plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com Open in urlscan Pro
149.137.129.254  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	Primary Request index.html Show response plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/	79 KB 79 KB	256ms 72ms	Document text/html	149.137.129.254 BACKBLAZE
General Check archive.org Show headers Download Go to Full URL https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 149.137.129.254 , United States, ASN40401 (BACKBLAZE, US), Reverse DNS s3.us-west-004.backblazeb2.com Software / Resource Hash a285679b033322576470c9c3fe506c735d09d9c5bea7254d4ef817c3f935a61a Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language en-US,en;q=0.9 Response headers Accept-Ranges bytes Last-Modified Wed, 22 Dec 2021 08:42:55 GMT ETag "6906f6da1c24c58591ac936dad433f7d" x-amz-request-id 861e107d51543875 x-amz-id-2 aM65mSTRVMYo1tjRIYo0xHzWsMs1m/Dcx x-amz-version-id 4_za34fb4d145e4eb1175d20f17_f105d4c1930acb1af_d20211222_m084255_c004_v0402005_t0046 Content-Type text/html Content-Length 80414 Date Mon, 03 Jan 2022 11:41:07 GMT Keep-Alive timeout=5 Connection keep-alive
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	65ms 21ms	Script application/javascript	2001:4de0:ac18::1:a:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com URL: https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/ Origin https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 03 Jan 2022 11:41:08 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 17:27:20 GMT server nginx etag W/"603e7578-15d9d" vary Accept-Encoding x-hw 1641210068.dop095.at2.t,1641210068.cds209.at2.hn,1641210068.cds220.at2.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H2	200	jquery-3.3.1.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	85 KB 30 KB	81ms 22ms	Script application/javascript	152.199.4.33 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js Requested by Host: plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com URL: https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.4.33 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (aga/87D4) / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/ Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 03 Jan 2022 11:41:08 GMT content-encoding gzip x-content-type-options nosniff age 24883623 x-cache HIT content-length 30394 x-xss-protection 1; mode=block last-modified Mon, 22 Jan 2018 19:27:49 GMT server ECAcc (aga/87D4) etag "80288516b793d31:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *
GET H2	200	webmail-logo.svg magicsmtps.com/email-list/gwebml8/assets/	5 KB 3 KB	72ms 26ms	Image image/svg+xml	2606:4700:3034::6815:4d4c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://magicsmtps.com/email-list/gwebml8/assets/webmail-logo.svg Requested by Host: plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com URL: https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:4d4c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5023cb5986b21ffc8da54cc95663b7706f337337021babedab9022cf750dfd5d Request headers Accept-Language en-US,en;q=0.9 Referer https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 11:41:08 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6748 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 02 Dec 2021 06:16:58 GMT server cloudflare etag W/"61a864da-14f0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=thjHRLRdn1eakxl9a1TrvBhF1lmJLBktAvc875Jdt5I9N90Hm9CHrJU5qUuJ%2BvV2w5caZFIQk%2Fp9752BYvQI3wSCk%2FLj44SqqYfF5rdh%2BjHHsgT2yxg3koWCQ1%2FrKowuhC9GS84%2B4erTRTSYOA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=315360000 cf-ray 6c7bf4cecfee63c0-ATL expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	webmail-login.svg magicsmtps.com/email-list/gwebml8/assets/	5 KB 3 KB	74ms 29ms	Image image/svg+xml	2606:4700:3034::6815:4d4c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://magicsmtps.com/email-list/gwebml8/assets/webmail-login.svg Requested by Host: plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com URL: https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:4d4c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce2d0dd8af7c4734b90978efd9a3413478a288b41e6519c88db292ad2af9ba99 Request headers Accept-Language en-US,en;q=0.9 Referer https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 11:41:08 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6748 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 02 Dec 2021 06:16:57 GMT server cloudflare etag W/"61a864d9-140d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PIXo0dn%2FOfLLgLlAixNMwIoWeCLJW0%2FupwUPKXUWz8i0Mh9DdbCEoMFGsYdHNptEqnqKPRGJgrLGhV9r2VfHgSDElgbkpDU%2BymOFwf9ipBf2cgqqc%2ByFRkK4JzC7gRNQFThVPrVGFFXRhPR%2FMg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=315360000 cf-ray 6c7bf4cecfef63c0-ATL expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	view.png magicsmtps.com/email-list/gwebml8/assets/	563 B 884 B	74ms 30ms	Image image/png	2606:4700:3034::6815:4d4c CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://magicsmtps.com/email-list/gwebml8/assets/view.png Requested by Host: plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com URL: https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:4d4c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8549b30036605e1d28140a76adbaf0f691d2495fcaf72b9a931897ac62184bec Request headers Accept-Language en-US,en;q=0.9 Referer https://plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 11:41:08 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6748 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 563 last-modified Thu, 02 Dec 2021 06:16:58 GMT server cloudflare etag "61a864da-233" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tuoKI0KIaGg0Ia%2FCsxaUnqgecgfL9ByKCuhMkxFcTuqSLaA0mLF%2BWa1fH1d5lBIus06FSDb%2FaD%2F73BKYIE6w56x5%2Fm%2FJNDZ7KCubcAEGTKjfNad4kJddoP%2BpaBLsUCq44NzwCX6eDK5uPYEE7g%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=315360000 accept-ranges bytes cf-ray 6c7bf4cecff163c0-ATL expires Thu, 31 Dec 2037 23:55:55 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _0x7687 function| _0x90d9 object| Zlib function| $ function| jQuery function| mg function| randomInteger function| randomString function| getdomainpartofemail function| get_email_hash function| validateEmail function| geturlparameter function| get_rand_url_pars

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
code.jquery.com
magicsmtps.com
plebeianizing-saddles-sizzled.s3.us-west-004.backblazeb2.com
149.137.129.254
152.199.4.33
2001:4de0:ac18::1:a:1a
2606:4700:3034::6815:4d4c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
5023cb5986b21ffc8da54cc95663b7706f337337021babedab9022cf750dfd5d
8549b30036605e1d28140a76adbaf0f691d2495fcaf72b9a931897ac62184bec
a285679b033322576470c9c3fe506c735d09d9c5bea7254d4ef817c3f935a61a
ce2d0dd8af7c4734b90978efd9a3413478a288b41e6519c88db292ad2af9ba99
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e