ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app
Open in
urlscan Pro
2604:1380:4601:6205:5000:64ff:fe6d:c8c2
Malicious Activity!
Public Scan
Submission: On August 22 via api from CH — Scanned from NL
Summary
TLS certificate: Issued by R3 on July 12th 2022. Valid for: 3 months.
This is the only time ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
18 | 2604:1380:460... 2604:1380:4601:6205:5000:64ff:fe6d:c8c2 | 54825 (PACKET) (PACKET) | |
2 | 99.86.240.61 99.86.240.61 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2606:4700::68... 2606:4700::6812:512 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 118.31.251.153 118.31.251.153 | 37963 (ALIBABA-C...) (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.) | |
23 | 5 |
ASN54825 (PACKET, US)
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app |
ASN16509 (AMAZON-02, US)
PTR: server-99-86-240-61.vie50.r.cloudfront.net
app.openlogin.com |
ASN37963 (ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.,Ltd., CN)
cdn.dcloud.net.cn |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
ic0.app
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app |
2 MB |
2 |
internetcomputer.org
rosetta-api.internetcomputer.org |
174 B |
2 |
openlogin.com
app.openlogin.com |
3 KB |
1 |
dcloud.net.cn
cdn.dcloud.net.cn — Cisco Umbrella Rank: 84865 |
579 B |
23 | 4 |
Domain | Requested by | |
---|---|---|
18 | ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app |
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app
|
2 | rosetta-api.internetcomputer.org |
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app
|
2 | app.openlogin.com |
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app
|
1 | cdn.dcloud.net.cn |
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app
|
23 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
boundary.dfinity.network R3 |
2022-07-12 - 2022-10-10 |
3 months | crt.sh |
*.openlogin.com Amazon |
2022-01-12 - 2023-02-10 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-26 - 2023-06-26 |
a year | crt.sh |
*.dcloud.net.cn Certum Domain Validation CA SHA2 |
2022-07-21 - 2023-08-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/
Frame ID: 83DDA538E5A8B20115E18BB64F40F54B
Requests: 23 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/ |
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.f4fc78fe.css
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/ |
93 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.88a0642f.chunk.css
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/css/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.e2234df2.chunk.js
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/js/ |
2 MB 503 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.ba4ebb74.chunk.js
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/js/ |
46 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.9485da95.js
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/js/ |
670 KB 209 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.15599aec.js
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/js/ |
66 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
start
app.openlogin.com/ |
0 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk-modal
app.openlogin.com/ |
0 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
list
rosetta-api.internetcomputer.org/network/ |
93 B 174 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages-index-index~pages-login-login~pages-newpages-index.9807bb37.js
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/js/ |
35 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pages-login-login.3154ca6e.js
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/js/ |
25 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-latin-400-normal.4673b453.woff2
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/media/ |
15 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
list
rosetta-api.internetcomputer.org/network/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg1.b4139508.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zeeplin.2bbc5f58.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
16 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dfinitylogo.d8f93b4e.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
23 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
youtube.4396437d.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
12 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
twitter.fe7f6df2.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
15 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
medium.457bd8d3.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
13 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
facebook.2b54b7b3.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
16 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
telegram.14a9fed4.png
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app/static/img/ |
18 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shadow-grey.png
cdn.dcloud.net.cn/img/ |
136 B 579 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation boolean| coverSupport function| SharedArrayBuffer object| webpackJsonpstoic-wallet number| 2f1acc6c3a606b082e5eef5e54414ffb function| setImmediate function| clearImmediate object| regeneratorRuntime object| tweetnacl object| ellipticcurve function| getid function| initlogin function| transfer function| getaddress object| webpackJsonp object| __uniConfig object| __uniRoutes function| UniApp object| UniViewJSBridge object| UniServiceJSBridge object| uni object| wx function| getApp function| getCurrentPages1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.dcloud.net.cn/ | Name: __uni__uid Value: CgEB82MDzEA58kF3TCZzAg== |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
app.openlogin.com
cdn.dcloud.net.cn
ggvxq-2aaaa-aaaah-qacoa-cai.raw.ic0.app
rosetta-api.internetcomputer.org
118.31.251.153
2604:1380:4601:6205:5000:64ff:fe6d:c8c2
2606:4700::6812:512
99.86.240.61
030c6cd811771581c1fe5d5ecc9b5de04ae62ebc0251417d31bf0b3ba504293a
0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3
15ed040cead5b78fbe6ba92bf4469ba3cd9f7bbe57053f2561fc9a9f6e00279e
26373a9b723fff33fe316f2cd39d053dda74eda1f67770207367e37d90c08948
288f451b69c6df8703097509f3bc69e9885a2e7e91fc2d7aa2e8c36073b82d21
315258666b3e66ae101cb272f1f04fb2db74eeb50857489104826d14c57d08c2
43e6ba589f12251c8509f2035f83d1c19358257ddbbd1dd3551c3f35394746ad
54d97963ea227be0f3d6dd590023f7156801d25a8c6d6eeba967341cd2dbede3
77d5dae3b40acc4d6faee0979605a8d806cec65d2a82247db1b0f5d1c14cdb55
8c12b3ffc0a8acb4fa6922ff024a139043db1e086a06278b302b80049ce6a89a
969e3ba775e46af9b324c09c2fa9613e92eb8d364f6ad5f7186598325a7a5b81
99cdd4779c517dbf52c03e6770be94a94f4c666f0a47a9cd8987ceb28f914855
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f
af447a4e04d5c3e9060a4b1d00901457436dda83b9247d5f8b49283205aa86f9
bb8ff89089c2bbd727468fb5655611db82ee9e4cbaa087d8035dbd235a95f938
bca55588189220a0e9ba55880f64c0cf052a1f0d4ca316fb2621b4cad812fdec
c4835fc2029997ffbcbc4f219252aeb9f71f330571268cb130d1e6e942f9c263
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
dfd9d2593e8281c3858b255b0b43e2b5e4427ba9286a59846696b1b3b0d0fda9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e505542575d5a04f71c593193b930826fb798527f6e208f623e7c1448422f672
e837193719374fae8ba128b67b47fb488e3f1d65a2b460bc9dbedcb866356894