confirm.hadglb7m3jcd.top Open in urlscan Pro
194.63.143.61  Malicious Activity! Public Scan

Submitted URL: https://drqqeh.paypal-europa.de/
Effective URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Submission: On August 22 via api from US — Scanned from US

Summary

This website contacted 3 IPs in 2 countries across 5 domains to perform 10 HTTP transactions. The main IP is 194.63.143.61, located in Moscow Oblast, Russian Federation and belongs to SUPERSERVERSDATACENTER, CZ. The main domain is confirm.hadglb7m3jcd.top. The Cisco Umbrella rank of the primary domain is 414009.
TLS certificate: Issued by R3 on June 28th 2023. Valid for: 3 months.
This is the only time confirm.hadglb7m3jcd.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 37.1.213.100 29802 (HVC-AS)
1 1 192.243.59.20 39572 (ADVANCEDH...)
1 2 173.233.137.60 7979 (SERVERS-COM)
1 9 194.63.143.61 50113 (SUPERSERV...)
10 3
Apex Domain
Subdomains
Transfer
9 hadglb7m3jcd.top
confirm.hadglb7m3jcd.top — Cisco Umbrella Rank: 414009
955 KB
2 practicallyfire.com
practicallyfire.com
4 KB
1 inediblebedside.com
inediblebedside.com — Cisco Umbrella Rank: 387656
803 B
1 paypal-europa.de
drqqeh.paypal-europa.de
600 B
0 simplewebanalysis.com Failed
simplewebanalysis.com Failed
10 5
Domain Requested by
9 confirm.hadglb7m3jcd.top 1 redirects confirm.hadglb7m3jcd.top
2 practicallyfire.com 1 redirects
1 inediblebedside.com 1 redirects
1 drqqeh.paypal-europa.de 1 redirects
0 simplewebanalysis.com Failed practicallyfire.com
10 5

This site contains no links.

Subject Issuer Validity Valid
practicallyfire.com
R3
2023-06-28 -
2023-09-26
3 months crt.sh
hadglb7m3jcd.top
R3
2023-06-28 -
2023-09-26
3 months crt.sh

This page contains 1 frames:

Primary Page: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Frame ID: CC3EF9D0BEF568B84724B2012AF16336
Requests: 10 HTTP requests in this frame

Screenshot

Page Title

Attention

Page URL History Show full URLs

  1. https://drqqeh.paypal-europa.de/ HTTP 302
    http://37.1.213.100/ycWbNp?host=drqqeh.paypal-europa.de/&mark=17082023_7r1_1kkHtml_1shab15de_ser... HTTP 302
    https://inediblebedside.com/t9hiwrkd?key=d928d7c4e235fa6eb6c04ecc0f7abe92 HTTP 307
    https://practicallyfire.com/rapksm56ie?key=07c23e0965369888f4d8e8e9f09eb547 Page URL
  2. https://practicallyfire.com/api/users?token=L3JhcGtzbTU2aWU_a2V5PTA3YzIzZTA5NjUzNjk4ODhmNGQ4ZThlOWYwOWVi... HTTP 302
    https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq HTTP 301
    https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

Page Statistics

10
Requests

90 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

3
IPs

2
Countries

958 kB
Transfer

1045 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://drqqeh.paypal-europa.de/ HTTP 302
    http://37.1.213.100/ycWbNp?host=drqqeh.paypal-europa.de/&mark=17082023_7r1_1kkHtml_1shab15de_serv1_SUB_17_key&keyword=i%20won%20the%20podium%20vehicle%20but%20didn%27t%20get%20it&template=&se_referrer= HTTP 302
    https://inediblebedside.com/t9hiwrkd?key=d928d7c4e235fa6eb6c04ecc0f7abe92 HTTP 307
    https://practicallyfire.com/rapksm56ie?key=07c23e0965369888f4d8e8e9f09eb547 Page URL
  2. https://practicallyfire.com/api/users?token=L3JhcGtzbTU2aWU_a2V5PTA3YzIzZTA5NjUzNjk4ODhmNGQ4ZThlOWYwOWViNTQ3JnBzdD0xNjkyNzIwMzQxJnJtdGM9dCZzaHU9ZTkzMjllOWMzZmU0NTBiYzExMjI1YzNhZDVmMWM3ODMzYjZhNGYwZjAwMDkwN2I4MTdlMmY4ZDMzYzc0MmYwYWI3MjQ2ZTZhNTBlZGEzMjFjOTQwNWNlZWU0Y2ZiNmY5ODVhNDZkNjc0OTZiMGEwOTZmNmQyZGQ4YjAwNDFiNjFlNDQ5NzZiYzgzZTI2OTM2OWY1NjgzY2M4ZTdlYjAxNzMzYjM0ZTk5OTg2MzViM2YyZDg0YWY1ZmQwZjA4ZGU4ODQ%3D&uuid=&pii=&in=false HTTP 302
    https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq HTTP 301
    https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://drqqeh.paypal-europa.de/ HTTP 302
  • http://37.1.213.100/ycWbNp?host=drqqeh.paypal-europa.de/&mark=17082023_7r1_1kkHtml_1shab15de_serv1_SUB_17_key&keyword=i%20won%20the%20podium%20vehicle%20but%20didn%27t%20get%20it&template=&se_referrer= HTTP 302
  • https://inediblebedside.com/t9hiwrkd?key=d928d7c4e235fa6eb6c04ecc0f7abe92 HTTP 307
  • https://practicallyfire.com/rapksm56ie?key=07c23e0965369888f4d8e8e9f09eb547

