a1933.pages.dev Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://0246r.app.link/elO7cyegdab
Effective URL:
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C
Submission Tags: falconsandbox
Submission: On June 15 via api (June 15th 2023, 4:12:18 pm UTC) from US — Scanned from DE

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 1 countries across 7 domains to perform 7 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is a1933.pages.dev.
TLS certificate: Issued by GTS CA 1P5 on May 1st 2023. Valid for: 3 months.

This is the only time a1933.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:205... 2600:9000:2057:a800:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.99.97 13.32.99.97	16509 (AMAZON-02) (AMAZON-02)
1	18.66.112.41 18.66.112.41	16509 (AMAZON-02) (AMAZON-02)
1	99.83.173.21 99.83.173.21	16509 (AMAZON-02) (AMAZON-02)
1	76.223.60.10 76.223.60.10	16509 (AMAZON-02) (AMAZON-02)
1	199.79.63.176 199.79.63.176	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
7	7

1 2600:9000:2057:a800:19:9934:6a80:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

0246r.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

a1933.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-97.fra60.r.cloudfront.net

openfpcdn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-41.fra56.r.cloudfront.net

fpjscdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.83.173.21 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a64bed9ff5004f5b3.awsglobalaccelerator.com

use1.fptls.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.223.60.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: a46a250059e296ddb.awsglobalaccelerator.com

api.fpjs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.79.63.176 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 199-79-63-176.unifiedlayer.com

golden4deisgn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	pages.dev a1933.pages.dev	7 KB
1	golden4deisgn.com golden4deisgn.com	11 KB
1	fpjs.io api.fpjs.io — Cisco Umbrella Rank: 49918	627 B
1	fptls.com use1.fptls.com — Cisco Umbrella Rank: 11098	331 B
1	fpjscdn.net fpjscdn.net — Cisco Umbrella Rank: 166949	41 KB
1	openfpcdn.io openfpcdn.io — Cisco Umbrella Rank: 24815	6 KB
1	app.link 1 redirects 0246r.app.link	511 B
7	7

	Domain	Requested by
2	a1933.pages.dev	a1933.pages.dev
1	golden4deisgn.com	a1933.pages.dev
1	api.fpjs.io	fpjscdn.net
1	use1.fptls.com	fpjscdn.net
1	fpjscdn.net	a1933.pages.dev
1	openfpcdn.io	a1933.pages.dev
1	0246r.app.link	1 redirects
7	7

This site contains no links.

Subject Issuer	Validity	Valid
a1933.pages.dev GTS CA 1P5	`2023-05-01` - `2023-07-30`	3 months	crt.sh
openfpcdn.io Amazon RSA 2048 M01	`2023-01-25` - `2024-02-24`	a year	crt.sh
fpcdn.io Amazon RSA 2048 M01	`2022-11-09` - `2023-12-08`	a year	crt.sh
use1.fptls.com R3	`2023-04-27` - `2023-07-26`	3 months	crt.sh
api.fpjs.io Amazon RSA 2048 M01	`2023-02-21` - `2024-01-13`	a year	crt.sh
*.carl247tools-panel.tk R3	`2023-04-30` - `2023-07-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C
Frame ID: 6B8DA63D101FF99372CE7F51452EBDF6
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

https://0246r.app.link/elO7cyegdab HTTP 307
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C Page URL
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C Page URL

Page Statistics

7
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

7
IPs

1
Countries

65 kB
Transfer

166 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://0246r.app.link/elO7cyegdab HTTP 307
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C Page URL
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://0246r.app.link/elO7cyegdab HTTP 307
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

7 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

%E6%B3%A8%E5%86%8C Show response
a1933.pages.dev/
Redirect Chain

https://0246r.app.link/elO7cyegdab
https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

