jgyft5r.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://jgyft5r.web.app/
Submission: On October 10 via api (October 10th 2023, 11:34:01 pm UTC) from JP — Scanned from JP

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 21 HTTP transactions. The main IP is 2620:0:890::100, located in United States and belongs to FASTLY, US. The main domain is jgyft5r.web.app.
TLS certificate: Issued by GTS CA 1D4 on September 11th 2023. Valid for: 3 months.

This is the only time jgyft5r.web.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: State Bank of India (Banking)

Domain & IP information

	IP Address	AS Autonomous System
20	2620:0:890::100 2620:0:890::100	54113 (FASTLY) (FASTLY)
1	2606:4700:303... 2606:4700:3033::6815:420f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	2

20 2620:0:890::100 (United States)

ASN54113 (FASTLY, US)

jgyft5r.web.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3033::6815:420f (United States)

ASN13335 (CLOUDFLARENET, US)

dns.niyawz.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	web.app jgyft5r.web.app	302 KB
1	niyawz.online dns.niyawz.online	564 B
21	2

	Domain	Requested by
20	jgyft5r.web.app	jgyft5r.web.app
1	dns.niyawz.online	jgyft5r.web.app
21	2

This site contains no links.

Subject Issuer	Validity	Valid
web.app GTS CA 1D4	`2023-09-11` - `2023-12-10`	3 months	crt.sh
niyawz.online E1	`2023-09-20` - `2023-12-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://jgyft5r.web.app/
Frame ID: 3BC2AE467EC274568BA4F6514FDEADAD
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WeIcomeIy

Page Statistics

21
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

303 kB
Transfer

596 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
jgyft5r.web.app/ 2 KB
972 B 451ms
138ms Document
text/html 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fb4b2ca45080cdc634eeaa2df1f4bd4f5997d871a6433b7726854afa275a4e0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=3600
content-encoding: br
content-length: 609
content-type: text/html; charset=utf-8
date: Tue, 10 Oct 2023 23:33:55 GMT
etag: "7b80058015b527c0ac90d1730c6df565948254d9c373bdcdbc76eba881ad674a-br"
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
strict-transport-security: max-age=31556926; includeSubDomains; preload
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
x-cache-hits: 1
x-served-by: cache-bom4748-BOM
x-timer: S1696980836.840003,VS0,VE1

GET
H2 200 d0dfcb0560db59a8.css
jgyft5r.web.app/_next/static/css/ 226 B
237 B 139ms
137ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/css/d0dfcb0560db59a8.css

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

69a63c47f61edeff7561553a7ead0adf7c2769c64edb8dca44278c9f0eec4e57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:55 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.990139,VS0,VE1
etag: "d11fdb0d6ff1ef663b899a6e26d9b61c0992aa0806bc42b2136011c0e8b53735-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 107
x-cache-hits: 1

GET
H2 200 d0b995f00f428fc2.css
jgyft5r.web.app/_next/static/css/ 7 KB
2 KB 140ms
139ms Stylesheet
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/css/d0b995f00f428fc2.css

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

22919e6aeb9a6659e6c79611915e32536476da58d45745bcb08f5b436693ae9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:55 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.990288,VS0,VE1
etag: "baa09a5cc18a264abf2b9516d516e0bb66ff9559eb77ec2fd949b7019717cade-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1749
x-cache-hits: 1

GET
H2 200 webpack-2555a4296ab7a1b2.js Show response
jgyft5r.web.app/_next/static/chunks/ 2 KB
895 B 141ms
137ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/webpack-2555a4296ab7a1b2.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8548f0e5d0ad9f008612807170927d4e3126c46496c184c05f0fb1ce4b728003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:55 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.996103,VS0,VE1
etag: "479f3a93ac413200a957097694bb163ccff1a7681ca6ee66f9bfedc018bff2c3-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 760
x-cache-hits: 1

GET
H2 200 framework-0c7baedefba6b077.js Show response
jgyft5r.web.app/_next/static/chunks/ 138 KB
39 KB 442ms
437ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/framework-0c7baedefba6b077.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1cd1cca3aebcdd10c33d713a95479909354ddbc5d5ad9761466ac27ea528895d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.997546,VS0,VE285
etag: "28bc0fee6cbe0476cde336c5dc6d92e6d0765bd35fe02778f4d17d2374f0f503-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 39435
x-cache-hits: 0

GET
H2 200 main-2f8a559bf41c5649.js Show response
jgyft5r.web.app/_next/static/chunks/ 112 KB
28 KB 392ms
387ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/main-2f8a559bf41c5649.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1b3688fb6ea6ab464f23bae1057b00bc388b5b5970a87aa7f5742f23631141d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.997936,VS0,VE252
etag: "f4f69b1b53140545fd90f1a6bd056e4f88c73bc90d8d6fa807faf0353c337f0e-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 28470
x-cache-hits: 0

GET
H2 200 _app-83735b03f48df9ad.js Show response
jgyft5r.web.app/_next/static/chunks/pages/ 520 B
395 B 142ms
138ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/pages/_app-83735b03f48df9ad.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

db9a9b9fb0b267813e3b439dea35f31bc0cc472d1d2ad6b579ab9ffd1d77103a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:55 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.997917,VS0,VE1
etag: "863926f5d3f194fd2afe225d88d7ac7977fbb2f9fe1fa8f7e4345260dea0a3aa-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 283
x-cache-hits: 1

GET
H2 200 345-06903d3df5375bbe.js Show response
jgyft5r.web.app/_next/static/chunks/ 10 KB
4 KB 143ms
139ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/345-06903d3df5375bbe.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

cf669fb2b760a389b00c421e75ea8347ecc715af19bd09babbf30272c7722415

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:55 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.998174,VS0,VE1
etag: "a346e209e2c1a72558554c49096f6b08827423e69c94bb372455fdc793977261-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3561
x-cache-hits: 1

GET
H2 200 index-8af2e18ab9795a1d.js Show response
jgyft5r.web.app/_next/static/chunks/pages/ 18 KB
6 KB 313ms
310ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/pages/index-8af2e18ab9795a1d.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

49ece970f9a579df5d562511bd3636f8bb3e36554998466ce1cd16a4b2bc7c9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.998489,VS0,VE174
etag: "c919937b8520507bdbfdef3ad0351cb5c5c24a2bbff6170e732af9a0fdc83534-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5708
x-cache-hits: 0

GET
H2 200 _buildManifest.js Show response
jgyft5r.web.app/_next/static/LPw06nI0pvjEmY89UK_VK/ 1 KB
665 B 269ms
266ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/LPw06nI0pvjEmY89UK_VK/_buildManifest.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2476e843c4eb26f0434fbe2f9627b1d028c96201a9e7d171489cb2b3e4283d44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.998888,VS0,VE129
etag: "fbc9ce57c82c1d2e0d24b6a8bafe1471bfe1a11327c63ef99aedc6292c31eeda-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 515
x-cache-hits: 0

GET
H2 200 _ssgManifest.js Show response
jgyft5r.web.app/_next/static/LPw06nI0pvjEmY89UK_VK/ 77 B
176 B 275ms
272ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/LPw06nI0pvjEmY89UK_VK/_ssgManifest.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

Referer: https://jgyft5r.web.app/
Origin: https://jgyft5r.web.app
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4748-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: gzip
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.998871,VS0,VE135
etag: "f73bbe5888d285cbab0ee19990a0d9db0b352fa3dfd30959d64a2bc66422d35c"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 61
x-cache-hits: 0

GET
H3 200 vrtppwlsxp.gif
jgyft5r.web.app/ 105 KB
90 KB 139ms
138ms Image
image/gif 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jgyft5r.web.app/vrtppwlsxp.gif

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d4b2102918440b431e5ac116b43cb29fc2da5fbe6e427ea4cd03e624d4e54347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980836.143068,VS0,VE1
etag: "2f86fbf00220bf63df2db190fd9a5146a78f272a45c4eadeb69a549c5c95ed49-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/gif
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 91502
x-cache-hits: 1

GET
H3 200 354-4e020a05081b574c.js Show response
jgyft5r.web.app/_next/static/chunks/ 52 KB
15 KB 139ms
139ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/354-4e020a05081b574c.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/_next/static/chunks/main-2f8a559bf41c5649.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d475792eb994ab10747563a804164114f676511cda598b21343da540e3d1e826