10 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
rapksm56ie
practicallyfire.com/
Redirect Chain
  • https://drqqeh.paypal-europa.de/
  • http://37.1.213.100/ycWbNp?host=drqqeh.paypal-europa.de/&mark=17082023_7r1_1kkHtml_1shab15de_serv1_SUB_17_key&keyword=i%20won%20the%20podium%20vehicle%20but%20didn%27t%20get%20it&template=&se_refer...
  • https://inediblebedside.com/t9hiwrkd?key=d928d7c4e235fa6eb6c04ecc0f7abe92
  • https://practicallyfire.com/rapksm56ie?key=07c23e0965369888f4d8e8e9f09eb547
3 KB
3 KB
Document
General
Full URL
https://practicallyfire.com/rapksm56ie?key=07c23e0965369888f4d8e8e9f09eb547
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
173.233.137.60 , United States, ASN7979 (SERVERS-COM, US),
Reverse DNS
Software
nginx/1.21.6 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubdomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Cache-Control
no-cache
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Tue, 22 Aug 2023 16:04:41 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server
nginx/1.21.6
Strict-Transport-Security
max-age=0; includeSubdomains
Transfer-Encoding
chunked
X-Request-ID
83d72700cd46149e3ee94e6ccb31f7bd

Redirect headers

Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
text/html
Date
Tue, 22 Aug 2023 16:04:41 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Location
https://practicallyfire.com/rapksm56ie?key=07c23e0965369888f4d8e8e9f09eb547
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server
nginx/1.19.5
Strict-Transport-Security
max-age=0; includeSubdomains
X-Request-ID
ab56b38c3f57ae07fd088d6f9412cdfc
stats
simplewebanalysis.com/
0
0

Primary Request /
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Redirect Chain
  • https://practicallyfire.com/api/users?token=L3JhcGtzbTU2aWU_a2V5PTA3YzIzZTA5NjUzNjk4ODhmNGQ4ZThlOWYwOWViNTQ3JnBzdD0xNjkyNzIwMzQxJnJtdGM9dCZzaHU9ZTkzMjllOWMzZmU0NTBiYzExMjI1YzNhZDVmMWM3ODMzYjZhNGYwZ...
  • https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq
  • https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
22 KB
6 KB
Document
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
7e1ce17df9abae373e49f3d44f952919ddbcec798ba468635d0fc5f8437725db

Request headers

Referer
https://practicallyfire.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Tue, 22 Aug 2023 16:04:43 GMT
ETag
W/"64e481f3-58c2"
Expires
Thu, 31 Dec 2037 23:55:55 GMT
Keep-Alive
timeout=10
Last-Modified
Tue, 22 Aug 2023 09:37:55 GMT
Server
nginx/1.15.10
Transfer-Encoding
chunked

Redirect headers

Connection
keep-alive
Content-Length
170
Content-Type
text/html
Date
Tue, 22 Aug 2023 16:04:43 GMT
Keep-Alive
timeout=10
Location
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Server
nginx/1.15.10
animate.css
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
78 KB
5 KB
Stylesheet
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/animate.css
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
d1413e8c95a61b36e4ea9441e9ead3cce29089e85043b0706453597016c01fdb

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Content-Encoding
gzip
Last-Modified
Tue, 22 Aug 2023 09:37:57 GMT
Server
nginx/1.15.10
ETag
W/"64e481f5-1361f"
Transfer-Encoding
chunked
Content-Type
text/css
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Connection
keep-alive
Keep-Alive
timeout=10
Expires
Thu, 31 Dec 2037 23:55:55 GMT
new_free.svg
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
2 KB
2 KB
Image
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/new_free.svg
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
89bcc9a26f3ed7fb196ca1d744395e6fb79f4561ced17605eb27105a9f67e56e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Last-Modified
Tue, 22 Aug 2023 09:37:58 GMT
Server
nginx/1.15.10
ETag
"64e481f6-609"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=10
Content-Length
1545
loading.svg
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
386 B
653 B
Image
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/loading.svg
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
d4d917c84ef07493d6dc83306cb754ddddc1cdb4fc879e09f5b54a0b6f11d451

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Last-Modified
Tue, 22 Aug 2023 09:37:58 GMT
Server
nginx/1.15.10
ETag
"64e481f6-182"
Content-Type
image/svg+xml
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=10
Content-Length
386
qr2.png
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
7 KB
7 KB
Image
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/qr2.png
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
808f265ca05900d28855bd7b9a2db0b963bc9f363aec6c9ea6332be0d4f467db

