www.geleanglobal.com Open in urlscan Pro
2606:4700:3030::681c:96d Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.geleanglobal.com/security/fail.html
Submission Tags: @ipnigh
Submission: On March 24 via api (March 24th 2020, 12:24:35 am UTC) from GB

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2606:4700:3030::681c:96d, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.geleanglobal.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on March 6th 2020. Valid for: 7 months.

This is the only time www.geleanglobal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking) GDrive and other (Online)

Domain & IP information

	IP Address		AS Autonomous System
7	2606:4700:303... 2606:4700:3030::681c:96d		13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2

7 2606:4700:3030::681c:96d (United States)

ASN13335 (CLOUDFLARENET, US)

www.geleanglobal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	geleanglobal.com www.geleanglobal.com	380 KB
7	1

	Domain	Requested by
7	www.geleanglobal.com	www.geleanglobal.com
7	1

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-03-06` - `2020-10-09`	7 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.geleanglobal.com/security/fail.html
Frame ID: 950864A123FA833D772B95A991182F51
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

380 kB
Transfer

806 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request fail.html Show response www.geleanglobal.com/security/	134 KB 44 KB	899ms 875ms	Document text/html	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e69da51fc2ba0e980ed1d1db8fc26ef5582061f578986d73e95a998e4a9f347f` Request headers :method GET :authority www.geleanglobal.com :scheme https :path /security/fail.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Tue, 24 Mar 2020 00:24:12 GMT content-type text/html set-cookie __cfduid=d172f2d327aa0ce5be11ea3822e2882a61585009451; expires=Thu, 23-Apr-20 00:24:11 GMT; path=/; domain=.geleanglobal.com; HttpOnly; SameSite=Lax; Secure last-modified Mon, 29 Jul 2019 05:34:26 GMT cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 578c3f710f84c277-FRA content-encoding br
GET H2	200	bootstrap.min.css www.geleanglobal.com/security/vendor/bootstrap/css/	150 KB 20 KB	14ms 13ms	Stylesheet text/css	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.geleanglobal.com/security/vendor/bootstrap/css/bootstrap.min.css Requested by Host: www.geleanglobal.com URL: https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c` Request headers Referer https://www.geleanglobal.com/security/fail.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Tue, 24 Mar 2020 00:24:12 GMT content-encoding br cf-cache-status HIT last-modified Tue, 05 Mar 2019 23:23:24 GMT server cloudflare age 76 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 578c3f7688a6c277-FRA
GET H2	200	agency.min.css www.geleanglobal.com/security/css/	159 KB 81 KB	12ms 11ms	Stylesheet text/css	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.geleanglobal.com/security/css/agency.min.css Requested by Host: www.geleanglobal.com URL: https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2c4777dbcff98f98a2ca3e1c737965ff02401ee055aabe757bfe6c5fbdf9b74f` Request headers Referer https://www.geleanglobal.com/security/fail.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Tue, 24 Mar 2020 00:24:12 GMT content-encoding br cf-cache-status HIT last-modified Tue, 05 Mar 2019 23:23:22 GMT server cloudflare age 76 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css status 200 cache-control max-age=14400 cf-ray 578c3f7688a7c277-FRA
GET H2	200	header-bg.jpg www.geleanglobal.com/security/img/	234 KB 235 KB	13ms 13ms	Image image/jpeg	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.geleanglobal.com/security/img/header-bg.jpg Requested by Host: www.geleanglobal.com URL: https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `86b3a0e189a75f5db18b06881a74091546c6b726f28b30ced1bdb2ae4f6c922a` Request headers Referer https://www.geleanglobal.com/security/css/agency.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Tue, 24 Mar 2020 00:24:12 GMT cf-cache-status HIT last-modified Sat, 27 Jul 2019 18:35:42 GMT server cloudflare age 75 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type image/jpeg status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 578c3f76a8f4c277-FRA content-length 240051
GET H2	200	sin.js Show response www.geleanglobal.com/security/	0 81 B	9ms 9ms	Script application/javascript	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.geleanglobal.com/security/sin.js Requested by Host: www.geleanglobal.com URL: https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.geleanglobal.com/security/fail.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Tue, 24 Mar 2020 00:24:12 GMT cf-cache-status HIT last-modified Sat, 27 Jul 2019 18:28:24 GMT server cloudflare age 76 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 accept-ranges bytes cf-ray 578c3f778a8dc277-FRA content-length 0
GET H2	404	jquery.min.js www.geleanglobal.com/security/vendor/jquery/	0 0	1532ms 1532ms	Script text/html	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.geleanglobal.com/security/vendor/jquery/jquery.min.js Requested by Host: www.geleanglobal.com URL: https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Referer https://www.geleanglobal.com/security/fail.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Tue, 24 Mar 2020 00:24:14 GMT content-encoding br cf-cache-status EXPIRED server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html; charset=UTF-8 status 404 expires Wed, 11 Jan 1984 05:00:00 GMT cache-control max-age=14400, must-revalidate cf-ray 578c3f778a8ec277-FRA link <https://www.geleanglobal.com/wp-json/>; rel="https://api.w.org/" x-ua-compatible IE=edge
GET H2	200	agency.min.js Show response www.geleanglobal.com/security/js/	1 KB 554 B	10ms 10ms	Script application/javascript	2606:4700:3030::681c:96d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.geleanglobal.com/security/js/agency.min.js Requested by Host: www.geleanglobal.com URL: https://www.geleanglobal.com/security/fail.html Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700:3030::681c:96d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c598946947854f8ae24de5ddb824fc9dd6fab41e25341b0b984ff23933bb17cb` Request headers Referer https://www.geleanglobal.com/security/fail.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Tue, 24 Mar 2020 00:24:12 GMT content-encoding br cf-cache-status HIT last-modified Tue, 05 Mar 2019 23:23:22 GMT server cloudflare age 76 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=14400 cf-ray 578c3f778a8fc277-FRA
GET DATA	200 OK	truncated /	60 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `770e10a61a69d8c2bc5bbdac5720311efdf654bf0edde38197ff6c627993d095` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	49 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8d5e3de3035855a96038cd1910a424237d2fc104ab44cdce69e0246e83024752` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0e95cbf733f41b43a1e2716643ad7ea8cd5fdfcb2eee2d038f4618c579bcaff7` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	13 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7fc8d6ebc9c560997bb0ad5595aaa79c7c0b5860136fe22ec0de6829c945371a` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	3 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `73b1ce58fa539aab1d6d1424607c5ff60fc5e2f2c0becd3a776f7f4f8f3664b0` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking) GDrive and other (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.geleanglobal.com/	1970-01-19 09:00:01	Name: __cfduid Value: d172f2d327aa0ce5be11ea3822e2882a61585009451

