urlscan.io logo urlscan.io
SecurityTrails logo

usbc.mkrycq.top Open in urlscan Pro
172.67.157.237  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://usbc.mkrycq.top/
Effective URL: https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Submission Tags: falconsandbox
Submission: On June 30 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 172.67.157.237, located in United States and belongs to CLOUDFLARENET, US. The main domain is usbc.mkrycq.top.
TLS certificate: Issued by E1 on May 20th 2024. Valid for: 3 months.
This is the only time usbc.mkrycq.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: USPS (Transportation)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
4 172.67.157.237 13335 (CLOUDFLAR...)
1 2a04:4e42:600... 54113 (FASTLY)
6 3
Apex Domain
Subdomains		 Transfer
5 mkrycq.top
usbc.mkrycq.top
14 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 816
30 KB
6 2
Domain Requested by
5 usbc.mkrycq.top 1 redirects usbc.mkrycq.top
code.jquery.com
1 code.jquery.com usbc.mkrycq.top
6 2

This site contains no links.

Subject Issuer Validity Valid
mkrycq.top
E1		 2024-05-20 -
2024-08-18		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Frame ID: F1F0F1155A3C80F9BCA1A8C171EE0764
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Loading...

Page URL History Show full URLs

  1. http://usbc.mkrycq.top/ HTTP 307
    https://usbc.mkrycq.top/ HTTP 302
    https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJ... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

43 kB
Transfer

130 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://usbc.mkrycq.top/ HTTP 307
    https://usbc.mkrycq.top/ HTTP 302
    https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request J7AAvo
usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/
Redirect Chain
  • http://usbc.mkrycq.top/
  • https://usbc.mkrycq.top/
  • https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.157.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
871351a06d76182e9fb945859ecf659e1198f999257fcc8c3f0dcc19e507b9d4

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private
cf-cache-status
DYNAMIC
cf-ray
89c1998fff565b86-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Sun, 30 Jun 2024 22:30:16 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3jTtBEFtt%2FMboWKIof00c6CVpmLf3nesKp9PhP%2Fsc%2BsaBrIlFJ0nvWET9PaEkK16zPM7eaTJHCkPY2DJNzWhglVDHyOod0Qyh8JB1o8mk%2FPdoGL%2FadPEypbpyU0Ga35KD%2Bk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-aspnet-version
4.0.30319
x-aspnetmvc-version
5.2
x-powered-by
ASP.NET

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
private
cf-cache-status
DYNAMIC
cf-ray
89c1998bfdcb1e0c-FRA
content-type
text/html; charset=utf-8
date
Sun, 30 Jun 2024 22:30:16 GMT
location
/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YNMNbLt9jnzctIBleDVw%2FhNcY0Na4soJiimG9ye7LOqhkkiOjTbw0HGLxpMnRzEjnJkAwbPikvAE7MGgkp4OhPMSoLU8RE%2BXlfeuewFOhvrwrk5OV4VSmXS52QHAJwKwN7YN86mgmpMaTgUXLyU%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-aspnet-version
4.0.30319
x-aspnetmvc-version
5.2
x-powered-by
ASP.NET
jquery-3.0.0.min.js
code.jquery.com/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.0.0.min.js
Requested by
Host: usbc.mkrycq.top
URL: https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://usbc.mkrycq.top/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 30 Jun 2024 22:30:16 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
7318747
x-cache
HIT, HIT
content-length
29995
x-served-by
cache-lga13625-LGA, cache-fra-etou8220103-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1719786617.960348,VS0,VE0
etag
W/"28feccc0-15145"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
1, 6166
vXpAANa
usbc.mkrycq.top/f1cda9/EAIAS_C/E4BAbTF0A72e/ 		11 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://usbc.mkrycq.top/f1cda9/EAIAS_C/E4BAbTF0A72e/vXpAANa?SaKAblKZE8lsgrFpA/aLAAAqb7RdrEA?GtMP6D8G6HA_SAI6AN.js
Requested by
Host: usbc.mkrycq.top
URL: https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.157.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
8682f242cccea53e81207632552705b8f6c44da88b145091568303d086d41690

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 30 Jun 2024 22:30:17 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=51dDkzFWCZnL6wh8kyqft5NUahnhyXuxpXNRaVC%2Fr0Gf3ETM1qItemOrTvevKGb7orelBnR5QCSlI7wTWTmKxOmXODNGKO8psxP%2F5KDiPKUL1Te%2B1ccOhL7wgrNXsv6KXBA%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cf-ray
89c19993a9aa5b86-FRA
alt-svc
h3=":443"; ma=86400
content-length
5247
AAmx8pEutAUAIZ
usbc.mkrycq.top/f1cda9/qAcr60/zid_AA06zYmA/jVslHy4AJWplMjzaoAKF4-/ 		16 B
597 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://usbc.mkrycq.top/f1cda9/qAcr60/zid_AA06zYmA/jVslHy4AJWplMjzaoAKF4-/AAmx8pEutAUAIZ?AaAmM0AtYyAFmqMCk
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.0.0.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.157.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Referer
https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
X-Requested-With
XMLHttpRequest
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 30 Jun 2024 22:30:20 GMT
content-encoding
gzip
x-aspnetmvc-version
5.2
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-aspnet-version
4.0.30319
server
cloudflare
x-powered-by
ASP.NET
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yFUiKPhxgW17r9KcoO%2F3BKvSgFt0I%2BolFLwhWYgLw1kY3%2F%2FSj5Cq%2F%2Fm%2FxzSuabOOYRFOqRYOJuqgeutOFMckIfgtwEOGKYEYSnZxptHjRqjKQwiF7hGhsEYN94IApI%2FtSFE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
cache-control
private
cf-ray
89c199a83d875b86-FRA
alt-svc
h3=":443"; ma=86400
content-length
36
ju
usbc.mkrycq.top/f1cda9/SAsQWI/yEAPUO/ 		31 KB
6 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://usbc.mkrycq.top/f1cda9/SAsQWI/yEAPUO/ju?x8r?Nn-AA2wA/AxAAAAAAAHAtz_3FOVI96A04E.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.157.237 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
67fbe8ef9020e5c776aadf6801a1fef8dc563e2e4dc9ddc740af8010c0c38943

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://usbc.mkrycq.top/f1cda9/6AIAN__E/4IAzbNxAMzHs/J7AAvo?cYbAjyn69pgsgdpoA/ucAAAEZKDbdEA?X56w5aYJcHA_uAIEAN
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 30 Jun 2024 22:30:20 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 30 Nov 2023 12:13:25 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"8d495b9e8623da1:0"
x-powered-by
ASP.NET
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k1grqWYiIxPjRNRnBj%2Bx4Ugd7hMp6NrvjortOhh4ROuBJG2T0em0M%2BBWt3r0VedlmZqoRp1uG7NCGblv4kkHbVgB4m0xzIorDb0uQ5wJ5npP6HyCqcPRYoM5gALCip2mlTA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/x-icon
cf-ray
89c199a84d935b86-FRA
alt-svc
h3=":443"; ma=86400
1j
usbc.mkrycq.top/f1cda9/uAsA3I/KEDpF8/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
usbc.mkrycq.top
URL
https://usbc.mkrycq.top/f1cda9/uAsA3I/KEDpF8/1j?J-w?Do-AAdWAA/_AAAAAAAHAOym56eioikAr4E

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: USPS (Transportation)

