basic-bundle-dawn-snow-139f.vannary03.workers.dev
Open in
urlscan Pro
172.67.206.37
Malicious Activity!
Public Scan
Submission: On August 15 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on August 14th 2023. Valid for: 3 months.
This is the only time basic-bundle-dawn-snow-139f.vannary03.workers.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.67.206.37 172.67.206.37 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 172.217.31.138 172.217.31.138 | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.65.229 151.101.65.229 | 54113 (FASTLY) (FASTLY) | |
6 | 5 |
ASN13335 (CLOUDFLARENET, US)
basic-bundle-dawn-snow-139f.vannary03.workers.dev |
ASN15169 (GOOGLE, US)
PTR: nrt20s08-in-f10.1e100.net
ajax.googleapis.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 392 |
93 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 356 |
3 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 245 |
27 KB |
1 |
workers.dev
basic-bundle-dawn-snow-139f.vannary03.workers.dev |
434 KB |
6 | 4 |
Domain | Requested by | |
---|---|---|
3 | ajax.googleapis.com |
basic-bundle-dawn-snow-139f.vannary03.workers.dev
|
1 | cdn.jsdelivr.net |
basic-bundle-dawn-snow-139f.vannary03.workers.dev
|
1 | cdnjs.cloudflare.com |
basic-bundle-dawn-snow-139f.vannary03.workers.dev
|
1 | basic-bundle-dawn-snow-139f.vannary03.workers.dev | |
6 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
vannary03.workers.dev GTS CA 1P5 |
2023-08-14 - 2023-11-12 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-17 - 2023-10-09 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://basic-bundle-dawn-snow-139f.vannary03.workers.dev/
Frame ID: 75CEFD3921C5FDD4B69A67D87E63E507
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Sign in to your accountDetected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
basic-bundle-dawn-snow-139f.vannary03.workers.dev/ |
2 MB 434 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/ |
84 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle.dev.js
cdn.jsdelivr.net/gh/joeymalvinni/webrtc-ip/dist/ |
11 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ |
90 KB 32 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
556 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
277 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| usertelegram string| tokenTelegram function| $ function| jQuery function| is_ipv4 function| is_ipv6 object| simpleIPRegex function| peer function| publicIPs function| getIPTypes function| getIPv4 function| getIPv6 function| getIPs function| getParameterByName function| ValidateEmail function| myFunction function| myFunction00 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
basic-bundle-dawn-snow-139f.vannary03.workers.dev
cdn.jsdelivr.net
cdnjs.cloudflare.com
104.17.24.14
151.101.65.229
172.217.31.138
172.67.206.37
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
47086ff7ee142551231d14b8fe48a3879d459feec01740752c640755c9ec22e4
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a88ff7775aba63e1c81248d0fe9c63133befd29d86002856f04a59bd2e4957df
a8de8263d0bd284cfb11d29fcb41a85e7a49531dd284db16cb7c43e225d75077
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
ddcd87dc87e16b8e464f5f429917470edb1764ccfbf75ab0767143aced474318
e532094e51493a4b86e1893bcebfd2b9527383d79b6bc413a1b7c85959dc3390
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea