cdn.dragon.cere.network Open in urlscan Pro
64.49.12.138  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request email-upgrade-access-portal.html Show response cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/	130 KB 130 KB	359ms 110ms	Document text/html	64.49.12.138 REDOUBT-NET
General Check archive.org Show headers Download Go to Full URL https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 64.49.12.138 -, , ASN400304 (REDOUBT-NET, US), Reverse DNS Software nginx/1.25.3 / Resource Hash 2aa51f80885032ca8b6e0e73c486756956a0de02b233539d5f89f733f8a32730 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection keep-alive Content-Type text/html; charset=utf-8 Date Sat, 07 Dec 2024 14:00:59 GMT Server nginx/1.25.3 Transfer-Encoding chunked Vary Origin
GET H/1.1	404 Not Found	hover.css cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/css/	0 0	323ms 108ms	Stylesheet application/json	64.49.12.138 REDOUBT-NET
General Check archive.org Show headers Download Go to Full URL https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/css/hover.css Requested by Host: cdn.dragon.cere.network URL: https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 64.49.12.138 -, , ASN400304 (REDOUBT-NET, US), Reverse DNS Software nginx/1.25.3 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Response headers Content-Length 46 Date Sat, 07 Dec 2024 14:00:59 GMT Content-Type application/json Vary Origin Server nginx/1.25.3 Connection keep-alive
GET H2	401	ii_c5byfb.png res.cloudinary.com/pta/image/upload/v1631524936/	0 394 B	566ms 139ms	Image text/html	2600:141b:1c00:2588::523 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://res.cloudinary.com/pta/image/upload/v1631524936/ii_c5byfb.png Requested by Host: cdn.dragon.cere.network URL: https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2600:141b:1c00:2588::523 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software Cloudinary / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=604800 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cdn.dragon.cere.network/ Response headers strict-transport-security max-age=604800 cache-control private, no-transform, max-age=0, no-cache access-control-expose-headers Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Robots-Tag timing-allow-origin * pragma no-cache content-transfer-encoding binary accept-ranges bytes access-control-allow-origin * x-cld-error pta cannot be accessed via this endpoint content-length 0 server-timing cld-akam;dur=3;start=2024-12-07T14:01:00.366Z;desc=synth,rtt;dur=134 date Sat, 07 Dec 2024 14:01:00 GMT content-type text/html content-disposition inline server Cloudinary
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	410ms 133ms	Script text/javascript	2607:f8b0:4004:c1d::5f GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: cdn.dragon.cere.network URL: https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c1d::5f Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cdn.dragon.cere.network/ Response headers content-encoding gzip age 43551 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Sun, 07 Dec 2025 01:55:09 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sat, 07 Dec 2024 01:55:09 GMT last-modified Tue, 03 Mar 2020 19:15:00 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30028 x-xss-protection 0 server sffe
GET H/1.1	404 Not Found	favicon.ico cdn.dragon.cere.network/	24 B 199 B	109ms 108ms	Other application/json	64.49.12.138 REDOUBT-NET
General Check archive.org Show headers Download Go to Full URL https://cdn.dragon.cere.network/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 64.49.12.138 -, , ASN400304 (REDOUBT-NET, US), Reverse DNS Software nginx/1.25.3 / Resource Hash 8699bf1eda7e016dec3efeff8db5e3400183e9ebf6ce42355b97b843def2b035 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Response headers Content-Length 24 Date Sat, 07 Dec 2024 14:01:00 GMT Content-Type application/json Vary Origin Server nginx/1.25.3 Connection keep-alive

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| myFunction function| validate object| locate string| text function| delineate number| theright function| $ function| jQuery

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/css	1969-12-31 23:59:59	Name: token Value:
			cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u	1969-12-31 23:59:59	Name: token Value:

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/css/hover.css Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://res.cloudinary.com/pta/image/upload/v1631524936/ii_c5byfb.png Message: Failed to load resource: the server responded with a status of 401 ()
recommendation	verbose	URL: https://cdn.dragon.cere.network/1158/baear4ia7zmg4npltdru7ftchgz5wlz6ayybz4s2fqsckyhyitbwr4zlg7u/email-upgrade-access-portal.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://cdn.dragon.cere.network/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.dragon.cere.network
res.cloudinary.com
2600:141b:1c00:2588::523
2607:f8b0:4004:c1d::5f
64.49.12.138
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2aa51f80885032ca8b6e0e73c486756956a0de02b233539d5f89f733f8a32730
8699bf1eda7e016dec3efeff8db5e3400183e9ebf6ce42355b97b843def2b035
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855