urlscan.io logo urlscan.io
SecurityTrails logo

red-coders.com Open in urlscan Pro
89.169.53.201  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://red-coders.com/86bg6/
Submission: On June 17 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 89.169.53.201, located in Frankfurt am Main, Germany and belongs to AEZA-AS, GB. The main domain is red-coders.com.
TLS certificate: Issued by R10 on June 15th 2024. Valid for: 3 months.
This is the only time red-coders.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WhatsApp (Instant Messenger)

Domain & IP information

IP Address AS Autonomous System
7 89.169.53.201 210644 (AEZA-AS)
8 2
Apex Domain
Subdomains		 Transfer
7 red-coders.com
red-coders.com
470 KB
8 1
Domain Requested by
7 red-coders.com red-coders.com
8 1

This site contains no links.

Subject Issuer Validity Valid
red-coders.com
R10		 2024-06-15 -
2024-09-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://red-coders.com/86bg6/
Frame ID: AF38889C6FD64642793B919FB3D03878
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Главная

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

470 kB
Transfer

467 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
red-coders.com/86bg6/ 		355 B
758 B 		Document
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/86bg6/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
cbb20c331c87e6d25481d5e56ad9a2202eb9757af4e171104a961b92960b6093

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
access-control-allow-origin
*
access-control-max-age
3628800
cache-control
public, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Mon, 17 Jun 2024 14:29:56 GMT
etag
W/"163-18defcef008"
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
index-affbc48c.js
red-coders.com/86bg6/assets/ 		265 KB
265 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/86bg6/assets/index-affbc48c.js
Requested by
Host: red-coders.com
URL: https://red-coders.com/86bg6/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
2a32f987b6641bef1e3da0af267d4de2b3c753275409fcb0d85ae36725a064f8

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://red-coders.com/86bg6/
Origin
https://red-coders.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 14:29:57 GMT
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
etag
W/"42200-18defcef008"
access-control-max-age
3628800
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
270848
index-62abddb2.css
red-coders.com/86bg6/assets/ 		202 KB
202 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/86bg6/assets/index-62abddb2.css
Requested by
Host: red-coders.com
URL: https://red-coders.com/86bg6/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
62abddb23181d4e77fbeec5b5bc80f6577b46da5a2be68c08dc26880f65e4cd6

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://red-coders.com/86bg6/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 14:29:57 GMT
last-modified
Wed, 28 Feb 2024 13:02:13 GMT
server
stormwall
etag
W/"3271d-18defcef008"
access-control-max-age
3628800
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
content-type
text/css; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
206621
/
red-coders.com/socket.io/ 		118 B
468 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/socket.io/?EIO=4&transport=polling&t=P0ccima
Requested by
Host: red-coders.com
URL: https://red-coders.com/86bg6/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
ff51993ce251d5b8ca49039fff81998de0c49c6a49305439f00affcd2f45d14c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
*/*
Referer
https://red-coders.com/86bg6/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 14:29:57 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
118
favicon.ico
red-coders.com/ 		0
0
/
red-coders.com/socket.io/ 		2 B
338 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/socket.io/?EIO=4&transport=polling&t=P0ccion&sid=INkUWLvLQlTKODSYAAa0
Requested by
Host: red-coders.com
URL: https://red-coders.com/86bg6/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type
text/plain;charset=UTF-8
Accept
*/*
Referer
https://red-coders.com/86bg6/
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 14:29:57 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/html
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
2
/
red-coders.com/socket.io/ 		32 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/socket.io/?EIO=4&transport=polling&t=P0cciop&sid=INkUWLvLQlTKODSYAAa0
Requested by
Host: red-coders.com
URL: https://red-coders.com/86bg6/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
eaa1c35cb94d3a9f57ee761bd7928f3758bcdf348b25daac8b7dc72195c38e50

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
*/*
Referer
https://red-coders.com/86bg6/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 14:29:57 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
32
/
red-coders.com/socket.io/ 		1 B
349 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://red-coders.com/socket.io/?EIO=4&transport=polling&t=P0cciqu&sid=INkUWLvLQlTKODSYAAa0
Requested by
Host: red-coders.com
URL: https://red-coders.com/86bg6/assets/index-affbc48c.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.169.53.201 Frankfurt am Main, Germany, ASN210644 (AEZA-AS, GB),
Reverse DNS
quixotic-bomb_n4.aeza.network
Software
stormwall /
Resource Hash
e7f6c011776e8db7cd330b54174fd76f7d0216b612387a5ffcfb81e6f0919683

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
*/*
Referer
https://red-coders.com/86bg6/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 17 Jun 2024 14:29:57 GMT
server
stormwall
vary
Origin
access-control-max-age
3628800
content-type
text/plain; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT
cache-control
no-store
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, JSNLog-RequestId, activityId, applicationId, applicationUserId, channelId, senderId, sessionId
content-length
1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
red-coders.com
URL
https://red-coders.com/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WhatsApp (Instant Messenger)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage boolean| __VUE__

1 Cookies

Domain/Path Name / Value
red-coders.com/ Name: Auth
Value: def8e701783fbbeda8e95917a4244d52

1 Console Messages

Source Level URL
Text
network error URL: https://red-coders.com/favicon.ico
Message:
Failed to load resource: net::ERR_HTTP2_PROTOCOL_ERROR