URL: https://paste.nocf.microblock.cc/
Submission Tags: phishingrod
Submission: On June 03 via api from DE — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 206.237.24.252, located in Hong Kong and belongs to CLOUDIE-AS-AP Cloudie Limited, HK. The main domain is paste.nocf.microblock.cc.
TLS certificate: Issued by R3 on June 2nd 2024. Valid for: 3 months.
This is the only time paste.nocf.microblock.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 206.237.24.252 55933 (CLOUDIE-A...)
5 2
Apex Domain
Subdomains
Transfer
2 microblock.cc
paste.nocf.microblock.cc
19 KB
5 1
Domain Requested by
2 paste.nocf.microblock.cc paste.nocf.microblock.cc
5 1

This site contains links to these domains. Also see Links.

Domain
microbin.eu
Subject Issuer Validity Valid
paste.nocf.microblock.cc
R3
2024-06-02 -
2024-08-31
3 months crt.sh

This page contains 1 frames:

Primary Page: https://paste.nocf.microblock.cc/
Frame ID: 23E0CE8928AE96F92695B31973DCECE0
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

MicroBin

Page Statistics

5
Requests

40 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

19 kB
Transfer

19 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
paste.nocf.microblock.cc/
15 KB
16 KB
Document
General
Full URL
https://paste.nocf.microblock.cc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
206.237.24.252 , Hong Kong, ASN55933 (CLOUDIE-AS-AP Cloudie Limited, HK),
Reverse DNS
Software
Caddy /
Resource Hash
19a6b1cba5665ce3006a6a8a452e0ad6aa3250f90e68e2b430078d061f5a4e67

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000
content-length
15830
content-type
text/html
date
Mon, 03 Jun 2024 01:35:20 GMT
server
Caddy
logo.png
paste.nocf.microblock.cc/static/
4 KB
4 KB
Image
General
Full URL
https://paste.nocf.microblock.cc/static/logo.png
Requested by
Host: paste.nocf.microblock.cc
URL: https://paste.nocf.microblock.cc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
206.237.24.252 , Hong Kong, ASN55933 (CLOUDIE-AS-AP Cloudie Limited, HK),
Reverse DNS
Software
Caddy /
Resource Hash
0896aa13fe98346e6656a0ee953449be79e31668e9f2e72a55dbad018318aafc

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://paste.nocf.microblock.cc/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 03 Jun 2024 01:35:21 GMT
server
Caddy
alt-svc
h3=":443"; ma=2592000
content-length
3591
content-type
image/png
aes.js
paste.nocf.microblock.cc/static/
0
0

water.css
paste.nocf.microblock.cc/static/
0
0

favicon.ico
paste.nocf.microblock.cc/static/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
paste.nocf.microblock.cc
URL
http://paste.nocf.microblock.cc/static/aes.js
Domain
paste.nocf.microblock.cc
URL
http://paste.nocf.microblock.cc/static/water.css
Domain
paste.nocf.microblock.cc
URL
http://paste.nocf.microblock.cc/static/favicon.ico

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| encryptWithPassword function| encryptFileWithPassword function| fileOversized function| encryptFile

0 Cookies

6 Console Messages

Source Level URL
Text
security warning URL: https://paste.nocf.microblock.cc/
Message:
Mixed Content: The page at 'https://paste.nocf.microblock.cc/' was loaded over HTTPS, but requested an insecure element 'http://paste.nocf.microblock.cc/static/logo.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://paste.nocf.microblock.cc/
Message:
Mixed Content: The page at 'https://paste.nocf.microblock.cc/' was loaded over HTTPS, but requested an insecure script 'http://paste.nocf.microblock.cc/static/aes.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://paste.nocf.microblock.cc/(Line 13)
Message:
Mixed Content: The page at 'https://paste.nocf.microblock.cc/' was loaded over HTTPS, but requested an insecure stylesheet 'http://paste.nocf.microblock.cc/static/water.css'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://paste.nocf.microblock.cc/(Line 45)
Message:
Mixed Content: The page at 'https://paste.nocf.microblock.cc/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://paste.nocf.microblock.cc/upload'. This endpoint should be made available over a secure connection.
security warning URL: https://paste.nocf.microblock.cc/(Line 110)
Message:
Mixed Content: The page at 'https://paste.nocf.microblock.cc/' was loaded over HTTPS, but requested an insecure element 'http://paste.nocf.microblock.cc/static/logo.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://paste.nocf.microblock.cc/
Message:
Mixed Content: The page at 'https://paste.nocf.microblock.cc/' was loaded over HTTPS, but requested an insecure favicon 'http://paste.nocf.microblock.cc/static/favicon.ico'. This request has been blocked; the content must be served over HTTPS.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paste.nocf.microblock.cc
paste.nocf.microblock.cc
206.237.24.252
0896aa13fe98346e6656a0ee953449be79e31668e9f2e72a55dbad018318aafc
19a6b1cba5665ce3006a6a8a452e0ad6aa3250f90e68e2b430078d061f5a4e67