collab.ac
Open in
urlscan Pro
2606:4700:3035::6815:5080
Malicious Activity!
Public Scan
Submission Tags: https://sinking.yachts sinking-yachts phishing Search All
Submission: On June 26 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on June 3rd 2023. Valid for: 3 months.
This is the only time collab.ac was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2606:4700:303... 2606:4700:3035::6815:5080 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 198.251.82.65 198.251.82.65 | 53667 (PONYNET) (PONYNET) | |
| 2 | 2 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 1 |
lain.la
pomf2.lain.la — Cisco Umbrella Rank: 385675 |
155 KB |
| 1 |
collab.ac
collab.ac |
526 B |
| 2 | 2 |
| Domain | Requested by | |
|---|---|---|
| 1 | pomf2.lain.la |
collab.ac
|
| 1 | collab.ac | |
| 2 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| collab.ac GTS CA 1P5 |
2023-06-03 - 2023-09-01 |
3 months | crt.sh |
| *.lain.la R3 |
2023-04-30 - 2023-07-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://collab.ac/
Frame ID: D684837DF8CD7367F7C6FD5DD9A9CA43
Requests: 2 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
collab.ac/ |
82 B 526 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jdtol6p.jpeg
pomf2.lain.la/f/ |
155 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Malicious
task.url
Submitted on
June 26th 2023, 12:39:39 pm
UTC —
From United States
Threats:
Phishing
Scam
Comment: This domain is present in the Sinking Yachts anti-phishing list. More Info: https://sinking.yachts
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
collab.ac
pomf2.lain.la
198.251.82.65
2606:4700:3035::6815:5080
3856ba06a269453337a237c8125a63bb77370fb19f32c7c96f1e60bba5f20677
5ad140c5bcfb4a7a14767dfc0f6126b0fbc12ab077235f2265b355cac25cb1ad