urlscan.io logo urlscan.io
SecurityTrails logo

secure-mode-0f73.0k3d76dx.workers.dev Open in urlscan Pro
104.21.67.12  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Submission: On January 23 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 3 domains to perform 22 HTTP transactions. The main IP is 104.21.67.12, located in and belongs to CLOUDFLARENET, US. The main domain is secure-mode-0f73.0k3d76dx.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on December 1st 2023. Valid for: 3 months.
This is the only time secure-mode-0f73.0k3d76dx.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ourtime.com (Online)

Domain & IP information

IP Address AS Autonomous System
1 104.21.67.12 13335 (CLOUDFLAR...)
3 172.64.154.107 13335 (CLOUDFLAR...)
1 151.101.66.137 54113 (FASTLY)
1 ()
15 172.67.209.83 13335 (CLOUDFLAR...)
22 6
1    104.21.67.12 (None, )

ASN13335 (CLOUDFLARENET, US)
secure-mode-0f73.0k3d76dx.workers.dev
3    172.64.154.107 (United States)

ASN13335 (CLOUDFLARENET, US)
codesandbox.io
1    151.101.66.137 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
1    (None, )

ASN- ()
secure-mode-0f73.0k3d76dx.workers.dev
15    172.67.209.83 (United States)

ASN13335 (CLOUDFLARENET, US)
api.rename-service0.workers.dev
Apex Domain
Subdomains		 Transfer
17 workers.dev
secure-mode-0f73.0k3d76dx.workers.dev
api.rename-service0.workers.dev
1 MB
3 codesandbox.io
codesandbox.io — Cisco Umbrella Rank: 85741
48 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 760
30 KB
22 3
Domain Requested by
15 api.rename-service0.workers.dev secure-mode-0f73.0k3d76dx.workers.dev
3 codesandbox.io secure-mode-0f73.0k3d76dx.workers.dev
codesandbox.io
2 secure-mode-0f73.0k3d76dx.workers.dev secure-mode-0f73.0k3d76dx.workers.dev
1 code.jquery.com secure-mode-0f73.0k3d76dx.workers.dev
22 4
Subject Issuer Validity Valid
0k3d76dx.workers.dev
GTS CA 1P5		 2023-12-01 -
2024-02-29		 3 months crt.sh
codesandbox.io
E1		 2023-12-28 -
2024-03-27		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
rename-service0.workers.dev
GTS CA 1P5		 2023-12-10 -
2024-03-09		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Frame ID: D6E2A8B343614DFA6E34246D67B6138C
Requests: 22 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

OurTime.com - The 50+ Single Network

Detected technologies

Overall confidence: 100%
Detected patterns
  • moment(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

22
Requests

95 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

6
IPs

2
Countries

1346 kB
Transfer

12153 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/ 		7 MB
1 MB 		Document
General
Check archive.org
Download Go to
Full URL
https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.67.12 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
399362e45bb570db3363aa20f44c0545756dca4bb0d38aed6223fbf105d9848d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-cache, no-store
cf-cache-status
DYNAMIC
cf-ray
84a103a3da6e09f9-LAS
content-encoding
br
content-type
text/html
date
Tue, 23 Jan 2024 15:19:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yVMsl8gtMisvnfP%2Fy%2BYfjPfTWyevjX3W2NuX3W7a8JB7zh6%2Bl7CBrQ6OHlTv9VOg0e435K%2Bi3vHFiYoIgnbGMWKu6yzRtdDPklfwvunJEsbc9UMc53Nve6NqlUMo9mEs%2FxxeTfygtkhdBPAKJ%2B1ntPsLd2EtytNc"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
via
1.1 google
x-request-id
F60DBnHeD6-JZhwAMKKC
sse-hooks.350c89a8d06431c89209943b3882c89f.js
codesandbox.io/public/sse-hooks/ 		172 KB
45 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/public/sse-hooks/sse-hooks.350c89a8d06431c89209943b3882c89f.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.154.107 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59f17efc9fc32fc73c0451ed936286b0e690dc43282472a9d70ab785c68d4c98

