nextmoovrecords.com Open in urlscan Pro
2606:4700:3030::ac43:c7fa Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://nextmoovrecords.com/
Submission: On March 13 via api (March 13th 2024, 7:39:48 pm UTC) from EE — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3030::ac43:c7fa, located in United States and belongs to CLOUDFLARENET, US. The main domain is nextmoovrecords.com.
TLS certificate: Issued by GTS CA 1P5 on February 27th 2024. Valid for: 3 months.

This is the only time nextmoovrecords.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USPS (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:303... 2606:4700:3030::ac43:c7fa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	76.76.21.241 76.76.21.241	16509 (AMAZON-02) (AMAZON-02)
11	3

8 2606:4700:3030::ac43:c7fa (United States)

ASN13335 (CLOUDFLARENET, US)

nextmoovrecords.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.76.21.241 (Walnut, United States)

ASN16509 (AMAZON-02, US)

us.umami.is	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	nextmoovrecords.com nextmoovrecords.com	170 KB
3	umami.is us.umami.is — Cisco Umbrella Rank: 702767	3 KB
11	2

	Domain	Requested by
8	nextmoovrecords.com	nextmoovrecords.com
3	us.umami.is	nextmoovrecords.com us.umami.is
11	2

This site contains no links.

Subject Issuer	Validity	Valid
nextmoovrecords.com GTS CA 1P5	`2024-02-27` - `2024-05-27`	3 months	crt.sh
us.umami.is R3	`2024-01-29` - `2024-04-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nextmoovrecords.com/
Frame ID: 7ED4E5A50C0AD5B10A54B6E9D412BEAD
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

U𝑺𝑷𝑺.com® - U𝑺𝑷𝑺 Tracking® Results

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

172 kB
Transfer

270 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
nextmoovrecords.com/ 1 KB
1 KB 356ms
281ms Document
text/html 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextmoovrecords.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 325b1265740262ced79043f657a9a7f2aca3b39a4eb43a790b7a639d0734386a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 863e7ddc080e371c-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 13 Mar 2024 19:39:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gp89phCfUOWwRJL92F6oUwX%2F5YQfUlVdiYWBQ6B9cOPD7NLyhw8wfW3hDy9YkoMpqrtIIE3qvRuYC1r9ceLdg2b9D139n3VzsnCMGDgtrkdowyHYpT4otZUq5whyrl149u02lhL%2ByesGXf4MF1uRxtKG"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 script.js Show response
us.umami.is/ 2 KB
2 KB 65ms
17ms Script
application/javascript 76.76.21.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://us.umami.is/script.js

Requested by

Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

6fc6fda94186ec00fc02e14c40ce06a83eeea8fe36c684f7fc346c488d52e407

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';img-src ;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self'
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

content-security-policy: default-src 'self';img-src *;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' *
content-encoding: br
date: Wed, 13 Mar 2024 19:39:43 GMT
server: Vercel
strict-transport-security: max-age=63072000
age: 142706
x-matched-path: /script.js
etag: W/"18a5a03a0306a75df40e6df799b8f211"
x-vercel-cache: HIT
x-dns-prefetch-control: on
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-vercel-id: fra1::sjw2r-1710358783698-7f7ebd7fd1ef
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="script.js"

GET
H2 200 chunk-vendors.ca913239.js Show response
nextmoovrecords.com/js/ 99 KB
38 KB 339ms
339ms Script
application/javascript 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextmoovrecords.com/js/chunk-vendors.ca913239.js
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d548d32f1acad054d35791fb4494b2f14792ea11199a1d7ce8dd7e1b43ccfd11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b74b10-18c1f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sPmzYsmzQqlGOgzCcLKCAi5L9tK%2FY6MO6PNOHpkL11KEkpBlfOCYhyUwH1f0eFKiYa4uAwq2%2B0jhsU3g0bPC3126TivBrRWbAyFclLbufnz5YRJTImKtHQCc43s1qDSGiksHT9k1K2S7q06nxK2TrG8G"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 863e7dddda6d371c-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 14 Mar 2024 07:39:43 GMT

GET
H2 200 app.e4905b08.js Show response
nextmoovrecords.com/js/ 8 KB
3 KB 77ms
77ms Script
application/javascript 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextmoovrecords.com/js/app.e4905b08.js
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bb0b33257d0cc3a271566b5e39a81341439a95c8ee4315616b8f1fee52e4ec3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 6108
etag: W/"65b74b10-1f84"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wgBv3I0C1ql8gSXNZ9bqsIlRXFNCJASmnLazf24jjLEJ3xNDAYQLOTYGjh0IYRkwJ%2Fk7%2B5C2uAsEZYpAMyeyDaqp3sOaiT%2BkfYMbR68xjD%2F%2F%2Fh841RKukpiv8O%2F5aATa4%2BjRhvuRT5iTaHfmAD919JvB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 863e7dddea92371c-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 14 Mar 2024 05:57:55 GMT

GET
H2 200 app.9b8d7b51.css
nextmoovrecords.com/css/ 35 KB
24 KB 324ms
323ms Stylesheet
text/css 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextmoovrecords.com/css/app.9b8d7b51.css
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bee8ee56c3e18aec4ef04b5e5a3dfd6fa6d0de71e9860ad0efeb1c7647092844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:43 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b74b10-8a1e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bEbIfV3r16d4qsc91bjrhQKLjE4ZTx908%2BdXRO567Pm6oI6k5nXzx9FBgsCGhpHrIDHLtQemTmUiz7hfdazWCAkqhA17EgW3qRJNp%2BBbhwajX7%2BpyvMP7nowJCc34rVC91WT7vIkGC28z5Sng7y9avuW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=43200
cf-ray: 863e7dddda69371c-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 14 Mar 2024 07:39:43 GMT

GET
H2 200 loading.jpg
nextmoovrecords.com/ 80 KB
80 KB 410ms
410ms Image
image/jpeg 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextmoovrecords.com/loading.jpg
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:44 GMT
cf-cache-status: MISS
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "65b74b10-13ea4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=znekOsACmq6CzPL9f4%2Fz2JhxTHXbfKsG74mQx%2Byqhi4KEc86eYXkSZLTiYgVpa9tzNI9kvBBReA4dWPBbc%2FzZUz4yM%2F1ZJvwZXQuu9XPRvzXK7efjBy2KLGedhjSbRGOrGiomg73C5uBFKOTY%2F2LBNot"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 863e7dddda6b371c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 81572
expires: Fri, 12 Apr 2024 19:39:43 GMT

GET
H3 200 logo_mobile.66d3314d.svg
nextmoovrecords.com/img/ 2 KB
1 KB 233ms
233ms Image
image/svg+xml 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextmoovrecords.com/img/logo_mobile.66d3314d.svg
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:44 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b74b10-80c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AWeGhOP6G5xgu4LJGZqZmKxdY9Evzcm%2FcnSYpRjnzRtSIgopyI0cfnRbKUWia2UYT3YXfDilfVdnmk%2FwIdns3oPCv6ap5pNLEnsOPohLpgXXPn78Pr4KF2ZYccGlW1jdnwTZVE2Id3NqBEypDMzWUlN6"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 863e7de01c9c19a0-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4d11f37fae309c522c4c45d9f75cb48f0651a09a9d278cddbd19a1a8e31aa9a3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc8abacb97d2e71cafbfdd4705d6f914e189d7825edff03d7a95acaca7f98ef1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aa2a82bbec6afb10324988b2003e61d47a09708b25ac0e2ce3b64950aa2b7a35

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
H3 200 6.d26a0f1e.png
nextmoovrecords.com/img/ 9 KB
9 KB 188ms
188ms Image
image/png 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextmoovrecords.com/img/6.d26a0f1e.png
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/css/app.9b8d7b51.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b106acf20bd4b5ff01ddb53be3c6f3173682ea42b893f31a1400e09de0be9e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://nextmoovrecords.com/css/app.9b8d7b51.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:44 GMT
cf-cache-status: MISS
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "65b74b10-2237"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dMweeeySIAf9r%2FJ7V3zBJkbc%2FTnFrM02lkp5sY0RAN7IQo2QDYTRQ6vWUQkKaT3HT4rKzTat1sOWOpSbehZ0g%2BI%2FkjohdYb2i14m4zyeVozUqUdK72%2FS%2BNEhMWJzV3d9jfn4IEoSWzoZ%2BXM5YFnfsEnk"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 863e7de01ca219a0-FRA
alt-svc: h3=":443"; ma=86400
content-length: 8759
expires: Fri, 12 Apr 2024 19:39:44 GMT

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e36eaeb05ac9e38a5e6ee0fea36ded8da7707532912f061ef6d445603fb5bfa9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
H3 200 mavenpro.5df981a4.woff
nextmoovrecords.com/fonts/ 12 KB
13 KB 224ms
224ms Font
font/woff 2606:4700:3030::ac43:c7fa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextmoovrecords.com/fonts/mavenpro.5df981a4.woff
Requested by: Host: nextmoovrecords.com
URL: https://nextmoovrecords.com/css/app.9b8d7b51.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:c7fa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc9e259669117b3e2c814392798e23871961db27b54ef88731aae886f5c4f58d