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Last-Modified
Tue, 22 Aug 2023 09:37:59 GMT
Server
nginx/1.15.10
ETag
"64e481f7-1c0f"
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=10
Content-Length
7183
Expires
Thu, 31 Dec 2037 23:55:55 GMT
1.png
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
49 KB
49 KB
Image
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/1.png
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
ff708dfd7d816c51832a47cebfaf051422ddd0ab0d96588b55a1a2b89c1f3f73

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Last-Modified
Tue, 22 Aug 2023 09:37:56 GMT
Server
nginx/1.15.10
ETag
"64e481f4-c2cb"
Content-Type
image/png
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=10
Content-Length
49867
Expires
Thu, 31 Dec 2037 23:55:55 GMT
alertmicrosoft1.mp3
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
50 KB
50 KB
Media
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/alertmicrosoft1.mp3
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
68d390582507c5639dc5b624fd8e3b302678428fecb1ccedb75b23e90a8cdfbf

Request headers

Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Range
bytes=0-

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Last-Modified
Tue, 22 Aug 2023 09:37:56 GMT
Server
nginx/1.15.10
ETag
"64e481f4-c7dd"
Content-Type
audio/mpeg
Content-Range
bytes 0-51164/51165
Connection
keep-alive
Keep-Alive
timeout=10
Content-Length
51165
bg.gif
confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/
835 KB
835 KB
Image
General
Full URL
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/assets/bg.gif
Requested by
Host: confirm.hadglb7m3jcd.top
URL: https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
194.63.143.61 Moscow Oblast, Russian Federation, ASN50113 (SUPERSERVERSDATACENTER, CZ),
Reverse DNS
Software
nginx/1.15.10 /
Resource Hash
306d7910500ae32624462375434beaab45581fdfb743af6f3efa5b096a403721

Request headers

accept-language
en-US,en;q=0.9
Referer
https://confirm.hadglb7m3jcd.top/eb430691fe30d16070b5a144c3d3303c/maq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

Date
Tue, 22 Aug 2023 16:04:43 GMT
Last-Modified
Tue, 22 Aug 2023 09:37:58 GMT
Server
nginx/1.15.10
ETag
"64e481f6-d0a03"
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=10
Content-Length
854531

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
simplewebanalysis.com
URL
https://simplewebanalysis.com/stats

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture number| popupShows function| showDontLeavePopup

11 Cookies

Domain/Path Name / Value
practicallyfire.com/api Name: pdhtkv
Value: true
practicallyfire.com/api Name: uncs
Value: 1
practicallyfire.com/api Name: pdhtkv28
Value: true
practicallyfire.com/api Name: uncs28
Value: 1
37.1.213.100/ Name: _subid
Value: 320t84pbq26tr
37.1.213.100/ Name: 9fb19
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjEyNlwiOjE2OTI3MjAyODF9LFwiY2FtcGFpZ25zXCI6e1wiMVwiOjE2OTI3MjAyODF9LFwidGltZVwiOjE2OTI3MjAyODF9In0.7Rd007SBQ3Sbu5R5JJVB-n-CXpFl8eI9tGRdKNM4els
37.1.213.100/ Name: _token
Value: uuid_320t84pbq26tr_320t84pbq26tr64e4dc994b0772.69305232
inediblebedside.com/ Name: u_pl
Value: 15107318
practicallyfire.com/ Name: u_pl
Value: 20196238
practicallyfire.com/ Name: ain
Value: eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDE5NjIzOCwiayI6IjA3YzIzZTA5NjUzNjk4ODhmNGQ4ZThlOWYwOWViNTQ3Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoyODQ0MTQ0LCJwaWQiOjI3NTcsImFuIjpmYWxzZSwibGFuIjpmYWxzZSwiY2lkIjoyNCwiYWlkIjoyOCwicHQiOjQsInBrIjoicmFwa3NtNTZpZSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjoxOTc0ODA3NzksImlkcyI6IiIsImljIjpmYWxzZSwibiI6IkRlc2t0b3AsRW11bGF0b3IiLCJ2IjoiVW5rbm93biIsIm0iOiJVbmtub3duIiwiZiI6MSwiZm4iOiJEZXNrdG9wIiwib2lkIjozODkxNCwib24iOiJXaW5kb3dzIiwib3YiOiIxMC4wIiwiYmlkIjoxMjgxMjMsImJuIjoiQ2hyb21lIiwiYnYiOiIxMTYiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoyMjMsImMiOiJVUyIsIm4iOiJVbml0ZWQgU3RhdGVzIn0sImEiOnRydWUsImNyIjp7Im4iOiJOZXhlb24gVGVjaG5vbG9naWVzIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiIn19.aYvfQehaYfb31PXlopG1YN326p-D44VyJSNPO1QLcJI
practicallyfire.com/ Name: cjs
Value: t

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0; includeSubdomains