www.be-104.xyz
Open in
urlscan Pro
2606:4700:3031::6815:4e30
Malicious Activity!
Public Scan
Submission: On November 08 via manual from US — Scanned from JP
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 7th 2021. Valid for: a year.
This is the only time www.be-104.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2606:4700:303... 2606:4700:3031::6815:4e30 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a01:4f8:c0c:... 2a01:4f8:c0c:ebaa::1 | 24940 (HETZNER-AS) (HETZNER-AS) | |
2 | 2404:6800:400... 2404:6800:4004:80b::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2404:6800:400... 2404:6800:4004:824::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.229.179.87 192.229.179.87 | 15133 (EDGECAST) (EDGECAST) | |
2 | 2404:6800:400... 2404:6800:4004:808::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2404:6800:400... 2404:6800:4008:c04::9c | 15169 (GOOGLE) (GOOGLE) | |
14 | 9 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
be-104.xyz
www.be-104.xyz |
75 KB |
2 |
google-analytics.com
www.google-analytics.com |
20 KB |
2 |
googletagmanager.com
www.googletagmanager.com |
72 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
439 B |
1 |
w3schools.com
www.w3schools.com |
14 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com |
27 KB |
1 |
googleapis.com
ajax.googleapis.com |
34 KB |
1 |
eviltrap.site
eviltrap.site |
|
14 | 8 |
Domain | Requested by | |
---|---|---|
5 | www.be-104.xyz |
www.be-104.xyz
|
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
2 | www.googletagmanager.com |
www.be-104.xyz
www.googletagmanager.com |
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.w3schools.com | |
1 | cdnjs.cloudflare.com |
www.be-104.xyz
|
1 | ajax.googleapis.com |
www.be-104.xyz
|
1 | eviltrap.site |
www.be-104.xyz
|
14 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-06-07 - 2022-06-06 |
a year | crt.sh |
eviltrap.site R3 |
2021-11-04 - 2022-02-02 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
*.w3schools.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-04-27 - 2022-05-02 |
a year | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-10-18 - 2022-01-10 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.be-104.xyz/a20287/20211108/jp/jp3/static/chrome.php
Frame ID: B172DF72F6E36B08922E322BB33158FE
Requests: 14 HTTP requests in this frame
Frame:
https://eviltrap.site/trap/download-dialog-dos/
Frame ID: E5F71470DE115559D3CB70F4A844B959
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
chrome.php
www.be-104.xyz/a20287/20211108/jp/jp3/static/ |
22 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
defender.png
www.be-104.xyz/a20287/20211108/jp/jp3/static/files/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
rocket-loader.min.js
www.be-104.xyz/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
song.mp3
www.be-104.xyz/a20287/20211108/jp/jp3/static/ |
49 KB 50 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
japan.mp3
www.be-104.xyz/a20287/20211108/jp/jp3/static/ |
101 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
eviltrap.site/trap/download-dialog-dos/ Frame E5F7 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
467 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
90 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.2/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ |
82 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
horse.ogg
www.w3schools.com/tags/ |
14 KB 14 KB |
Media
video/ogg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
90 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/j/ |
2 B 207 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 439 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| __cfQR function| $ function| jQuery object| _0x4797 function| gtag object| dataLayer object| _0xf4d2 string| stroka string| urrl object| _0x5759 function| openBrowser function| toggleFullScreen object| _0x2bf1 object| _0x2290 object| _0x80f8 object| _0xda4c object| _0x4b34 function| makeNewPosition function| animateDiv function| calcSpeed object| _0xc711 function| nocontextmenu function| norightclick object| _0x96ec string| params object| _0xa5f6 function| confirmExit function| fullscreen function| registerEventListeners boolean| __cfRLUnblockHandlers object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.be-104.xyz/ | Name: _ga Value: GA1.2.1735715391.1636379011 |
|
.be-104.xyz/ | Name: _gid Value: GA1.2.918483969.1636379011 |
|
.be-104.xyz/ | Name: _gat_gtag_UA_149868268_2 Value: 1 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
eviltrap.site
stats.g.doubleclick.net
www.be-104.xyz
www.google-analytics.com
www.googletagmanager.com
www.w3schools.com
192.229.179.87
2404:6800:4004:808::200e
2404:6800:4004:80b::2008
2404:6800:4004:824::200a
2404:6800:4008:c04::9c
2606:4700:3031::6815:4e30
2606:4700::6810:135e
2a01:4f8:c0c:ebaa::1
0d0e13e1d5d88f434c1ba91f3e81d6f3b959a349848970b6469820cdfddbc4b6
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
534005da6673059024215f36a4cab983faa7041190223bba39edd845f9445bc1
59b1b0e0dda3abbfdedb60f066d9532cb91c60ee15ff1ebebae04eecb7305101
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7ce2ae13d717596ff63a6d0694e87f94d96246a2d5fa7d8d153fb17af7d0d42d
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
a64cea11f0b36764f64b50abbb7d143e7a00e8b035226ee9b3f614b7ec68ffe3
adfb86dccf830bfa77ac2c9393d198324dd2bb9a69c8151a0946e59c5b39617a
bb973f31411bc8ea2a49f265ff6ef5220f3dc3d1f700a0241eb5319d678819e8
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62