z455635782022.playcode.io Open in urlscan Pro
2a06:98c1:3121::3  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response z455635782022.playcode.io/	92 KB 26 KB	456ms 397ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://z455635782022.playcode.io/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a8794561028b59cd8fd5ee6b8763bea8f7131a1fb538742d5c3f512633717a2 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 72ecc6cfed569225-FRA content-encoding br content-type text/html; charset=utf-8 date Fri, 22 Jul 2022 14:13:22 GMT expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mDXltanBbjwdmiu2yJZR6KGZbALgols1%2BOgUC6xIyECSCdGPusElTCW%2B1srcbO94%2BuWVzOIB9plxVpOzKwnsbonv%2FOx8Skt4srbTt8iAiGjwwMoR5Z7GpjYerFRyN9H%2B%2BkOqXR%2BpP8Bn%2Fw7awe%2F5D5zNQncL67kK"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=15552000; includeSubDomains vary Accept-Encoding x-content-type-options nosniff x-dns-prefetch-control off x-download-options noopen x-xss-protection 1; mode=block
GET H2	200	adobe-pdf-icon-logo-png-transparent.png www.biochek.com/wp-content/uploads/2018/07/	329 KB 331 KB	57ms 16ms	Image image/png	2a01:7c8:aac4:2e8::2 TRANSIP-AS Amsterdam
General Check archive.org Show headers Download Go to Show image Full URL https://www.biochek.com/wp-content/uploads/2018/07/adobe-pdf-icon-logo-png-transparent.png Requested by Host: z455635782022.playcode.io URL: https://z455635782022.playcode.io/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a01:7c8:aac4:2e8::2 , Netherlands, ASN20857 (TRANSIP-AS Amsterdam, the Netherlands, NL), Reverse DNS Software Apache/2 / W3 Total Cache/2.2.1 Resource Hash 35d6b5ff288bb35acdf34369164428e02a6898c7f662da4fc86d9208f6edd0e8 Request headers accept-language nl-NL,nl;q=0.9 Referer https://z455635782022.playcode.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers pragma public date Fri, 22 Jul 2022 14:13:22 GMT referrer-policy last-modified Fri, 06 Jul 2018 13:03:23 GMT server Apache/2 x-powered-by W3 Total Cache/2.2.1 content-type image/png cache-control max-age=31536000, public accept-ranges bytes content-length 336595 etag "522d3-5705449e8532f" expires Sat, 22 Jul 2023 14:13:22 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| __bfs__ object| global object| process object| path object| fs object| events object| os object| buffer function| Buffer function| require object| module

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.biochek.com
z455635782022.playcode.io
2a01:7c8:aac4:2e8::2
2a06:98c1:3121::3
2a8794561028b59cd8fd5ee6b8763bea8f7131a1fb538742d5c3f512633717a2
35d6b5ff288bb35acdf34369164428e02a6898c7f662da4fc86d9208f6edd0e8