drnasr2020.com Open in urlscan Pro
2606:4700:3033::6818:65cc  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response drnasr2020.com/	49 KB 13 KB	551ms 317ms	Document text/html	2606:4700:3033::6818:65cc CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://drnasr2020.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::6818:65cc , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a88dcaf74585a316eba36da8ec0b431c99a0270f4a5b4a544f9a7ce32209a89 Request headers :method GET :authority drnasr2020.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 13 Dec 2020 20:32:43 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d1e77ebb7f4d98331297bd3a5e1f8f5ac1607891562; expires=Tue, 12-Jan-21 20:32:42 GMT; path=/; domain=.drnasr2020.com; HttpOnly; SameSite=Lax; Secure vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 06ff6749a70000ea62fc840000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3iPu%2FgUub0MyfcamOjtyA%2F8kY6VdrIQjaorsnJqC%2BdsutkEgZK95eQzamW2CKtR8qWkUhvWAhc%2BXEKNEzJRRwbrh2rbchv2azWDRjqVueXR7sC4t109KiW%2F59g%3D%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 601274bc3e3eea62-IAD content-encoding br
GET H2	200	fxxj3ttftm5ltcqnto1o4baovyl.png ir.ebaystatic.com/rs/v/	5 KB 5 KB	21ms 7ms	Image image/png	2a04:4e42:1b::718 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://ir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png Requested by Host: drnasr2020.com URL: https://drnasr2020.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::718 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ebay server / Resource Hash 5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0 Request headers Referer https://drnasr2020.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 13 Dec 2020 20:32:43 GMT via 1.1 include-cache-4 (squid), 1.1 varnish x-cache-lookup HIT from include-cache-4:80 age 6875551 rlogid t6q%60utuf%3C%3Dosuufvuq%60%28%3F0ghp*w%60ut3540-174c3fd9ef9-0xbe x-cache HIT from include-cache-4, HIT x-cache-hits 143295 x-ebay-c-version 1.0.0 content-length 4820 x-served-by cache-hhn4055-HHN last-modified Wed, 29 Oct 2014 18:09:24 GMT server ebay server x-timer S1607891563.211948,VS0,VE0 access-control-allow-methods GET content-type image/png access-control-allow-origin * cache-control public, max-age=31536000, immutable warning 113 squid "This cache hit is still fresh and more than 1 day old" accept-ranges bytes access-control-allow-headers * expires Sat, 25 Sep 2021 06:40:12 GMT
GET H2	200	imgbg.jpg securepics.ebaystatic.com/aw/pics/cmp/ds3/	1 KB 2 KB	313ms 95ms	Image image/jpeg	104.84.57.51 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://securepics.ebaystatic.com/aw/pics/cmp/ds3/imgbg.jpg Requested by Host: drnasr2020.com URL: https://drnasr2020.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.84.57.51 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-84-57-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://drnasr2020.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 13 Dec 2020 20:32:43 GMT x-cache-lookup HIT from slcpicscache-1939228:80 last-modified Tue, 30 May 2017 20:58:47 GMT server Apache etag "570-550c411e57d01" content-type image/jpeg cache-control max-age=3295916 accept-ranges bytes content-length 1392 x-xss-protection 1; mode=block expires Thu, 21 Jan 2021 00:04:39 GMT
GET H2	200	sprSignIn3.png securepics.ebaystatic.com/aw/pics/register/	19 KB 20 KB	319ms 102ms	Image image/png	104.84.57.51 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://securepics.ebaystatic.com/aw/pics/register/sprSignIn3.png Requested by Host: drnasr2020.com URL: https://drnasr2020.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.84.57.51 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-84-57-51.deploy.static.akamaitechnologies.com Software Apache / Resource Hash e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec Security Headers Name Value X-Xss-Protection 1; mode=block Request headers Referer https://drnasr2020.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 13 Dec 2020 20:32:43 GMT x-cache-lookup HIT from slcpicscache-1939226:80 last-modified Tue, 30 May 2017 21:02:38 GMT server Apache etag "4de3-550c41fb00e9b" content-type image/png cache-control max-age=3758682 accept-ranges bytes content-length 19939 x-xss-protection 1; mode=block expires Tue, 26 Jan 2021 08:37:25 GMT
GET H2	200	f5uxsy10bmz05dtrtrqybl5qquv.png ir.ebaystatic.com/rs/v/	994 B 1 KB	7ms 6ms	Image image/png	2a04:4e42:1b::718 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://ir.ebaystatic.com/rs/v/f5uxsy10bmz05dtrtrqybl5qquv.png?e Requested by Host: drnasr2020.com URL: https://drnasr2020.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:1b::718 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software ebay server / Resource Hash 7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0 Request headers Referer https://drnasr2020.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sun, 13 Dec 2020 20:32:43 GMT via 1.1 include-cache-1 (squid), 1.1 varnish x-cache-lookup HIT from include-cache-1:80 age 362508 x-cache HIT from include-cache-1, HIT x-cache-hits 1 x-ebay-c-version 1.0.0 content-length 994 x-served-by cache-hhn4055-HHN last-modified Fri, 12 Feb 2016 00:01:35 GMT server ebay server x-timer S1607891563.220288,VS0,VE1 access-control-allow-methods GET content-type image/png access-control-allow-origin * cache-control public, max-age=31536000, immutable rlogid t6q%60utuf%3C%3Dosuufvuq%60%28rukgu*w%60ut355%3F-1764832c3c9-0xd2 accept-ranges bytes access-control-allow-headers * expires Thu, 09 Dec 2021 15:50:55 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.drnasr2020.com/	1970-01-19 15:21:23	Name: __cfduid Value: d1e77ebb7f4d98331297bd3a5e1f8f5ac1607891562

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

drnasr2020.com
ir.ebaystatic.com
securepics.ebaystatic.com
104.84.57.51
2606:4700:3033::6818:65cc
2a04:4e42:1b::718
2a88dcaf74585a316eba36da8ec0b431c99a0270f4a5b4a544f9a7ce32209a89
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec