accountid7278info.org
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Effective URL: https://accountid7278info.org/fatt94552ar/login.php
Submission: On August 13 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by WE1 on August 1st 2024. Valid for: 3 months.
This is the only time accountid7278info.org was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2804:10:8001:... 2804:10:8001::209:5 | 28299 (Cyberweb ...) (Cyberweb Networks Ltda) | |
1 10 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.18.95.41 104.18.95.41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
15 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
accountid7278info.org
1 redirects
accountid7278info.org |
84 KB |
2 |
cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3877 |
15 KB |
2 |
alianca-rs.com.br
alianca-rs.com.br |
10 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
10 | accountid7278info.org |
1 redirects
accountid7278info.org
|
2 | challenges.cloudflare.com |
accountid7278info.org
challenges.cloudflare.com |
2 | alianca-rs.com.br | |
15 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
alianca-rs.com.br R10 |
2024-08-08 - 2024-11-06 |
3 months | crt.sh |
accountid7278info.org WE1 |
2024-08-01 - 2024-10-30 |
3 months | crt.sh |
challenges.cloudflare.com E5 |
2024-07-17 - 2024-10-15 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://accountid7278info.org/fatt94552ar/login.php
Frame ID: 736C82853293F779E3755EC6178A5C5A
Requests: 14 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/lmzct/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
Frame ID: 35B7825A9B9DEEB49A465B2DC73732DD
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Nur einen Moment…Page URL History Show full URLs
- https://alianca-rs.com.br/ar/allowed.html Page URL
- https://accountid7278info.org/fatt94552ar/login.php Page URL
-
https://accountid7278info.org/cdn-cgi/phish-bypass?atok=ki0F2WGlnR4kvFZ2nrCMxa3suR1pDpBfO6sWLrCEeWI-172354...
HTTP 301
https://accountid7278info.org/fatt94552ar/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://alianca-rs.com.br/ar/allowed.html Page URL
- https://accountid7278info.org/fatt94552ar/login.php Page URL
-
https://accountid7278info.org/cdn-cgi/phish-bypass?atok=ki0F2WGlnR4kvFZ2nrCMxa3suR1pDpBfO6sWLrCEeWI-1723544803-0.0.1.1-%2Ffatt94552ar%2Flogin.php
HTTP 301
https://accountid7278info.org/fatt94552ar/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
allowed.html
alianca-rs.com.br/ar/ |
190 B 323 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
login.php
accountid7278info.org/fatt94552ar/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
alianca-rs.com.br/ |
42 KB 9 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
accountid7278info.org/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
accountid7278info.org/cdn-cgi/images/ |
452 B 635 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
accountid7278info.org/ |
15 KB 8 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
login.php
accountid7278info.org/fatt94552ar/ Redirect Chain
|
15 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
accountid7278info.org/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ |
90 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
challenges.cloudflare.com/turnstile/v0/b/cc21665cd7b9/ |
44 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
accountid7278info.org/ |
5 KB 5 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
053459d4-42d1-4b75-b249-8845691e8844
https://accountid7278info.org/ |
13 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
0fea2eaaa02734e
accountid7278info.org/cdn-cgi/challenge-platform/h/b/flow/ov1/1122430887:1723543752:SvP4PSPAuT2tEVeHDGpxS9jGL9NRXoG5yPBoJa1TjXs/8b28024cad2a9055/ |
16 KB 13 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
a3ab9b07-8b3f-49a2-9a80-c54b1c08a2c0
https://accountid7278info.org/ |
80 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/lmzct/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ Frame 35B7 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
accountid7278info.org/ |
15 KB 8 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _cf_chl_opt function| UbXdg5 function| afnU4 function| SRrOZ4 function| hHKd1 function| ZcOq0 object| Lxsf8 object| NCxme2 function| CXYl7 boolean| LplnK7 function| IPJP7 object| UldE7 number| ZQHE7 object| angular string| EKUyv0 object| turnstile boolean| YEMy0 boolean| mgdMS72 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
alianca-rs.com.br/ | Name: PHPSESSID Value: 7e5ba85631005d4a5725949db6a3ba4c |
|
.accountid7278info.org/ | Name: __cf_mw_byp Value: ki0F2WGlnR4kvFZ2nrCMxa3suR1pDpBfO6sWLrCEeWI-1723544803-0.0.1.1-/fatt94552ar/login.php |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accountid7278info.org
alianca-rs.com.br
challenges.cloudflare.com
104.18.95.41
188.114.96.3
2804:10:8001::209:5
09969ff98103700563d510b68eb73e8fc668f2d4005b58cd5f06dcb21817e140
2d6cc4701120ab0bd98e4027f1cfb5de8359fce50e458dc577de4848e7e7ab07
3641ab09893585add9e40d0384c032d8c6fe5b2eb71727953e5269786bd6729e
4e71c2efe9416cd8fa26602a3dcdf6d56bcdb8f462a5d46a4c2ff616208ebfab
518f98bdc64777c24faaaeaab1bc5cb15c3615f87f61f71ca77040884a08435b
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
95aabf6a921c6fc1948aa5731f9216e292823d554611fb0c4fa49eac3a364ffe
c7436b868c56174f6e851e2e2e0163a049ee57f221d0d73ed4c1159c623b328f
d4c091c7b3573840001deab9efb0505729e0a8d53a9af35770b5443b7919b653
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f3418640c1204265881221580b9d1554424f6ed49549d408da50c690ab29f400
f4a2eb2ac4f712bbfd4c194b8d988ea17ad9ea87609ec60ea76616a8d9bcd9b9