Request headers

accept-language
en-US,en;q=0.9
Referer
https://secure-mode-0f73.0k3d76dx.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 15:19:23 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
age
3976902
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 08 Dec 2023 11:11:17 GMT
server
cloudflare
etag
W/"6572f9d5-2b197"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
84a103c129c5a700-PHX
expires
Thu, 31 Dec 2037 23:55:55 GMT
banner.d9cb10a38.js
codesandbox.io/static/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/static/js/banner.d9cb10a38.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.154.107 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74850bad3411bc2540a6928159967088a555cb990e9569065a878e9e8a864830

Request headers

accept-language
en-US,en;q=0.9
Referer
https://secure-mode-0f73.0k3d76dx.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 15:19:23 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
age
5280209
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 09 Nov 2023 15:15:01 GMT
server
cloudflare
etag
W/"654cf775-efa"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
84a103c129c6a700-PHX
expires
Thu, 31 Dec 2037 23:55:55 GMT
jquery-3.4.1.min.js
code.jquery.com/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.4.1.min.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://secure-mode-0f73.0k3d76dx.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 15:19:23 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
1340246
x-cache
HIT, HIT
content-length
30638
x-served-by
cache-lga21923-LGA, cache-phx12424-PHX
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1706023163.048648,VS0,VE0
etag
W/"28feccc0-15851"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
61, 11561
phishing
codesandbox.io/api/v1/sandboxes/secure-mode-0f73/ 		0
0
watermark-button.eeb14a97b.js
codesandbox.io/static/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codesandbox.io/static/js/watermark-button.eeb14a97b.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.154.107 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://secure-mode-0f73.0k3d76dx.workers.dev/
Origin
https://secure-mode-0f73.0k3d76dx.workers.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 15:19:24 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 08 Dec 2023 11:11:12 GMT
server
cloudflare
etag
W/"6572f9d0-ac1"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=315360000
cf-ray
84a103c75862a718-PHX
alt-svc
h3=":443"; ma=86400
expires
Thu, 31 Dec 2037 23:55:55 GMT
bdc797ad-cccd-4b50-ab5e-989195248257
https://secure-mode-0f73.0k3d76dx.workers.dev/ 		5 MB
0 		Document
General
Check archive.org
Download Go to
Full URL
blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8ac8b6e059665d05f7d6a65bb6a2ed1cdbf6178293370b20964fbb7c1dbdc737

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Content-Length
5216462
Content-Type
text/html
otSDKStub.js
api.rename-service0.workers.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/otSDKStub.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers
js
api.rename-service0.workers.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/js?id=UA-1817027-45
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers
jquery-3.5.1.min.js
api.rename-service0.workers.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/jquery-3.5.1.min.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers
jquery-migrate-3.3.1.min.js
api.rename-service0.workers.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/jquery-migrate-3.3.1.min.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers
moment.min.js
api.rename-service0.workers.dev/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/moment.min.js
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers
heagregauwe.png
api.rename-service0.workers.dev/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://api.rename-service0.workers.dev/heagregauwe.png
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:400
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:700
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:400italic
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/css?family=PT+Sans:700italic
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
font-1.2.css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/font-1.2.css
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
redesign_fonts.css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/redesign_fonts.css
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
base_external.css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/base_external.css
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
166.css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/166.css
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers
theme.css
api.rename-service0.workers.dev/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://api.rename-service0.workers.dev/theme.css
Requested by
Host: secure-mode-0f73.0k3d76dx.workers.dev
URL: blob:https://secure-mode-0f73.0k3d76dx.workers.dev/bdc797ad-cccd-4b50-ab5e-989195248257
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.209.83 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
codesandbox.io
URL
https://codesandbox.io/api/v1/sandboxes/secure-mode-0f73/phishing

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ourtime.com (Online)

