qe70i4yaiz4riv9xxmo9rab.vercel.app
Open in
urlscan Pro
76.76.21.93
Malicious Activity!
Public Scan
Effective URL: https://qe70i4yaiz4riv9xxmo9rab.vercel.app/
Submission: On October 13 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R11 on August 14th 2024. Valid for: 3 months.
This is the only time qe70i4yaiz4riv9xxmo9rab.vercel.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 76.76.21.93 76.76.21.93 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
14 | 95.164.33.245 95.164.33.245 | 44477 (STARK-IND...) (STARK-INDUSTRIES) | |
18 | 5 |
ASN44477 (STARK-INDUSTRIES, GB)
PTR: vm2090149.stark-industries.solutions
zitromanx.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
zitromanx.top
zitromanx.top |
153 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 791 |
108 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 412 |
30 KB |
1 |
vercel.app
qe70i4yaiz4riv9xxmo9rab.vercel.app |
69 KB |
18 | 4 |
Domain | Requested by | |
---|---|---|
14 | zitromanx.top |
qe70i4yaiz4riv9xxmo9rab.vercel.app
zitromanx.top |
2 | code.jquery.com |
qe70i4yaiz4riv9xxmo9rab.vercel.app
|
1 | ajax.googleapis.com |
qe70i4yaiz4riv9xxmo9rab.vercel.app
|
1 | qe70i4yaiz4riv9xxmo9rab.vercel.app | |
18 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
go.cpanel.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.vercel.app R11 |
2024-08-14 - 2024-11-12 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-09-24 - 2024-12-17 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
*.zitromanx.top R10 |
2024-10-01 - 2024-12-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://qe70i4yaiz4riv9xxmo9rab.vercel.app/
Frame ID: 549767C8292E5B9F393E100E3196BA94
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
Webmail LoginPage URL History Show full URLs
-
http://qe70i4yaiz4riv9xxmo9rab.vercel.app/
HTTP 307
https://qe70i4yaiz4riv9xxmo9rab.vercel.app/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Moment.js (JavaScript Libraries) Expand
Detected patterns
- moment(?:\.min)?\.js
Select2 (JavaScript Libraries) Expand
Detected patterns
- select2(?:\.min|\.full)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: cPanel Blog
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://qe70i4yaiz4riv9xxmo9rab.vercel.app/
HTTP 307
https://qe70i4yaiz4riv9xxmo9rab.vercel.app/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
qe70i4yaiz4riv9xxmo9rab.vercel.app/ Redirect Chain
|
150 KB 69 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.js
code.jquery.com/ |
265 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styleme_v2_optimized.css
zitromanx.top/rcubby/ufiles/ |
141 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webmail-logo.svg
zitromanx.top/rcubby/ufiles/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.2.1.min.js
zitromanx.top/myjs/vendor/jquery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animsition.min.js
zitromanx.top/myjs/vendor/animsition/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
popper.js
zitromanx.top/myjs/vendor/bootstrap/js/ |
80 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
zitromanx.top/myjs/vendor/bootstrap/js/ |
50 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select2.min.js
zitromanx.top/myjs/vendor/select2/ |
65 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moment.min.js
zitromanx.top/myjs/vendor/daterangepicker/ |
46 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
daterangepicker.js
zitromanx.top/myjs/vendor/daterangepicker/ |
68 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
countdowntime.js
zitromanx.top/myjs/vendor/countdowntime/ |
1 KB 832 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
zitromanx.top/myjs/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
notice-error.png
zitromanx.top/rcubby/ufiles/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-username.png
zitromanx.top/rcubby/ufiles/ |
320 B 604 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-password.png
zitromanx.top/rcubby/ufiles/ |
450 B 735 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Popper function| moment function| daterangepicker function| _0x1f1362 function| _0x9f4ae0 function| _0x28b013 function| _0x56ab function| _0x1b7c function| _0x39c7c9 function| _0x18e3d5 object| filter function| search string| dot function| _0x3d6af9 function| _0x2be6ee function| _0x4b9296 function| _0x2cd4c7 function| _0x522bae function| _0xf252f8 function| _0x503c function| _0x23ff65 function| _0x30003d function| _0x3a04d9 function| _0x2474 function| _0x3d3d82 function| _0x3576e40 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
code.jquery.com
qe70i4yaiz4riv9xxmo9rab.vercel.app
zitromanx.top
2a00:1450:4001:828::200a
2a04:4e42::649
76.76.21.93
95.164.33.245
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
05ce0f813e6236158fa1d115faba62cd2041aab1878cac0960a0f45575cece1e
0e25895d7caaf355a53d19c37c69a06198f668e5422b211d27597ed93983b80b
2c3836208d9d0a3f9dab8ef05dda493c6e98c175155e7e7abba3575207ad0244
4cff184248850f8767575963eb504ee95bbfabff946cdbfb4271474442b80ecd
4e411c99fe4a486db34e801a53392ae86f8659eccc438944b5a062c9aaba25be
70667a94ef79118b93b13b1cb41fcb11b09e8fd3ce0c9c82680ed5f991ba9a32
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
998cd48cdc0414f694d0a3a299dd2beb1134769d5666c7e5567e7d20b4174ef8
a02998df88a6efb0baa526796b2b682ce9fdd6471ceb19170b326320f22f7053
a93f37c5c32d030a1d831b5023b6b29bc93290f5423debaf47c83b6444528059
b567c08098f2fe628374d2d4f5411b2b666b8645c00479a8e34c6c8cf84deb7a
bcaf01928e5c7246ab0bb7e83f609b485a67a5e442d3dd94539a883c11fb70cd
c6621f4a76072047e9bf910378852421cb5c5bacfecd2abd1ba2a49f8f658f0f
d418f1a383157e6d013cc08376bfad645f6b8a5a7e4310798ec0a5c8b389eccb
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
f32da6bf81134c664b32582076b8260b3b614d508d5c651d0907b581df2a9323
fa659dfc6ebd4b8aad80fa304842c879502fefe16e2fcef55976a89605e7af04