165 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage string| url string| url2 string| url3 function| $ function| jQuery string| qMKzRAI string| vtdfja string| whYLOstNnApAGq number| HLyiQiJVHYDUjW string| QFTAvcIGviL string| KiFmLAVZfDkc string| uAESIb number| hHvRclcTM string| oJaQMLUUnz string| qIlQyRW number| uvbTpi string| KpgYkBiJytdn string| mTZTHC string| LzMJseRExwPK number| IrzFOBVnAAywdk number| kayLKzgF number| booQUEKlK number| gVHwmeeq number| MOZeFss string| siXcMi number| vKjDPEXXjkzldt string| VHWjCerfzp string| nEeUaADcSIvfpf number| vMdoASLWs number| lwyqfDkM number| fTGhoiHRR string| xbumNJEntN number| RqZuHWidg string| vqXboK number| qdRWxeE string| wIYzugmQmDrYO number| NKSvgJcOv number| GStdaExymeMho number| lwfqiFJMNH string| fcwxsWbJR string| uYEWhHI number| gbpKWW number| qksJWf number| JpTYMFrBJ string| xNQlxQ number| ePxOVJOvFVI string| FZUPzEKiFUFs string| DutPfOEQfBpf string| gYyiUXAeY string| MQnfKUQpggO number| SjVWHoxxs number| MGboFvAZiOT number| ILKKZsdq number| aRxnhDQDPk number| EEqWmeqe number| XRoCZORD number| iRAphKDVLJQi string| zgQzkvf number| nGQJCoKkRqZGgT string| jOyAydgbAlq string| htausGEmRunml number| MFAETMKAI number| ehSzTjfYelkP number| NCDqqOeshv number| NNvBmfmILDV string| wbLfjFJngMW number| yJugQgcg number| GdUSBeIULILfK number| CGBPeu number| PySgdGZOa number| BJdLBfcsre string| xLOfQUPbeDvnmX string| vDRWtmp number| QyGSeFW number| plnRpiew string| MyNuGJwSEVZfX string| uhUdyZacV string| gauqgqCSWe number| AQExagpcK number| YKWZtKlnKDCRSw string| yrnWwuWgmAKetE number| oguKWn number| QEhEDGi function| detectDevice string| EGnawIbD string| APTCrJdYZhu number| eJAuJjIvbFHc number| AYZpMHGb string| saYLsMs number| ZbyRCmQbHmjfy string| AQHwqnUJh number| OUYngJ number| uqDlzJgauwYP number| ROGQsYM number| uYUylVwzvNjS string| zGmfDvPEGfm string| XiTqLL string| bxOSUTlkIO string| AavLABvycJXgod number| jehrcw number| aXisoaPGtO number| WfkfkxobJDYOc string| HVwKtqqYxaw string| gzOtyr string| drgwSoYY string| aztynSPDzmHumI number| ypkMQxCBJOBR number| SDdKyMNmFRPVe string| HbQVjd string| iYydkOr string| tMawOj number| qrxdjJbcWlPf string| xNajNokLUjmCr number| eJCEbgfYjjptl number| TpUfVAc string| LOwgjW number| WjfADTJrstVDGI number| hfZPJP number| OPobmQSSUKjJVN number| iYbdGDkKYgcgM string| qMGXejd string| xUBWmpxvnZfN number| lzzLtlrDYnH string| BobSVLkkm number| ikZiVoq string| naIzIJEHhpVJf string| RdEZyl string| gRgfbLXxNWEg number| yaKwJMKmrZkqD number| xfEiJGrwI number| brplilQbVuuNn number| qgRsLLKIjF number| dMnXRhoSDE string| uBxWusvRP number| zMfLRxYhKsI string| GVuynlDp number| WKWFQLxWKcrkhQ string| dTOBSuoTiRWLuF number| LSPLVyF number| QkfLXmqASAhRcj number| OPAKpe string| gYHSALkhgMyq string| YgbTzNWYaxPagg number| RQAnpnT number| iiZAQGmwlh string| dugSgVePGth number| YpxRWU string| rhoDmXr number| ZSTDrO number| efJajblVwcZ number| tjIYJvXwU number| QdoqjANySGk string| GcBWWgWB number| IYlflV string| QOcfxSK string| gKrmiIB number| cOjZaPEHI string| LtuTdYBDEV string| YNNlOvKKvbeB number| nddxOvgdlx string| zceOWnpHZKxBl string| SmWrVWDoDzUiq

3 Cookies

Domain/Path Name / Value
usbc.mkrycq.top/ Name: ASP.NET_SessionId
Value: ouqixki2k2oxgdw0ruxf1a4m
usbc.mkrycq.top/ Name: RdStr
Value: ouqixki2k2oxgdw0ruxf1a4m
usbc.mkrycq.top/ Name: HasCheckClientInfoCookie
Value: 1a5dd7e0f7fbc70b516dc4e840e24a43