jonatalz.top
Open in
urlscan Pro
2606:4700:30::681b:93cc
Malicious Activity!
Public Scan
URL:
https://jonatalz.top/workspace_authentication_process/webmail/index.php
Submission Tags: @ipnigh
Submission: On August 14 via api from GB
Submission Tags: @ipnigh
Submission: On August 14 via api from GB
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 10 HTTP transactions.
The main IP is 2606:4700:30::681b:93cc, located in
United States and
belongs to CLOUDFLARENET - Cloudflare, Inc., US.
The main domain is jonatalz.top.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on August 12th 2019. Valid for: a year.
This is the only time jonatalz.top was scanned on urlscan.io!
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on August 12th 2019. Valid for: a year.
This is the only time jonatalz.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2606:4700:30:... 2606:4700:30::681b:93cc | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 8 | 2.20.21.198 2.20.21.198 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 10 | 3 |
1
2606:4700:30::681b:93cc
(United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| jonatalz.top |
8
2.20.21.198
(Ascension Island)
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-21-198.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-21-198.deploy.static.akamaitechnologies.com
| img1.wsimg.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
wsimg.com
img1.wsimg.com |
221 KB |
| 1 |
jonatalz.top
jonatalz.top |
13 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 10 | 3 |
| Domain | Requested by | |
|---|---|---|
| 8 | img1.wsimg.com |
jonatalz.top
img1.wsimg.com |
| 1 | jonatalz.top | |
| 0 | gui.undefined Failed |
img1.wsimg.com
|
| 10 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.undefined |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-08-12 - 2020-08-11 |
a year | crt.sh |
| *.wsimg.com Starfield Secure Certificate Authority - G2 |
2018-09-25 - 2020-09-25 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://jonatalz.top/workspace_authentication_process/webmail/index.php
Frame ID: B1BD32A327B45D1BD7F6D77E35A24C3B
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
CloudFlare
(CDN)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
URL: https://www.undefined/contact-us.aspx
Title: Contact Us
Title: Contact Us
Search URL Search Domain Scan URL
URL: https://www.undefined/agreements/showdoc.aspx?pageid=PRIVACY&plid=1387
Title: Privacy Policy
Title: Privacy Policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
index.php
jonatalz.top/workspace_authentication_process/webmail/ |
46 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
uxcore-pl.min.css
img1.wsimg.com/ux/1.3.50-brand/css/ |
145 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
bg-pass-reseller.png
img1.wsimg.com/auth/v1/static/1033/img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Boing-Bold.woff2
img1.wsimg.com/ux/fonts/1.4/woff2/ |
28 KB 28 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
uxfont.woff2
img1.wsimg.com/ux/1.3.50-brand/fonts/ |
25 KB 25 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
uxcore.en.min.js
img1.wsimg.com/ux/1.3.50-brand/js/ |
448 KB 138 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
languageheader.min.js
img1.wsimg.com/ux/eldorado/1.5.107/js/ |
13 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
includemarket
gui.undefined/pcjson/support/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.js
img1.wsimg.com/auth/v1/static/852/js/src/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
form.js
img1.wsimg.com/auth/v1/static/852/js/src/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- gui.undefined
- URL
- https://gui.undefined/pcjson/support/includemarket?plid=1387&callback=jQuery183009516734763746193_1565795650199&_=1565795650244
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| ux object| Globals object| translate_dict object| uxel object| _trfq function| fire_virtual_page function| require object| openit function| $ function| jQuery function| _ object| jQuery183009516734763746193 function| jQuery183009516734763746193_15657956501991 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .jonatalz.top/ | Name: __cfduid Value: dbaf8c34fd86527c1c7afbd8622c53b841565795649 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gui.undefined
img1.wsimg.com
jonatalz.top
gui.undefined
2.20.21.198
2606:4700:30::681b:93cc
0e9c92ce3fb08350e36aa2504c2edf3bae82be0168478e03ae5a8ac0f1702bc5
429525935077de20eaff6dce3bfc28f3d0701679975c812f7a85b16f705e7363
49f6c1034e3661e29c5de12d1c97e489565c7d55fec513c2668a57329367e082
4e9eb39bd2d4a943ebc78767969a9b62c5490ae30dff9dc6d29c8f4cd3e4c112
e0a02facc825dc98082553e2314ae636091367d688b3173a3175b58480ad6b87
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fcb6e427c996feb5d62f2eb9e110b32bce66b290ec6026787b2b15edf5c15962