6 KB
4 KB

145ms
72ms

Document
text/html

2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0776e4a7052c14baeb591cec3ba49a549826a97afcb1e15702372893b096a00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 7d7c17e358c12be4-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 15 Jun 2023 16:12:12 GMT
etag: W/"448f3da7988395dbd2ec49b3cdb94a2d"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lVjhuMTjGk5Yrn2Zrz5OPD1ogKlJ99orWqiDJ35q2JfF9EjLePqpK1OSV6DgCF5E2MAkDgfOnEws%2FsMAizaN4U9n6WFbUvqKoCyo1%2BgoHsCZjojOR7S5AsChuTVRQwKHypIL9r4FSnYUOxzVD2c%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
date: Thu, 15 Jun 2023 16:12:12 GMT
last-modified: Thu, 15 Jun 2023 16:12:12 GMT
location: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
x-amz-cf-id: Msc5EXEET4BK3DbAHKpm-ia52JuWiPrUBcqkyysanoPNgSSIcLAMDQ==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront

GET
H2 200 v1 Show response
openfpcdn.io/botd/ 15 KB
6 KB 76ms
8ms Script
text/javascript 13.32.99.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://openfpcdn.io/botd/v1

Requested by

Host: a1933.pages.dev
URL: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.97 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-97.fra60.r.cloudfront.net

Software

CloudFront /

Resource Hash

b61fb11f3e2b7bd4a2019e33f1b68cbb2d07e3729cff45edd1b4bf6829b9ec16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://a1933.pages.dev/
Origin: https://a1933.pages.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 13:37:23 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: gzip
via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 9290
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
server: CloudFront
etag: W/"kutgS/Eg1xn4RPXeyMMv2PXiou0"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=604523, s-maxage=10936
x-amz-cf-id: zMNjJRBwvy_Y6m1Vp_BS1DguAnGUz25PU0dtJsaxzAVBZeIZKPk7IQ==

GET
H2 200 znuTLSmWFHYK68tA6KLh Show response
fpjscdn.net/v3/ 118 KB
41 KB 49ms
10ms Script
text/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fpjscdn.net/v3/znuTLSmWFHYK68tA6KLh

Requested by

Host: a1933.pages.dev
URL: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-112-41.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

fd32495f7f0f19ca017a66c3183c46f067f9537f0d1d3337069d9688094e22af

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://a1933.pages.dev/
Origin: https://a1933.pages.dev
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 09 Jun 2023 08:42:43 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
content-encoding: br
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 545370
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
server: CloudFront
etag: W/"YCtQZf3iqLpD1eKP1r7RbXLXIrU"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3436, s-maxage=602793
x-amz-cf-id: MVxo-OlXRgGHxH4Ns4cNi_vUNn0QzVqpFGN0ZGXoo6Wta4K-2YmFsg==

GET
H2 200 / Show response
use1.fptls.com/ 204 B
331 B 306ms
97ms XHR
text/plain 99.83.173.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://use1.fptls.com/

Requested by

Host: fpjscdn.net
URL: https://fpjscdn.net/v3/znuTLSmWFHYK68tA6KLh

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.83.173.21 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a64bed9ff5004f5b3.awsglobalaccelerator.com

Software

Resource Hash

faa595bf6b4ee359bab3ca18ecdfc90b13b043cb39673b1a8f655d84e74b76bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a1933.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubDomains
cache-control: max-age=2592000, immutable, private
date: Thu, 15 Jun 2023 16:12:13 GMT
content-length: 204
content-type: text/plain; charset=utf-8

POST
H2 403 / Show response
api.fpjs.io/ 282 B
627 B 328ms
120ms XHR
text/plain 76.223.60.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.fpjs.io/?ci=js/3.8.14

Requested by

Host: fpjscdn.net
URL: https://fpjscdn.net/v3/znuTLSmWFHYK68tA6KLh

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.223.60.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a46a250059e296ddb.awsglobalaccelerator.com