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980837.585660,VS0,VE1
etag: "e11fcd2e2eaec0c02bbd36aec86967ca2c519fd4945a66411975deb1fa7fc0f0-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 14636
x-cache-hits: 1

GET
H3 200 nymvwklfxw-9ce49d8986ef419e.js Show response
jgyft5r.web.app/_next/static/chunks/pages/ 15 KB
5 KB 347ms
347ms Script
text/javascript 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/chunks/pages/nymvwklfxw-9ce49d8986ef419e.js

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/_next/static/chunks/main-2f8a559bf41c5649.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5454926a5d98a6e62558621d6832be6c10e5a61519f014cd5f73c2c52b5c2ce5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980837.585971,VS0,VE210
etag: "1c7e642e9b52cc509ab398f3b143feb6b622b10624d13ab4796e6c07d29e38ae-br"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 4746
x-cache-hits: 0

GET
H3 200 d0b995f00f428fc2.css Show response
jgyft5r.web.app/_next/static/css/ 7 KB
2 KB 142ms
142ms Fetch
text/css 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/_next/static/css/d0b995f00f428fc2.css

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/_next/static/chunks/main-2f8a559bf41c5649.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

22919e6aeb9a6659e6c79611915e32536476da58d45745bcb08f5b436693ae9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980837.585968,VS0,VE1
etag: "baa09a5cc18a264abf2b9516d516e0bb66ff9559eb77ec2fd949b7019717cade-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: text/css; charset=utf-8
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1749
x-cache-hits: 1

GET
H3 200 tmjlogazlt.json Show response
jgyft5r.web.app/ 3 KB
1 KB 137ms
137ms Fetch
application/json 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://jgyft5r.web.app/tmjlogazlt.json

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/_next/static/chunks/pages/nymvwklfxw-9ce49d8986ef419e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

32e4b7e76d04571cad1b49afeb0f19e7a7b2948d7b15a95c90534fe97d42bd65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/nymvwklfxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980837.942212,VS0,VE1
etag: "28cf5a3c492995772e4f0eeb0a2f637517f3a3dac11e8849418a6c552ef8099f-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: application/json
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1096
x-cache-hits: 1

GET
H2 200 csrf Show response
dns.niyawz.online/ 18 B
564 B 638ms
610ms Fetch
application/json 2606:4700:3033::6815:420f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dns.niyawz.online/csrf

Requested by

Host: jgyft5r.web.app
URL: https://jgyft5r.web.app/_next/static/chunks/pages/nymvwklfxw-9ce49d8986ef419e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:420f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

90e22bda5ac09781c6a0641a0e37842219e5875c00a9766fd3c64acba61e5d10

Security Headers

Name	Value
Content-Security-Policy	default-src: *'

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 23:33:57 GMT
content-security-policy: default-src: *'
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/json
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1CopEqy1Fq%2FU0uZUSZORcNTRnI%2Fk5N%2BwTC46f%2BxTmyXgZvIwrEKNUPPtzdxFyLOFHM8fK1IMGQpEXd5C%2BdT1ywvPdaYhmwmS37AUif7OaZH%2Ffjh3LESVWPKcSOXO2TfxvdPl5zZ6368O7Vphhh9A%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8142abd69f49f6f2-NRT
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400

GET
H3 200 vrtppwlsxp.gif
jgyft5r.web.app/ 105 KB
90 KB 136ms
136ms Image
image/gif 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jgyft5r.web.app/vrtppwlsxp.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d4b2102918440b431e5ac116b43cb29fc2da5fbe6e427ea4cd03e624d4e54347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/nymvwklfxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
content-encoding: br
date: Tue, 10 Oct 2023 23:33:56 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980837.953667,VS0,VE0
etag: "2f86fbf00220bf63df2db190fd9a5146a78f272a45c4eadeb69a549c5c95ed49-br"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/gif
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 91502
x-cache-hits: 2

GET
H3 200 lbgpietmnu.png
jgyft5r.web.app/ 9 KB
9 KB 506ms
506ms Image
image/png 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jgyft5r.web.app/lbgpietmnu.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

