flying-petunia-drake-co.koyeb.app
Open in
urlscan Pro
2606:4700:10::6816:4ebe
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On April 12 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by E1 on March 22nd 2024. Valid for: 3 months.
This is the only time flying-petunia-drake-co.koyeb.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Discord (Instant Messenger)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2606:4700:10:... 2606:4700:10::6816:4ebe | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 104.18.125.91 104.18.125.91 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 172.67.24.44 172.67.24.44 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 4 |
ASN13335 (CLOUDFLARENET, US)
flying-petunia-drake-co.koyeb.app |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
koyeb.app
flying-petunia-drake-co.koyeb.app |
677 KB |
5 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 5499 newassets.hcaptcha.com — Cisco Umbrella Rank: 7707 |
111 KB |
0 |
captcha.bot
Failed
captcha.bot Failed |
|
16 | 3 |
Domain | Requested by | |
---|---|---|
10 | flying-petunia-drake-co.koyeb.app |
flying-petunia-drake-co.koyeb.app
|
4 | newassets.hcaptcha.com |
hcaptcha.com
|
1 | hcaptcha.com |
flying-petunia-drake-co.koyeb.app
|
0 | captcha.bot Failed | |
16 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.koyeb.app E1 |
2024-03-22 - 2024-06-20 |
3 months | crt.sh |
hcaptcha.com E1 |
2024-03-15 - 2024-06-13 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://flying-petunia-drake-co.koyeb.app/login/?from=90TUmlWSE5ENBpWT5FEVOVTQE9UNBpmT4NmaNlXRqlkNJNkWKJ1RiBnVzoVa3lWS4VFVNRTTq5UeRRVT0UFROl3YU5keVRVT4lUaPlWUXNFM1clWwhnMZl2dplUZD50bRx0Swk1Qk5WUEN0aRZ2SwE1QOxWUmpEMRNkTvFld3cmau9mamNkdJZTSTpFdG1mYpdXaNVTUq9UaN52Ysp0VixWMtl0cJlmWwRWbMtmSU9EMRRVTwEEVNpmRUpVbopXT4dGVNVTWH5EbSRUToZVbZpXUqpVaKJDWolTaNBzZE1UeJRUTxsGRNRzaE1kMFpnT5lEVNZXTuJmdOdVY2BjMipWNDN2dGdkW5ljMZpHbHpVd0ckWqlTeMZTTINGMShUYp9maJVXOykFcKlXZ
Frame ID: F9B6FD5811BE69C2D476AAA881374D86
Requests: 14 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html
Frame ID: 3D9DD6A6E87A15F6053F11C5F26E77F3
Requests: 1 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/b1c589a/static/hcaptcha.html
Frame ID: C2319179A697F70EBBDCC3DA5D112826
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 14- https://flying-petunia-drake-co.koyeb.app/static/assets/images/favicon.ico HTTP 302
- https://captcha.bot/
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
flying-petunia-drake-co.koyeb.app/login/ |
178 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.45d4d70d2e41bc34b882.css
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
2 MB 395 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shared.f01e9143e31c19a68a8e.css
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
515 KB 86 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
hcaptcha.com/1/ |
378 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
adf75861421c2a6a6269.png
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
863db41a48a43395cd55.svg
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
flying-petunia-drake-co.koyeb.app/login/static/js/ |
30 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
b9811218b3a54ad59fb2.woff2
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
37 KB 38 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
20ac37ed2576dd48d7dc.woff2
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3f46bbecb4287c0a829f.woff2
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f84e3e81b8d0718cd917.woff2
flying-petunia-drake-co.koyeb.app/login/static/assets/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/b1c589a/static/ Frame 3D9D |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/b1c589a/static/ Frame C231 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fi.json
newassets.hcaptcha.com/captcha/v1/b1c589a/static/i18n/ |
9 KB 4 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fi.json
newassets.hcaptcha.com/captcha/v1/b1c589a/static/i18n/ |
9 KB 0 |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
captcha.bot/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- captcha.bot
- URL
- https://captcha.bot/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Discord (Instant Messenger)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| Raven object| hcaptcha string| ref undefined| a2fTicket function| login function| a2fSubmit function| onSuccess function| reset function| openA2f function| closeA2f function| startLoading function| stopLoading function| openModal function| closeModal object| grecaptcha1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
api2.hcaptcha.com/ | Name: __cflb Value: 0H28vk2VKwPbLoawFj9mU2fhedYxxWRCscmXUPW9qtq |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
captcha.bot
flying-petunia-drake-co.koyeb.app
hcaptcha.com
newassets.hcaptcha.com
captcha.bot
104.18.125.91
172.67.24.44
2606:4700:10::6816:4ebe
01908359050da30c842f89d13af0447be961b00b67b46eb61114d1fa48f1bdc9
0e249fc62186726d8018b924977b3619c8abb17b3c20bbf20a24c1dda6c8299c
13da02ce62b1a388a7c8d6f3bd286fe774ee2b91ac63d281523e80b2a8a063bc
32e03ff133065d188f5fa71ba092b294e63331ce46fd5298beb5b04716983d60
3f4c9afac040e2b0a6d41ec0cc3853b8ea3dc25ab449883f0ea803fb3792a7d2
440ad8b1449985479bc37265e9912bbf2bf56fe9ffd14709358a8e9c2d5f8e5b
8e401b056dc1eb48d44a01407ceb54372bbc44797d3259069ce96a96dfd8c104
ae99aaede2f373187a4fe442a2cb0ab9c2945efbab01cf33e01be517c0c4f813
b5845ac9cbc719a62f5cdcfb01b599d15e940d3b2c637867197445d5f400fdf4
c427341da80b0cb6c5ab8239e137769b3173e1b13c227315c7d6e9d130aecc41
c66e294cd9e33abcacfa53a5413cecc206018c9c252578a0cc33220cd7332766
f1ca5949ef43d0a6130a1176794b4b38b393f2638c6cc5c2b8449adb6ed3f144