100 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| s string| m function| OptanonWrapper object| _gaq object| dataLayer undefined| $jq function| LIii6y4cA56Nc1o2nfu6se6iiii function| Llli6y4cA56Nc1o2nfu6se6iiii string| TwrKDo string| RCCL2rZ string| d_yygl1 string| nPbLr5 string| j6IEw1h string| F11ctP string| HmYA8Eb string| Uu0fyjw string| _R0pBll object| QP2vb3 function| jXZMKmk object| WkaAxwh number| HoSrLE object| RKp1IM string| oV3pE3J string| stD1hJA string| hTiCwR string| nhjSrcE string| dczP1fC string| GXRMfa string| pflhlZ string| bAV2FHf string| kpK0MS string| K0pPLcP string| ilzQrM string| l4fF6M string| W6JJDR1 string| W9Fv6_P string| YA7SbYl string| omsvSY string| TJ52EOX string| zbtPMD string| jgHujc string| r8YQ0XO string| TZNv9v2 string| b7mjkot string| YSzLP8j string| tCf_xlh string| nQaumS_ string| FROKm_ string| a23vi9 string| hEu0IyC string| VBypuQR string| XXkR9J string| KyQowX string| D9A_PQq string| h39lwuS string| KMpTeDy string| HfNV0ex string| fkHjKiN string| qew0iz7 string| BkRC2x string| o1IYopZ string| aNCB9ga string| yH47Kc string| Nm_2YK string| EXTKJi string| qb6Bra string| vRNjGF string| fkFo8Sb string| gkXQmjG string| x8rRi6 string| FoWtNM8 string| rL6xHx string| yfyIMD string| YWwHLcp string| OC6UPU function| llll6y4ca56nc1o2nfu6se6lli object| zWE1jg object| O_R05T object| kgV3s7 object| YZF2wji function| V_y35t function| T7CYa0 undefined| zFgjFlL string| jd3hOME string| BmAA_6W string| gIPzJx string| VORoKJT undefined| RnN9a7 function| q40SGw function| AY48sEu function| xaTUsms function| ItppNV0 function| iiii6y4ca56nc1o2nfu6se6iiii function| GeLD_h function| ihFb7SQ function| S0CkPQ function| U6xIl5W function| llli6y4ca56nc1o2nfu6se6iiii function| llii6y4ca56nc1o2nfu6se6iiii function| unlockPage

1 Cookies

Domain/Path Name / Value
.codesandbox.io/ Name: _cfuvid
Value: N_fXb3ky_82rhIW3Ypp.5S8iCG7TnV0UNj2_GLUaeP4-1706023163088-0-604800000

23 Console Messages

Source Level URL
Text
javascript error URL: https://secure-mode-0f73.0k3d76dx.workers.dev/7754c0bb-33ec-44d6-b7ce-c8d8978f5304/(Line 25)
Message:
Access to fetch at 'https://codesandbox.io/api/v1/sandboxes/secure-mode-0f73/phishing' from origin 'https://secure-mode-0f73.0k3d76dx.workers.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network error URL: https://codesandbox.io/api/v1/sandboxes/secure-mode-0f73/phishing
Message:
Failed to load resource: net::ERR_FAILED
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/otSDKStub.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/js?id=UA-1817027-45, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/jquery-migrate-3.3.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.rename-service0.workers.dev/moment.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://api.rename-service0.workers.dev/otSDKStub.js
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/jquery-migrate-3.3.1.min.js
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/js?id=UA-1817027-45
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/moment.min.js
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/jquery-3.5.1.min.js
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/css?family=PT+Sans:400
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/css?family=PT+Sans:700
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/css?family=PT+Sans:400italic
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/css?family=PT+Sans:700italic
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/166.css
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/font-1.2.css
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/base_external.css
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/theme.css
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/redesign_fonts.css
Message:
Failed to load resource: the server responded with a status of 429 ()
network error URL: https://api.rename-service0.workers.dev/heagregauwe.png
Message:
Failed to load resource: the server responded with a status of 429 ()