customblv.eu-gb.cf.appdomain.cloud
Open in
urlscan Pro
169.50.73.250
Malicious Activity!
Public Scan
Effective URL: https://customblv.eu-gb.cf.appdomain.cloud/?page2=Y29udGFjdC1mckBzdXNlLmNvbQ==&text=cds
Submission: On December 03 via manual from IN
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on September 24th 2019. Valid for: a year.
This is the only time customblv.eu-gb.cf.appdomain.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 169.50.73.250 169.50.73.250 | 36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.) | |
1 | 198.54.114.249 198.54.114.249 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
1 | 2606:2800:234... 2606:2800:234:660:118e:28f:1d8a:2522 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
2 | 2406:da00:ff0... 2406:da00:ff00::3213:fe6e | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
7 | 5 |
ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: fa.49.32a9.ip4.static.sl-reverse.com
dencsolyu.eu-gb.cf.appdomain.cloud | |
customblv.eu-gb.cf.appdomain.cloud |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server66-1.web-hosting.com
genteryservercheck.xyz |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
fast.fonts.net |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
static.telus.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
appdomain.cloud
dencsolyu.eu-gb.cf.appdomain.cloud customblv.eu-gb.cf.appdomain.cloud |
120 KB |
2 |
telus.com
static.telus.com |
105 KB |
1 |
fonts.net
fast.fonts.net |
152 B |
1 |
genteryservercheck.xyz
genteryservercheck.xyz |
481 B |
7 | 4 |
Domain | Requested by | |
---|---|---|
2 | static.telus.com |
customblv.eu-gb.cf.appdomain.cloud
|
2 | customblv.eu-gb.cf.appdomain.cloud |
customblv.eu-gb.cf.appdomain.cloud
|
1 | fast.fonts.net |
customblv.eu-gb.cf.appdomain.cloud
|
1 | genteryservercheck.xyz | |
1 | dencsolyu.eu-gb.cf.appdomain.cloud | |
7 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
webmail.tsast.mn |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.eu-gb.cf.appdomain.cloud DigiCert SHA2 Secure Server CA |
2019-09-24 - 2020-09-28 |
a year | crt.sh |
genteryservercheck.xyz Sectigo RSA Domain Validation Secure Server CA |
2019-11-24 - 2020-11-23 |
a year | crt.sh |
s9.wac.edgecastcdn.net DigiCert SHA2 Secure Server CA |
2019-01-16 - 2021-02-03 |
2 years | crt.sh |
static.telus.com DigiCert Global CA G2 |
2019-04-02 - 2020-04-25 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://customblv.eu-gb.cf.appdomain.cloud/?page2=Y29udGFjdC1mckBzdXNlLmNvbQ==&text=cds
Frame ID: ABC6C01073F9E376FB210F5C82F9C3D6
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://dencsolyu.eu-gb.cf.appdomain.cloud/?id=contact-fr@suse.com Page URL
- https://genteryservercheck.xyz/xdr/R/KdbpaezhiVyYbNUJPDDJMNUVORTVvnBbSCVURopV/KdbpaezhiVyYbNUJPDDJMNUVORTVv... Page URL
- https://customblv.eu-gb.cf.appdomain.cloud/?page2=Y29udGFjdC1mckBzdXNlLmNvbQ==&text=cds Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: var locate = window.location document.joe.burns.value = locate var text = document.joe.burns.value function delineate(str){ theleft = str.indexOf("=") + 1; theright = str.lastIndexOf("&"); return(str.substring(theleft, theright)); } document.write("" +atob(delineate(text))); contact-fr@suse.comMail
Search URL Search Domain Scan URL
Title: ContactsContactsContacts
Search URL Search Domain Scan URL
Title: SettingsSettingsSettings
Search URL Search Domain Scan URL
Title: LogoutLogoutLogout
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://dencsolyu.eu-gb.cf.appdomain.cloud/?id=contact-fr@suse.com Page URL
- https://genteryservercheck.xyz/xdr/R/KdbpaezhiVyYbNUJPDDJMNUVORTVvnBbSCVURopV/KdbpaezhiVyYbNUJPDDJMNUVORTVvnBbSCVURopV.php?id=Y29udGFjdC1mckBzdXNlLmNvbQ==&text=cds Page URL
- https://customblv.eu-gb.cf.appdomain.cloud/?page2=Y29udGFjdC1mckBzdXNlLmNvbQ==&text=cds Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
dencsolyu.eu-gb.cf.appdomain.cloud/ |
422 B 609 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KdbpaezhiVyYbNUJPDDJMNUVORTVvnBbSCVURopV.php
genteryservercheck.xyz/xdr/R/KdbpaezhiVyYbNUJPDDJMNUVORTVvnBbSCVURopV/ |
440 B 481 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
customblv.eu-gb.cf.appdomain.cloud/ |
584 KB 119 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.css
fast.fonts.net/t/ |
0 152 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
static.telus.com/common/fonts// |
56 KB 57 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icheck-green.png
customblv.eu-gb.cf.appdomain.cloud/my-account/assets/images/ |
239 B 239 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
static.telus.com/common/fonts// |
48 KB 48 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
24 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| make_blankp1 function| make_blank object| locate string| text function| delineate function| show function| hide function| show1 function| hide1 function| validate function| validates number| theleft number| theright string| dx string| fx string| dj string| fes string| input object| field string| net string| got object| fielde string| cat string| res string| zork1 string| message function| clickIE function| clickNS function| disableCtrlKeyCombination0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
customblv.eu-gb.cf.appdomain.cloud
dencsolyu.eu-gb.cf.appdomain.cloud
fast.fonts.net
genteryservercheck.xyz
static.telus.com
169.50.73.250
198.54.114.249
2406:da00:ff00::3213:fe6e
2606:2800:234:660:118e:28f:1d8a:2522
283246420c8ddc585831699f9623caf0985097ce116a5d640f4d869becfcceca
30e0fb28e825f13abe622975df47524ee9443514a19b852c82af99c0ecaefa87
382c30319f5c79a66c7aba94b69014498e57486602a3ebe040a6c0be8b19e5b6
42320c592f6b299d0f5649a0fa99f93d6fb5f66184430a084045883ba126033e
52e685b652ad085f0a75b1db1eef16926485862db6d2779195d106879d7857e4
5a9ce4d93bc8fd30ad48503f5eefce9d741aec86f7edee7eb89a30137662f479
74c46aee61a1e4035e1596566d7eddb00aca9e1147e3bbe7c6abcdf27477bf76
8fb7f75ec47b5f70882f0c2ccfb6d204f332aae123b81440254c1fcd566f34fe
d34d265fe5054f57d570f4eb8737474ccaab2dd316938c91582a9e8e77d8f7cc
dca2bda8f008bbc88da0460eb901c7b1fd28a2fcd9e10e8f1011ce3a51267831
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855