taengball.co Open in urlscan Pro
2606:4700:3034::ac43:ab1a Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://taengball.co/$/apdf/view.php?email=
Submission: On June 03 via automatic, source openphish (June 3rd 2020, 12:34:34 am UTC)

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3034::ac43:ab1a, located in United States and belongs to CLOUDFLARENET, US. The main domain is taengball.co.

This is the only time taengball.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
8	2606:4700:303... 2606:4700:3034::ac43:ab1a		13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	1

8 2606:4700:3034::ac43:ab1a (United States)

ASN13335 (CLOUDFLARENET, US)

taengball.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	taengball.co taengball.co	214 KB
8	1

	Domain	Requested by
8	taengball.co	taengball.co
8	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://taengball.co/$/apdf/view.php?email=
Frame ID: 9482992353C939AD0ED23663B4D757EA
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

8
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

214 kB
Transfer

396 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set view.php Show response taengball.co/$/apdf/	5 KB 2 KB	690ms 666ms	Document text/html	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `73d5802bb3882bd1a8732d68ff19a0210e4456b651a14730de0a848b3121cb91` Request headers Host taengball.co Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d4d226f8cbdea659963fcf25e654ff8701591144422; expires=Fri, 03-Jul-20 00:33:42 GMT; path=/; domain=.taengball.co; HttpOnly; SameSite=Lax Vary Accept-Encoding,User-Agent CF-Cache-Status DYNAMIC cf-request-id 031932362e0000062dfb3e4200000001 Server cloudflare CF-RAY 59d553037a38062d-FRA Content-Encoding gzip
GET H/1.1	200 OK	bootstrap.min.css taengball.co/$/apdf/files/	118 KB 20 KB	10ms 10ms	Stylesheet text/css	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://taengball.co/$/apdf/files/bootstrap.min.css Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `61c23502ff4c86909ed9c218124f2fc3312868e35d62532b7e26d08d345bf4fc` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2517 ETag W/"5ed58df3-1d96f" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 59d55307a9f1062d-FRA cf-request-id 03193238cc0000062dfb000200000001
GET H/1.1	200 OK	jquery.min.js Show response taengball.co/$/apdf/files/	85 KB 30 KB	18ms 12ms	Script application/javascript	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://taengball.co/$/apdf/files/jquery.min.js Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2392 ETag W/"5ed58df3-15283" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 59d55307ba97d6bd-FRA cf-request-id 03193238d10000d6bd3c88e200000001
GET H/1.1	200 OK	bootstrap.min.js Show response taengball.co/$/apdf/files/	36 KB 10 KB	19ms 13ms	Script application/javascript	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://taengball.co/$/apdf/files/bootstrap.min.js Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2398 ETag W/"5ed58df3-90b5" Vary Accept-Encoding Content-Type application/javascript Cache-Control max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 59d55307bc581f51-FRA cf-request-id 03193238d100001f5132242200000001
GET H/1.1	200 OK	logo.jpg taengball.co/$/apdf/files/	48 KB 48 KB	13ms 13ms	Image image/jpeg	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://taengball.co/$/apdf/files/logo.jpg Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `15376a8c2c600eb1b8540675810ef7cdbcaf862bb0f95beec18a4752dd621542` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2513 ETag "5ed58df3-be33" Vary Accept-Encoding Content-Type image/jpeg Cache-Control max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 59d55307dc841f51-FRA Content-Length 48691 cf-request-id 03193238e300001f5132243200000001
GET H/1.1	200 OK	favicon.png taengball.co/$/apdf/files/	2 KB 3 KB	11ms 10ms	Image image/png	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://taengball.co/$/apdf/files/favicon.png Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `577fe7b23b3663e2cdd2b57d7bb849558097e1c025405ba95b289f18b20d832a` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2513 ETag "5ed58df3-9f2" Vary Accept-Encoding Content-Type image/png Cache-Control max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 59d55307dabcd6bd-FRA Content-Length 2546 cf-request-id 03193238e20000d6bd3c88f200000001
GET H/1.1	200 OK	footer.png taengball.co/$/apdf/files/	4 KB 4 KB	11ms 11ms	Image image/png	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://taengball.co/$/apdf/files/footer.png Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `45b184735aabdf9b87d5712ba0b0ed0a4b38045fd99f03e5a7caec65f039abad` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2512 ETag "5ed58df3-ea2" Vary Accept-Encoding Content-Type image/png Cache-Control max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 59d55307ecae1f51-FRA Content-Length 3746 cf-request-id 03193238ef00001f5132246200000001
GET H/1.1	200 OK	background.jpg taengball.co/$/apdf/files/	98 KB 98 KB	10ms 9ms	Image image/jpeg	2606:4700:3034::ac43:ab1a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://taengball.co/$/apdf/files/background.jpg Requested by Host: taengball.co URL: http://taengball.co/$/apdf/view.php?email= Protocol HTTP/1.1 Server 2606:4700:3034::ac43:ab1a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `fc833d925ec2b6e359a581787185194bca173e3085ed86399ce452003cdfb6f2` Request headers Referer http://taengball.co/$/apdf/view.php?email= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Wed, 03 Jun 2020 00:33:43 GMT CF-Cache-Status HIT Last-Modified Mon, 01 Jun 2020 23:23:31 GMT Server cloudflare Age 2394 ETag "5ed58df3-18691" Vary Accept-Encoding Content-Type image/jpeg Cache-Control max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 59d55307eadcd6bd-FRA Content-Length 99985 cf-request-id 03193238f20000d6bd3c890200000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.taengball.co/	1970-01-19 10:42:16	Name: __cfduid Value: d4d226f8cbdea659963fcf25e654ff8701591144422

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

taengball.co
2606:4700:3034::ac43:ab1a
15376a8c2c600eb1b8540675810ef7cdbcaf862bb0f95beec18a4752dd621542
45b184735aabdf9b87d5712ba0b0ed0a4b38045fd99f03e5a7caec65f039abad
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
577fe7b23b3663e2cdd2b57d7bb849558097e1c025405ba95b289f18b20d832a
61c23502ff4c86909ed9c218124f2fc3312868e35d62532b7e26d08d345bf4fc
73d5802bb3882bd1a8732d68ff19a0210e4456b651a14730de0a848b3121cb91
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
fc833d925ec2b6e359a581787185194bca173e3085ed86399ce452003cdfb6f2

taengball.co Open in urlscan Pro 2606:4700:3034::ac43:ab1a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

214 kBTransfer

396 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

taengball.co Open in urlscan Pro
2606:4700:3034::ac43:ab1a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

214 kB
Transfer

396 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!