Request headers

Referer: https://nextmoovrecords.com/css/app.9b8d7b51.css
Origin: https://nextmoovrecords.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 13 Mar 2024 19:39:44 GMT
cf-cache-status: MISS
last-modified: Mon, 29 Jan 2024 06:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "65b74b10-3124"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ie1G0FgYNRktH2rpgTA7bCeNvfUBXph4kXzySx%2BHtsvzrIP6IUHSYMIsj3iZxKq7L8bi0yKuW2WXcGhdPXJyBfr32qIaqv7F%2FhhrG0ThAN9BiLaOs2pgT1SsVFEKSJzd2pkUNLHcNOFB06mVrPaycncx"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 863e7de01ca519a0-FRA
alt-svc: h3=":443"; ma=86400
content-length: 12580

POST
H2 200 send Show response
us.umami.is/api/ 541 B
641 B 392ms
391ms Fetch
text/plain 76.76.21.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://us.umami.is/api/send

Requested by

Host: us.umami.is
URL: https://us.umami.is/script.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

161eb8d7122191ca0c142172796fe8c213325e440fb563350f8ad36045e7747d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';img-src ;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self'
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://nextmoovrecords.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: application/json

Response headers

content-security-policy: default-src 'self';img-src *;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' *
date: Wed, 13 Mar 2024 19:39:44 GMT
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::sfo1::4nsx9-1710358784437-4eb980237dc9
x-matched-path: /api/send
etag: "11jxg1ckn0gf1"
x-vercel-cache: MISS
x-dns-prefetch-control: on
content-type: text/plain
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-length: 541

OPTIONS
H2 204 send
us.umami.is/api/ 0
0 191ms
175ms Preflight 76.76.21.241
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://us.umami.is/api/send

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.241 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';img-src ;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self'
Strict-Transport-Security	max-age=63072000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://nextmoovrecords.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: public, max-age=0, must-revalidate
content-length: 0
content-security-policy: default-src 'self';img-src *;script-src 'self' 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';connect-src 'self' api.umami.is cloud.umami.is;frame-ancestors 'self' *
date: Wed, 13 Mar 2024 19:39:44 GMT
server: Vercel
strict-transport-security: max-age=63072000
vary: Access-Control-Request-Headers
x-dns-prefetch-control: on
x-matched-path: /api/send
x-vercel-cache: MISS
x-vercel-id: fra1::sfo1::4nsx9-1710358784261-fd40ecf8ef48

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| umami object| webpackChunkvue_usps boolean| __VUE__

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nextmoovrecords.com
us.umami.is
2606:4700:3030::ac43:c7fa
76.76.21.241
05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668
0bb0b33257d0cc3a271566b5e39a81341439a95c8ee4315616b8f1fee52e4ec3
161eb8d7122191ca0c142172796fe8c213325e440fb563350f8ad36045e7747d
325b1265740262ced79043f657a9a7f2aca3b39a4eb43a790b7a639d0734386a
4d11f37fae309c522c4c45d9f75cb48f0651a09a9d278cddbd19a1a8e31aa9a3
6fc6fda94186ec00fc02e14c40ce06a83eeea8fe36c684f7fc346c488d52e407
9685d6241f41ac71741d0ee9b242779f640cd3b1e64bb9bbcfb8798c5be503b2
aa2a82bbec6afb10324988b2003e61d47a09708b25ac0e2ce3b64950aa2b7a35
b106acf20bd4b5ff01ddb53be3c6f3173682ea42b893f31a1400e09de0be9e49
bee8ee56c3e18aec4ef04b5e5a3dfd6fa6d0de71e9860ad0efeb1c7647092844
d548d32f1acad054d35791fb4494b2f14792ea11199a1d7ce8dd7e1b43ccfd11
e36eaeb05ac9e38a5e6ee0fea36ded8da7707532912f061ef6d445603fb5bfa9
fc8abacb97d2e71cafbfdd4705d6f914e189d7825edff03d7a95acaca7f98ef1
fc9e259669117b3e2c814392798e23871961db27b54ef88731aae886f5c4f58d

nextmoovrecords.com Open in urlscan Pro 2606:4700:3030::ac43:c7fa Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

172 kBTransfer

270 kBSize

0 Cookies

0 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

nextmoovrecords.com Open in urlscan Pro
2606:4700:3030::ac43:c7fa Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

172 kB
Transfer

270 kB
Size

0
Cookies

11 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!