anonblacksec.com Open in urlscan Pro
194.163.142.38 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9
Effective URL:
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd...
Submission: On January 27 via manual (January 27th 2022, 1:50:04 pm UTC) from IN — Scanned from DE

Summary HTTP 4 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 194.163.142.38, located in Düsseldorf, Germany and belongs to CONTABO, DE. The main domain is anonblacksec.com.
TLS certificate: Issued by R3 on November 30th 2021. Valid for: 3 months.

This is the only time anonblacksec.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 4	194.163.142.38 194.163.142.38	51167 (CONTABO) (CONTABO)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b	63949 (LINODE-AP...) (LINODE-AP Linode)
4	4

4 194.163.142.38 (Düsseldorf, Germany) 2 redirects

ASN51167 (CONTABO, DE)
PTR: server.superfastcloudhosting.com

anonblacksec.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:3c01::f03c:91ff:fe79:43b (Fremont, United States)

ASN63949 (LINODE-AP Linode, LLC, US)

jsonip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	anonblacksec.com 2 redirects anonblacksec.com	31 KB
1	jsonip.com jsonip.com — Cisco Umbrella Rank: 26087	470 B
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 227	64 KB
4	3

	Domain	Requested by
4	anonblacksec.com	2 redirects
1	jsonip.com	cdnjs.cloudflare.com
1	cdnjs.cloudflare.com	anonblacksec.com
4	3

This site contains no links.

Subject Issuer	Validity	Valid
*.anonblacksec.com R3	`2021-11-30` - `2022-02-28`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
jsonip.com R3	`2021-12-23` - `2022-03-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea
Frame ID: A1FE2E36209BA917B6659E0821B084BA
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in

Page URL History Show full URLs

https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9 HTTP 301
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/ HTTP 303
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/r.php?signin=d41d8cd98f00b204e9800998e... Page URL
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

95 kB
Transfer

349 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9 HTTP 301
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/ HTTP 303
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea Page URL
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9 HTTP 301
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/ HTTP 303
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea

4 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3-Q050

200

r.php Show response
anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/
Redirect Chain

https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/
https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea

222 B
1 KB

38ms
37ms

Document
text/html

194.163.142.38
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

194.163.142.38 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

server.superfastcloudhosting.com

Software

/ anonblacksec.com

Resource Hash

25e05fd0216db5dca922ce505651f74e1fd5b21f54614e3243560afdd0af6345

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Security-Policy	img-src * data:
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

x-powered-by: anonblacksec.com
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 174
content-encoding: br
vary: Accept-Encoding
date: Thu, 27 Jan 2022 13:50:00 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=7776000, enforce
access-control-allow-origin: null
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-headers: Content-Type, Authorization
x-content-security-policy: img-src * data:
content-security-policy: upgrade-insecure-requests
cross-origin-embedder-policy-report-only: unsafe-none; report-to="default"
cross-origin-embedder-policy: unsafe-none; report-to="default"
cross-origin-opener-policy-report-only: same-origin; report-to="default"
cross-origin-opener-policy: same-origin; report-to="default"
cross-origin-resource-policy: cross-origin
strict-dynamic: https: 'self'; default-src 'self'
x-frame-options: SAMEORIGIN
permissions-policy: geolocation=(), microphone=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=()

Redirect headers

x-powered-by: anonblacksec.com
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
location: ./r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea
content-type: text/html; charset=UTF-8
content-length: 0
date: Thu, 27 Jan 2022 13:50:00 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=7776000, enforce
access-control-allow-origin: null
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-headers: Content-Type, Authorization
x-content-security-policy: img-src * data:
content-security-policy: upgrade-insecure-requests
cross-origin-embedder-policy-report-only: unsafe-none; report-to="default"
cross-origin-embedder-policy: unsafe-none; report-to="default"
cross-origin-opener-policy-report-only: same-origin; report-to="default"
cross-origin-opener-policy: same-origin; report-to="default"
cross-origin-resource-policy: cross-origin
strict-dynamic: https: 'self'; default-src 'self'
x-frame-options: SAMEORIGIN
permissions-policy: geolocation=(), microphone=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=()

GET
H3-Q050 200 Primary Request / Show response
anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/ 54 KB
29 KB 43ms
42ms Document
text/html 194.163.142.38
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL

https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

194.163.142.38 Düsseldorf, Germany, ASN51167 (CONTABO, DE),

Reverse DNS

server.superfastcloudhosting.com

Software

/ anonblacksec.com

Resource Hash

ea965bf1b703d835285c04e1c500ab307a99a210a7526207483ed04b84252858

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Security-Policy	img-src * data:
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea

Response headers

x-powered-by: anonblacksec.com
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
content-length: 29559
content-encoding: br
vary: Accept-Encoding
date: Thu, 27 Jan 2022 13:50:00 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
expect-ct: max-age=7776000, enforce
access-control-allow-origin: null
access-control-allow-methods: GET,PUT,POST,DELETE
access-control-allow-headers: Content-Type, Authorization
x-content-security-policy: img-src * data:
content-security-policy: upgrade-insecure-requests
cross-origin-embedder-policy-report-only: unsafe-none; report-to="default"
cross-origin-embedder-policy: unsafe-none; report-to="default"
cross-origin-opener-policy-report-only: same-origin; report-to="default"
cross-origin-opener-policy: same-origin; report-to="default"
cross-origin-resource-policy: cross-origin
strict-dynamic: https: 'self'; default-src 'self'
x-frame-options: SAMEORIGIN
permissions-policy: geolocation=(), microphone=(), accelerometer=(), gyroscope=(), magnetometer=(), interest-cohort=()

GET
H2 200 jquery.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ 257 KB
64 KB 85ms
32ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Requested by

Host: anonblacksec.com
URL: https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 27 Jan 2022 13:50:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 193782
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 64997
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-40464"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8R4rUzW2I%2FKu5xfHBLNZNExdNhrQcQx30OsiSm5ZoCP1GBTTgmeU2I4BhDvDofUogjIqOVvH0CuFt9aaW%2BSr29ItzCo8bgzO%2BPi2eJ39aD9lMZErs7yHR7dBLydyHRn11IOs7HG7GSSRaCbtHfqS6T24"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6d427295ac5e90b5-FRA
expires: Tue, 17 Jan 2023 13:50:00 GMT

GET
DATA 200
OK truncated
/ 17 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a5325de78333bec4ed2ebee5881915f50a8d4bd1ee410699eca21721ca7a0ec4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK / Show response
jsonip.com/ 169 B
470 B 532ms
175ms Script
application/json 2600:3c01::f03c:91ff:fe79:43b
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://jsonip.com/?callback=jQuery300023892495718349527_1643291400636&_=1643291400637

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/jquery.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:3c01::f03c:91ff:fe79:43b Fremont, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx/1.20.1 /

Resource Hash

1229332f7a5b0517cc94b543b81c29d3838b98824952fcc2d3e44b62cfcc07a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=cb56c3c9cd21cabc65db493850db6d48060fcd330369670efe367f4e45f78dff805d4cea
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Thu, 27 Jan 2022 13:50:01 GMT
Server: nginx/1.20.1
Strict-Transport-Security: max-age=31536000;
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive

GET
DATA 200
OK truncated
/ 7 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2974582870978ef39a55c0ecc4f54e75c70be369ee6bc5b2f4b3573d917e9ed2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc75475b34552fc6bee06461fd821665b7f17738d982768dc79a5a41aa0b5cca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7dfdb9bd44248a6dbf66b09b7ce71066b8486a3200dc8fd783799e1d66fd3e43

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| getIPAddress string| x

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			anonblacksec.com/wwpp44/eCcXRVFyWZTEo5r4rE7eLFRJDZ7BL9/s	1969-12-31 23:59:59	Name: ip11 Value: 2001:1b60:1010:2:1011:b8cb:310a:5004
			anonblacksec.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 698264174f416994c70cf5f420bcf3a1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'interest-cohort'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Security-Policy	img-src * data:
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

anonblacksec.com
cdnjs.cloudflare.com
jsonip.com
194.163.142.38
2600:3c01::f03c:91ff:fe79:43b
2606:4700::6810:125e
1229332f7a5b0517cc94b543b81c29d3838b98824952fcc2d3e44b62cfcc07a2
25e05fd0216db5dca922ce505651f74e1fd5b21f54614e3243560afdd0af6345
2974582870978ef39a55c0ecc4f54e75c70be369ee6bc5b2f4b3573d917e9ed2
7dfdb9bd44248a6dbf66b09b7ce71066b8486a3200dc8fd783799e1d66fd3e43
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
a5325de78333bec4ed2ebee5881915f50a8d4bd1ee410699eca21721ca7a0ec4
bc75475b34552fc6bee06461fd821665b7f17738d982768dc79a5a41aa0b5cca
ea965bf1b703d835285c04e1c500ab307a99a210a7526207483ed04b84252858

anonblacksec.com Open in urlscan Pro 194.163.142.38 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

95 kBTransfer

349 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

2 Cookies

2 Console Messages

Security Headers

Indicators

anonblacksec.com Open in urlscan Pro
194.163.142.38 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

95 kB
Transfer

349 kB
Size

2
Cookies

4 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!