racket-ambiguous.co.uk
Open in
urlscan Pro
69.49.228.26
Malicious Activity!
Public Scan
Submission: On May 25 via automatic, source openphish
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 20th 2021. Valid for: 3 months.
This is the only time racket-ambiguous.co.uk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Protonmail (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 69.49.228.26 69.49.228.26 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 185.70.41.130 185.70.41.130 | 62371 (PROTON) (PROTON) | |
11 | 3 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 69-49-228-26.unifiedlayer.com
racket-ambiguous.co.uk |
ASN62371 (PROTON, CH)
PTR: 185-70-41-130.protonmail.ch
mail.protonmail.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
racket-ambiguous.co.uk
racket-ambiguous.co.uk |
558 KB |
2 |
protonmail.com
mail.protonmail.com |
5 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
6 | racket-ambiguous.co.uk |
racket-ambiguous.co.uk
|
2 | mail.protonmail.com |
racket-ambiguous.co.uk
|
11 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
mail.protonmail.com |
protonmail.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
racket-ambiguous.co.uk cPanel, Inc. Certification Authority |
2021-05-20 - 2021-08-18 |
3 months | crt.sh |
protonmail.com SwissSign EV Gold CA 2014 - G22 |
2019-10-25 - 2021-10-25 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/login2.php
Frame ID: C2183E3415DD70298E1F3313C17C6E73
Requests: 11 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Sign up for free
Search URL Search Domain Scan URL
Title: Log out
Search URL Search Domain Scan URL
Title: 3.11.7
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login2.php
racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/assets/ |
544 KB 544 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
backto.png
racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/assets/ |
777 B 1019 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
report.png
racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/assets/ |
749 B 991 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/assets/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
decrypt.png
racket-ambiguous.co.uk/proton/proton/cmd-login=2d31d5c9d52dd9c521620c808d5558d4/assets/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
mail.protonmail.com/assets/img/ |
5 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
host.png
mail.protonmail.com//assets/ |
42 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.woff2
mail.protonmail.com/https://mail.protonmail.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.woff
mail.protonmail.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.ttf
mail.protonmail.com/assets/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- mail.protonmail.com
- URL
- https://mail.protonmail.com/https://mail.protonmail.com/assets/fonts/fontawesome-webfont.woff2
- Domain
- mail.protonmail.com
- URL
- https://mail.protonmail.com/assets/fonts/fontawesome-webfont.woff
- Domain
- mail.protonmail.com
- URL
- https://mail.protonmail.com/assets/fonts/fontawesome-webfont.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Protonmail (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.protonmail.com
racket-ambiguous.co.uk
mail.protonmail.com
185.70.41.130
69.49.228.26
1802929e6ef6154c697c22582519d72a1e33528ab4784e9313153973ca459e46
27fce56d0c495d504f13f48fc6c7b5b8e571b06d05cd342f463dfa93dbf65110
4a999ca02ebdfa56358214681d6e00e2a1a5660fa93b5de77a18d9f565e5daa6
5b8c2f95bd9c3634cba8e86053f73649fbfd1e8ef3c2889089300b1dfc4310ea
8e918cd0cfb05ae079469642a7fa00b724da86e266f4e067ed71999c3da14045
95d2bee962d76c2bd39b6133806fdbff6ea6a49df4a56bc556ffcacce97ba569
9ff02cecda6977d867aa29d5441a95e523be380dcec8867689064903e9f41cce
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629