2lkIjogImQ4YjViZWZmOTgwZDFmNjYxZT...
Submission: On February 26 via manual from FR — Scanned from FR
Summary
TLS certificate: Issued by E1 on February 25th 2024. Valid for: 3 months.
This is the only time register.delta-holder.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 12 | 2606:4700:303... 2606:4700:3035::6815:3d39 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2606:4700:303... 2606:4700:3032::ac43:ceb7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 157.90.33.122 157.90.33.122 | 24940 (HETZNER-AS) (HETZNER-AS) | |
2 | 23.88.8.123 23.88.8.123 | 24940 (HETZNER-AS) (HETZNER-AS) | |
20 | 4 |
ASN13335 (CLOUDFLARENET, US)
router.delta-holder.net | |
register.delta-holder.net | |
api.delta-holder.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
delta-holder.net
2 redirects
router.delta-holder.net register.delta-holder.net api.delta-holder.net |
530 KB |
2 |
uidsync.net
uidsync.net — Cisco Umbrella Rank: 51166 |
714 B |
2 |
push-sdk.com
push-sdk.com — Cisco Umbrella Rank: 50430 |
15 KB |
20 | 3 |
Domain | Requested by | |
---|---|---|
12 | register.delta-holder.net |
register.delta-holder.net
|
5 | router.delta-holder.net |
2 redirects
router.delta-holder.net
|
2 | uidsync.net |
register.delta-holder.net
|
2 | push-sdk.com |
router.delta-holder.net
push-sdk.com |
1 | api.delta-holder.net |
register.delta-holder.net
|
20 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
delta-holder.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
delta-holder.net E1 |
2024-02-25 - 2024-05-25 |
3 months | crt.sh |
push-sdk.com R3 |
2024-02-15 - 2024-05-15 |
3 months | crt.sh |
uidsync.net Sectigo RSA Domain Validation Secure Server CA |
2023-12-30 - 2025-01-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://register.delta-holder.net/qjhld/fr/?aid=ezYB1VXZv3CZQY6Yd&v=sport&var4=agn_255&hobj=eyJoc2lkIjogImQ4YjViZWZmOTgwZDFmNjYxZTcyZWNjYmI4N2ZkZTE5ZjEyNTQ5YjExYWVhMjM2MjkwYTg3NmZlYWU1YzUwOTkiLCAiX19sb2NhdGlvbmNvZGUiOiAiRlIiLCAicHJpY2luZyI6IHsibmFtZSI6ICJldTU5IiwgInByaWNlIjogIjU5Ljk5IiwgImN1cnJlbmN5IjogIkVVUiIsICJjdXJyZW5jeV9zeW1ib2wiOiAiXHUyMGFjIiwgInRyaWFsIjogdHJ1ZSwgInBlcmlvZCI6IDMwLCAiYmlsbGluZ19wZXJpb2QiOiAxLCAiYmlsbGluZ19zdGVwIjogIm1vbnRoIiwgInRyaWFsX3N0ZXAiOiAiZGF5IiwgInRyaWFsX3BlcmlvZCI6IDcsICJkaXNwbGF5X3ByaWNlIjogIjU5Ljk5IFx1MjBhYyIsICJkaXNwbGF5X3ZfcHJpY2UiOiAiMSBcdTIwYWMiLCAidl9wcmljZSI6ICIxIn0sICJfX3BmdiI6ICJzdHJhYWxfY3NyIiwgInBheW1lbnRfdHlwZSI6ICJjYXJkIiwgImRvbWFpbiI6ICJkZWx0YS1ob2xkZXIubmV0IiwgIndpdGhfYXZzIjogZmFsc2UsICJhY3Rpb24iOiAicmVnaXN0cmF0aW9uIn0=
Frame ID: 812F6937C7A3539EE0792DED907B1C88
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
Delta-holderPage URL History Show full URLs
- https://router.delta-holder.net/?lp=qjhld&sidng=850ZArZRm8AE0eRYnYQ0OmgAS6&aid=ezYB1VXZv3CZQY6Yd&PCTX=&var3=... Page URL
-
https://router.delta-holder.net/cdn-cgi/phish-bypass?atok=uqpKvBrieqXu3hTZa6zYOZn7Z62.nT70h8fDMFsyFtY-170894...