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www.geleanglobal.com
2606:4700:3030::681c:96d
0b6c1e1b33c085efad5bdc32654ec90b4ddc934eb1c1aca71a439ff89867f468
0e95cbf733f41b43a1e2716643ad7ea8cd5fdfcb2eee2d038f4618c579bcaff7
2c4777dbcff98f98a2ca3e1c737965ff02401ee055aabe757bfe6c5fbdf9b74f
6b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c
73b1ce58fa539aab1d6d1424607c5ff60fc5e2f2c0becd3a776f7f4f8f3664b0
770e10a61a69d8c2bc5bbdac5720311efdf654bf0edde38197ff6c627993d095
7fc8d6ebc9c560997bb0ad5595aaa79c7c0b5860136fe22ec0de6829c945371a
86b3a0e189a75f5db18b06881a74091546c6b726f28b30ced1bdb2ae4f6c922a
8d5e3de3035855a96038cd1910a424237d2fc104ab44cdce69e0246e83024752
c598946947854f8ae24de5ddb824fc9dd6fab41e25341b0b984ff23933bb17cb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e69da51fc2ba0e980ed1d1db8fc26ef5582061f578986d73e95a998e4a9f347f

www.geleanglobal.com Open in urlscan Pro 2606:4700:3030::681c:96d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

380 kBTransfer

806 kBSize

1 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

www.geleanglobal.com Open in urlscan Pro
2606:4700:3030::681c:96d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

380 kB
Transfer

806 kB
Size

1
Cookies

7 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!