seeauth.pages.dev
Open in
urlscan Pro
2606:4700:310c::ac42:2f5e
Malicious Activity!
Public Scan
Submission: On January 12 via api from BY — Scanned from DE
Summary
TLS certificate: Issued by E1 on December 12th 2023. Valid for: 3 months.
This is the only time seeauth.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AOL (Online) Yahoo (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:310... 2606:4700:310c::ac42:2f5e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a00:1288:80:... 2a00:1288:80:807::1 | 203220 (YAHOO-DEB) (YAHOO-DEB) | |
3 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:e2:... 2606:4700:e2::ac40:8c0d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 8 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
yimg.com
s.yimg.com — Cisco Umbrella Rank: 876 |
139 KB |
3 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 708 |
89 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1761 |
14 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 395 |
7 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1219 |
24 KB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1888 |
247 KB |
1 |
pages.dev
seeauth.pages.dev |
9 KB |
12 | 7 |
Domain | Requested by | |
---|---|---|
4 | s.yimg.com |
seeauth.pages.dev
s.yimg.com |
3 | ajax.googleapis.com |
seeauth.pages.dev
|
1 | maxcdn.bootstrapcdn.com |
seeauth.pages.dev
|
1 | cdnjs.cloudflare.com |
seeauth.pages.dev
|
1 | code.jquery.com |
seeauth.pages.dev
|
1 | use.fontawesome.com |
seeauth.pages.dev
|
1 | seeauth.pages.dev | |
12 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.aol.com |
help.aol.com |
oidc.www.aol.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
seeauth.pages.dev E1 |
2023-12-12 - 2024-03-11 |
3 months | crt.sh |
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA |
2023-12-12 - 2024-01-31 |
2 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-12-11 - 2024-03-04 |
3 months | crt.sh |
use.fontawesome.com Cloudflare Inc ECC CA-3 |
2023-10-12 - 2024-10-10 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2023-11-30 - 2024-02-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://seeauth.pages.dev/account/create?intl=us&src=fp-us&activity=default&pspid=1197803361&done=https://api.login.aol.com/oauth2/authorize?client_id=dj0yJmk9ZXRrOURhMkt6bkl5JnM9Y29uc3VtZXJzZWNyZXQmc3Y9MCZ4PWQ2&intl=us&nonce=rWqsyMSiH4cJ7UQx3CfQGh07xkvlZWnY&redirect_uri=https://oidc.www.aol.com/callback&response_type=code&scope=mail-r+openid+openid2+sdps-r&src=fp-us&state=eyJhbGciOiJSUzI1NiIsImtpZCI6IjZmZjk0Y2RhZDExZTdjM2FjMDhkYzllYzNjNDQ4NDRiODdlMzY0ZjcifQ.eyJyZWRpcmVjdFVyaSI6Imh0dHBzOi8vd3d3LmFvbC5jb20vIn0.hlDqNBD0JrMZmY2k9lEi6-BfRidXnogtJt8aI-q2FdbvKg9c9EhckG0QVK5frTlhV8HY7Mato7D3ek-Nt078Z_i9Ug0gn53H3vkBoYG-J-SMqJt5MzG34rxdOa92nZlQ7nKaNrAI7K9s72YQchPBn433vFbOGBCkU_ZC_4NXa9E&specId=yidReg
Frame ID: 50336EBA5339F55FD9D5D91EA58778A4
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
AOLDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Popper (Miscellaneous) Expand
Detected patterns
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Help
Search URL Search Domain Scan URL
Title: Continue
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
create
seeauth.pages.dev/account/ |
41 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol-main.css
s.yimg.com/wm/mbr/8b1c40accc6af01dae66620e611ed0b73f1049b5/ |
519 KB 117 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol-logo-black-v.0.0.2.png
s.yimg.com/wm/assets/images/ns/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aol-logo-white-v0.0.4.png
s.yimg.com/wm/assets/images/ybar/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.js
use.fontawesome.com/releases/v5.0.9/js/ |
682 KB 247 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
checkbox-unchecked.svg
s.yimg.com/wm/mbr/images/ |
733 B 987 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AOL (Online) Yahoo (Online)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture string| usertelegram string| token function| $ function| jQuery function| Popper object| bootstrap function| validateEmail object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
maxcdn.bootstrapcdn.com
s.yimg.com
seeauth.pages.dev
use.fontawesome.com
2606:4700:310c::ac42:2f5e
2606:4700::6811:180e
2606:4700::6812:bcf
2606:4700:e2::ac40:8c0d
2a00:1288:80:807::1
2a00:1450:4001:830::200a
2a04:4e42:400::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0fdefe26bac6a6b0b06fe67984582f887af70b7da25d6cb1b401f9074db58338
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
5afb54e55da47a8fe4a4c0af550a51602690aa11fdde5d4ae4c21f13a747e40e
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a28cb0ad1b14424a699fbd02e57f0e707248f1a32892bc312d4fae9a2d5202e1
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b72ffb45ce4245fbfd0e4e0a262a8cdd02ccc262a214622022331dd17057b6c1
c25f3a57f7858de738e2f3cd49ae322e7d02d70484cf7b6dde7de302eb033aa8
d0ecaea4f4b91a678f16b572dbe3c9dc7212d1437a97a31f84ae74c167d5a4db
d2fec0e2942f49dd3cad4650431d550d761f11dded17834d4835768c2ca730c0
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690