HTTP 301
https://router.delta-holder.net/?lp=qjhld&sidng=850ZArZRm8AE0eRYnYQ0OmgAS6&aid=ezYB1VXZv3CZQY6Yd&PCTX=&var3=... HTTP 302
https://register.delta-holder.net/qjhld/fr/?aid=ezYB1VXZv3CZQY6Yd&v=sport&var4=agn_255&hobj=eyJoc2lkIjogImQ4Yj... Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Conditions d'utilisation
Search URL Search Domain Scan URL
Title: Politique de confidentialité
Search URL Search Domain Scan URL
Title: Assistance
Search URL Search Domain Scan URL
Title: Utilisateur déjà enregistré, veuillez entrer dans la zone Membre
Search URL Search Domain Scan URL
Title: cliquez ici.
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://router.delta-holder.net/?lp=qjhld&sidng=850ZArZRm8AE0eRYnYQ0OmgAS6&aid=ezYB1VXZv3CZQY6Yd&PCTX=&var3=&var4=agn_255&v=sport Page URL
-
https://router.delta-holder.net/cdn-cgi/phish-bypass?atok=uqpKvBrieqXu3hTZa6zYOZn7Z62.nT70h8fDMFsyFtY-1708941495-0.0-%2F%3Flp%3Dqjhld%26sidng%3D850ZArZRm8AE0eRYnYQ0OmgAS6%26aid%3DezYB1VXZv3CZQY6Yd%26PCTX%3D%26var3%3D%26var4%3Dagn_255%26v%3Dsport
HTTP 301
https://router.delta-holder.net/?lp=qjhld&sidng=850ZArZRm8AE0eRYnYQ0OmgAS6&aid=ezYB1VXZv3CZQY6Yd&PCTX=&var3=&var4=agn_255&v=sport HTTP 302
https://register.delta-holder.net/qjhld/fr/?aid=ezYB1VXZv3CZQY6Yd&v=sport&var4=agn_255&hobj=eyJoc2lkIjogImQ4YjViZWZmOTgwZDFmNjYxZTcyZWNjYmI4N2ZkZTE5ZjEyNTQ5YjExYWVhMjM2MjkwYTg3NmZlYWU1YzUwOTkiLCAiX19sb2NhdGlvbmNvZGUiOiAiRlIiLCAicHJpY2luZyI6IHsibmFtZSI6ICJldTU5IiwgInByaWNlIjogIjU5Ljk5IiwgImN1cnJlbmN5IjogIkVVUiIsICJjdXJyZW5jeV9zeW1ib2wiOiAiXHUyMGFjIiwgInRyaWFsIjogdHJ1ZSwgInBlcmlvZCI6IDMwLCAiYmlsbGluZ19wZXJpb2QiOiAxLCAiYmlsbGluZ19zdGVwIjogIm1vbnRoIiwgInRyaWFsX3N0ZXAiOiAiZGF5IiwgInRyaWFsX3BlcmlvZCI6IDcsICJkaXNwbGF5X3ByaWNlIjogIjU5Ljk5IFx1MjBhYyIsICJkaXNwbGF5X3ZfcHJpY2UiOiAiMSBcdTIwYWMiLCAidl9wcmljZSI6ICIxIn0sICJfX3BmdiI6ICJzdHJhYWxfY3NyIiwgInBheW1lbnRfdHlwZSI6ICJjYXJkIiwgImRvbWFpbiI6ICJkZWx0YS1ob2xkZXIubmV0IiwgIndpdGhfYXZzIjogZmFsc2UsICJhY3Rpb24iOiAicmVnaXN0cmF0aW9uIn0= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
router.delta-holder.net/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
router.delta-holder.net/cdn-cgi/styles/ |
24 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
router.delta-holder.net/cdn-cgi/images/ |
452 B 540 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
register.delta-holder.net/qjhld/fr/ Redirect Chain
|
75 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.8d6405b3d619d6b57346.css
register.delta-holder.net/qjhld/assets/ |
105 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
EN_36e0c296adb3cc2b7669.png
register.delta-holder.net/qjhld/assets/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime.9552cc599bbd464fba55.js
register.delta-holder.net/qjhld/assets/ |
1 KB 1016 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.280072115b3d477ca93b.js
register.delta-holder.net/qjhld/assets/ |
551 KB 154 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.c71a2086e5157abffd04.js
register.delta-holder.net/qjhld/assets/ |
130 B 445 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v-sport-desktop_aebed4d0433cf1f6952a.jpg
register.delta-holder.net/qjhld/assets/ |
131 KB 132 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
global-flags-sprite-2_dedc674a9038eda65c08.png
register.delta-holder.net/qjhld/assets/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-check_04326d00d53fbbd0554e.svg
register.delta-holder.net/qjhld/assets/ |
253 B 703 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dRWiJM.js
register.delta-holder.net/s/627794/ |
400 KB 173 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
info
api.delta-holder.net/ |
733 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-signup_0f46400151d903afd110.svg
register.delta-holder.net/qjhld/assets/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-arrow_5f86d7a80ae0e4dc7fe1.svg
register.delta-holder.net/qjhld/assets/ |
227 B 690 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
push-sdk.com/f/ |
52 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
push-sdk.com/ |
0 533 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
sync
uidsync.net/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sync
uidsync.net/ |
62 B 714 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| languageOptions object| config object| errorCodes object| notifications object| webpackChunkusertive function| jQuery function| $ object| Landify boolean| __MOCKS__ object| dftc object| dftp function| ptfdb function| ptfda object| webpackChunkdftp object| __SENTRY__4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.router.delta-holder.net/ | Name: __cf_mw_byp Value: uqpKvBrieqXu3hTZa6zYOZn7Z62.nT70h8fDMFsyFtY-1708941495-0.0-/?lp=qjhld&sidng=850ZArZRm8AE0eRYnYQ0OmgAS6&aid=ezYB1VXZv3CZQY6Yd&PCTX=&var3=&var4=agn_255&v=sport |
|
router.delta-holder.net/ | Name: air3_site_cookie Value: 841205dcbffd0a9758cc2f4b9dcad48c3b1122cbgAWVRAAAAAAAAACMQGQ4YjViZWZmOTgwZDFmNjYxZTcyZWNjYmI4N2ZkZTE5ZjEyNTQ5YjExYWVhMjM2MjkwYTg3NmZlYWU1YzUwOTmULg== |
|
register.delta-holder.net/ | Name: session_id Value: 8ee2f1fb356946cf8312e198a4868e9c |
|
uidsync.net/ | Name: rauid Value: F6yj30h3Aps68WKziDlmZA |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.delta-holder.net
push-sdk.com
register.delta-holder.net
router.delta-holder.net
uidsync.net
157.90.33.122
23.88.8.123
2606:4700:3032::ac43:ceb7
2606:4700:3035::6815:3d39
00cc1d6f8359763349a09d2c5b32b6d1de9b0642a6838c22ee34e9b329447da5
0491d655d983ca22c3067197cfb485987b363b728c79ac9eda1aa501a518ed0d
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
2cd0d78851b71ad945050f6b015117d026c235434369e8be9e165bca3c817f9a
3b88ad05f0634903de5f2cc181eaed1def62f330a44cb4377da775e021f37a83
55da05ee0ca5cbbf20d05b8c6112c0f21bf245b8f5afcbc05304e771af6d3679
6d643acb7754232b13871b224b1a5723d7398c22fe315d150ca3c1ff0c1bbfc5
6dc735f086bbaa28504be70ca3f9e8196a5494c2a80a5e6d38fb9daf844e5a4f
77e45de570ed3f1db91e77c148aabc5f2a9d7e07f6e61d8f8c91f20f3f504e36
85e87e9192dcdf28c9c0c1c6a5fe18203c73d7853376ee9b25738ba85ba42a51
862a5d60a8d9f983384d3e54eb7201463b87d37d81b91cc4bf7e929f2d791b8e
afefc5aa2abfd3222999feb838c1783f136576d4810109699afe39c2444c0d6f
b37638a6d8a99c9ff6a194a71167435a8bdbc03d2ef784d3abb6ed59084d4a8b
c6ef382473f396153b81e96ef082c8fba2cc2ff899a9fca1500221b1d4c2612c
d1860b93b3ea4d6ea19f84339f0f648b7d907e8b0d38b04cd231b54653da5419
e1162768d7067b4581c82f40bb924b854404e10d8447ff11e06e6184d34db47d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea2ea0cc22d0d4d714a95dff9aa3846a57beb9fd2d7b0c14a2ca238dcc11f329
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016