Software

nginx/1.22.1 /

Resource Hash

ce8df7e6f1770eabd89de24cc11b1c4cedc36045b87c60dd27b02f1752456c5b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; frame-ancestors 'none'
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://a1933.pages.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 15 Jun 2023 16:12:14 GMT
content-security-policy: default-src 'none'; frame-ancestors 'none'
referrer-policy: no-referrer
strict-transport-security: max-age=63072000
server: nginx/1.22.1
x-content-type-options: nosniff
vary: Origin
x-frame-options: DENY
content-type: text/plain
access-control-allow-origin: https://a1933.pages.dev
access-control-expose-headers: Retry-After
access-control-allow-credentials: true
content-length: 282

POST
H2 200 index.php
golden4deisgn.com/api/ 16 KB
11 KB 2216ms
685ms XHR
text/html 199.79.63.176
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://golden4deisgn.com/api/index.php
Requested by: Host: a1933.pages.dev
URL: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 199.79.63.176 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 199-79-63-176.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Referer: https://a1933.pages.dev/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

access-control-allow-origin: *
date: Thu, 15 Jun 2023 16:12:15 GMT
content-encoding: gzip
server: Apache
content-length: 10732
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 Primary Request %E6%B3%A8%E5%86%8C Show response
a1933.pages.dev/ 6 KB
3 KB 35ms
34ms Document
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

Requested by

Host: a1933.pages.dev
URL: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0776e4a7052c14baeb591cec3ba49a549826a97afcb1e15702372893b096a00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://a1933.pages.dev/%E6%B3%A8%E5%86%8C
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 7d7c17fac82a2be4-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 15 Jun 2023 16:12:16 GMT
etag: W/"448f3da7988395dbd2ec49b3cdb94a2d"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mbPY9Vg9YjwJ8IqRecKxo4D99eP8fTc4FJLqW6I4wUi%2Fc7eouqyDCN1Da6FwMxgTXZUexb%2Bi7Kos09AgenNMMtfJXcTCHkWHubn9WnFD0u7NCP0lr832xB9SNfgx9k6HFCV8HA%2BrOmFvFLiAPZ0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
DATA 200
OK truncated
/ 1023 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 634990d96028ad5f0417e406482eec1c5325cf0dcb738601514a929b1807b70d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 60a046fd6f8c4d5097f12dd4effd486bcf95a6118cbb03bfc174139ecb710f36

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/svg+xml

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.app.link/	1970-01-20 21:19:41	Name: _s Value: %2FXQP%2Ffi0fdgqVe%2Frx1KSdOvCMws0yATV2zFb9HqU61dnBwZn2akQKbUPj046sJYE

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://api.fpjs.io/?ci=js/3.8.14 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0246r.app.link
a1933.pages.dev
api.fpjs.io
fpjscdn.net
golden4deisgn.com
openfpcdn.io
use1.fptls.com
13.32.99.97
18.66.112.41
199.79.63.176
2600:9000:2057:a800:19:9934:6a80:93a1
2a06:98c1:3120::3
76.223.60.10
99.83.173.21
0776e4a7052c14baeb591cec3ba49a549826a97afcb1e15702372893b096a00e
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
60a046fd6f8c4d5097f12dd4effd486bcf95a6118cbb03bfc174139ecb710f36
634990d96028ad5f0417e406482eec1c5325cf0dcb738601514a929b1807b70d
b61fb11f3e2b7bd4a2019e33f1b68cbb2d07e3729cff45edd1b4bf6829b9ec16
ce8df7e6f1770eabd89de24cc11b1c4cedc36045b87c60dd27b02f1752456c5b
faa595bf6b4ee359bab3ca18ecdfc90b13b043cb39673b1a8f655d84e74b76bd
fd32495f7f0f19ca017a66c3183c46f067f9537f0d1d3337069d9688094e22af

a1933.pages.dev Open in urlscan Pro 2a06:98c1:3120::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

7 Requests

100 %HTTPS

29 %IPv6

7 Domains

7 Subdomains

7 IPs

1 Countries

65 kBTransfer

166 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

a1933.pages.dev Open in urlscan Pro
2a06:98c1:3120::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

7
IPs

1
Countries

65 kB
Transfer

166 kB
Size

1
Cookies

7 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!