hearty-dragonfly.static.domains
Open in
urlscan Pro
2606:4700:20::681a:c04
Malicious Activity!
Public Scan
Effective URL: https://hearty-dragonfly.static.domains/currently
Submission Tags: phishing
Submission: On May 14 via api from US — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on April 14th 2024. Valid for: 3 months.
This is the only time hearty-dragonfly.static.domains was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.18.0.248 104.18.0.248 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:20:... 2606:4700:20::681a:c04 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700:20:... 2606:4700:20::ac43:4626 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 4 |
ASN13335 (CLOUDFLARENET, US)
hearty-dragonfly.static.domains |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
static.app
static.app |
5 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 380 |
30 KB |
1 |
static.domains
hearty-dragonfly.static.domains |
102 KB |
1 |
flowcode.com
1 redirects
flowcode.com — Cisco Umbrella Rank: 82522 |
570 B |
4 | 4 |
Domain | Requested by | |
---|---|---|
2 | static.app |
hearty-dragonfly.static.domains
|
1 | ajax.googleapis.com |
hearty-dragonfly.static.domains
|
1 | hearty-dragonfly.static.domains | |
1 | flowcode.com | 1 redirects |
4 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.att.com |
attreg.att.net |
about.att.com |
static.app |
Subject Issuer | Validity | Valid | |
---|---|---|---|
static.domains GTS CA 1P5 |
2024-04-14 - 2024-07-13 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-05-06 - 2024-07-29 |
3 months | crt.sh |
static.app GTS CA 1P5 |
2024-03-22 - 2024-06-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://hearty-dragonfly.static.domains/currently
Frame ID: 92653E7E9B5EA2655F890CBF2B0E1480
Requests: 8 HTTP requests in this frame
Screenshot
Page Title
Login ScreenPage URL History Show full URLs
-
http://flowcode.com/p/Ef7regJrl?fc=3D0
HTTP 307
https://flowcode.com/p/Ef7regJrl?fc=3D0 HTTP 302
https://hearty-dragonfly.static.domains/currently Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: Forgot user ID?
Search URL Search Domain Scan URL
Title: Forgot password?
Search URL Search Domain Scan URL
Title: Create one now
Search URL Search Domain Scan URL
Title: Learn about ZenKey
Search URL Search Domain Scan URL
Title: Legal policy center
Search URL Search Domain Scan URL
Title: Privacy policy
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Do not sell my personal info
Search URL Search Domain Scan URL
Title: Hosted for freewith Static.app
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://flowcode.com/p/Ef7regJrl?fc=3D0
HTTP 307
https://flowcode.com/p/Ef7regJrl?fc=3D0 HTTP 302
https://hearty-dragonfly.static.domains/currently Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
currently
hearty-dragonfly.static.domains/ Redirect Chain
|
162 KB 102 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
static-forms.js
static.app/js/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
static.js
static.app/js/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
22 KB 22 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
373 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| getEmailFromhash function| isAllBase64Chars function| validateEmail function| getHashOrUrlParVal function| MD5 function| M function| X function| V function| Y function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| safe_add function| bit_rol object| forms function| j function| _0x29a5 function| _0x56ca2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.flowcode.com/ | Name: __cf_bm Value: FQsSRkB6O1TuMpYa5lTLkWQ0YqeEYRky5HMGXOh7j8U-1715713537-1.0.1.1-3JZImTNXwlM8ByJ1suBA6vceVHzg9Lc4W3gMTvVsQGLYY4CHZISXbZia7owIrjRdfb5W0fOUPNJTcAPDwfk1RA |
|
.flowcode.com/ | Name: _cfuvid Value: j2umcPQzKrgFpDI0wb9d8qEqZOoGtdA7eWRFbA7nqn4-1715713537948-0.0.1.1-604800000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
flowcode.com
hearty-dragonfly.static.domains
static.app
104.18.0.248
2606:4700:20::681a:c04
2606:4700:20::ac43:4626
2a00:1450:4001:809::200a
07b3a3d0f02092988f8b70fa51992fa109b23bbc82638fc857dee5ee0e3ad5dc
3664f91baec63678fabaa2afa2411aa50292e47cacb796aaf7c862620698d11e
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
947f7f6c08d7de52e4aff5ed724273dfac1a7cd3374bdad7b64746da1a5c8dad
9d655d5b697be8eae62ffff41a7f6cc62dac6bc9057f6c147c77bdd369ed2642
a69c8f44aa893f1b89c4f2f685b20e60d1ff098af7535aeec9be0333ed693e7d
bde0c02c23f58bacdd0622f928446c1512fdc85d9c141ceabffd36aee8aba60c
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a