18d88c6fb86e31d9715e71ff60570abfb768363d7670cb84737a0474d2f5913a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/nymvwklfxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Tue, 10 Oct 2023 23:33:57 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980837.090160,VS0,VE268
etag: "ab4304a95a179817024d0427735ca55552a0eb0abc66b00f86f9cc9810a4cb06"
vary: x-fh-requested-host, accept-encoding
x-cache: MISS
content-type: image/png
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 8918
x-cache-hits: 0

GET
H3 200 vulxshxmam.png
jgyft5r.web.app/ 7 KB
8 KB 630ms
137ms Image
image/png 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jgyft5r.web.app/vulxshxmam.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4001c31e7a271b9c5ecbcd6c44fdf85c15f9380835ddd88f7b8fcc4f3f71f393

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/nymvwklfxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Tue, 10 Oct 2023 23:33:57 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980838.582695,VS0,VE1
etag: "06b165c9ab4b7220c840d3a8fadfb0d3d2b4d53d3be75251e445b353cefd06cd"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/png
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7575
x-cache-hits: 1

GET
H3 200 nlgijidvwj.png
jgyft5r.web.app/ 2 KB
2 KB 631ms
137ms Image
image/png 2620:0:890::100
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jgyft5r.web.app/nlgijidvwj.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2620:0:890::100 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a0fbb2f835713a0319bc2e5b516fc9005ab3856dcb374244adbfaeb9bee345e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://jgyft5r.web.app/nymvwklfxw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

x-served-by: cache-bom4733-BOM
strict-transport-security: max-age=31556926; includeSubDomains; preload
date: Tue, 10 Oct 2023 23:33:57 GMT
last-modified: Mon, 09 Oct 2023 02:57:09 GMT
x-timer: S1696980838.583097,VS0,VE1
etag: "137139155838082a18643c270af1511140c243509d25cf17b187bd66530265d0"
vary: x-fh-requested-host, accept-encoding
x-cache: HIT
content-type: image/png
cache-control: max-age=3600
accept-ranges: bytes
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1755
x-cache-hits: 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: State Bank of India (Banking)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dns.niyawz.online
jgyft5r.web.app
2606:4700:3033::6815:420f
2620:0:890::100
18d88c6fb86e31d9715e71ff60570abfb768363d7670cb84737a0474d2f5913a
1b3688fb6ea6ab464f23bae1057b00bc388b5b5970a87aa7f5742f23631141d1
1cd1cca3aebcdd10c33d713a95479909354ddbc5d5ad9761466ac27ea528895d
22919e6aeb9a6659e6c79611915e32536476da58d45745bcb08f5b436693ae9f
2476e843c4eb26f0434fbe2f9627b1d028c96201a9e7d171489cb2b3e4283d44
32e4b7e76d04571cad1b49afeb0f19e7a7b2948d7b15a95c90534fe97d42bd65
4001c31e7a271b9c5ecbcd6c44fdf85c15f9380835ddd88f7b8fcc4f3f71f393
49ece970f9a579df5d562511bd3636f8bb3e36554998466ce1cd16a4b2bc7c9b
5454926a5d98a6e62558621d6832be6c10e5a61519f014cd5f73c2c52b5c2ce5
69a63c47f61edeff7561553a7ead0adf7c2769c64edb8dca44278c9f0eec4e57
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
8548f0e5d0ad9f008612807170927d4e3126c46496c184c05f0fb1ce4b728003
90e22bda5ac09781c6a0641a0e37842219e5875c00a9766fd3c64acba61e5d10
a0fbb2f835713a0319bc2e5b516fc9005ab3856dcb374244adbfaeb9bee345e1
cf669fb2b760a389b00c421e75ea8347ecc715af19bd09babbf30272c7722415
d475792eb994ab10747563a804164114f676511cda598b21343da540e3d1e826
d4b2102918440b431e5ac116b43cb29fc2da5fbe6e427ea4cd03e624d4e54347
db9a9b9fb0b267813e3b439dea35f31bc0cc472d1d2ad6b579ab9ffd1d77103a
fb4b2ca45080cdc634eeaa2df1f4bd4f5997d871a6433b7726854afa275a4e0a

jgyft5r.web.app Open in urlscan Pro 2620:0:890::100 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

21 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

303 kBTransfer

596 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

jgyft5r.web.app Open in urlscan Pro
2620:0:890::100 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

303 kB
Transfer

596 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!