zez.am
Open in
urlscan Pro
2606:4700:20::681a:aab
Malicious Activity!
Public Scan
Submission: On October 15 via api from CA — Scanned from CA
Summary
TLS certificate: Issued by WE1 on October 14th 2024. Valid for: 3 months.
This is the only time zez.am was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication) Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 26 | 2606:4700:20:... 2606:4700:20::681a:aab | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2600:9000:251... 2600:9000:2511:b400:1:3e1a:c400:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700::68... 2606:4700::6810:5049 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 34.120.195.249 34.120.195.249 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
2 | 2400:52e0:1a0... 2400:52e0:1a00::1207:2 | 200325 (BUNNYCDN) (BUNNYCDN) | |
31 | 5 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 249.195.120.34.bc.googleusercontent.com
o942608.ingest.sentry.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
26 |
zez.am
1 redirects
zez.am |
1 MB |
2 |
plausible.io
plausible.io — Cisco Umbrella Rank: 9060 |
2 KB |
2 |
zezam.io
media.zezam.io |
14 KB |
1 |
sentry.io
o942608.ingest.sentry.io |
300 B |
1 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 683 |
7 KB |
31 | 5 |
Domain | Requested by | |
---|---|---|
26 | zez.am |
1 redirects
zez.am
|
2 | plausible.io |
zez.am
|
2 | media.zezam.io |
zez.am
|
1 | o942608.ingest.sentry.io |
zez.am
|
1 | static.cloudflareinsights.com |
zez.am
|
31 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
llattr.weebly.com |
my.zez.am |
Subject Issuer | Validity | Valid | |
---|---|---|---|
zez.am WE1 |
2024-10-14 - 2025-01-12 |
3 months | crt.sh |
media.zezam.io Amazon RSA 2048 M02 |
2024-09-09 - 2025-10-08 |
a year | crt.sh |
cloudflareinsights.com WE1 |
2024-09-03 - 2024-12-02 |
3 months | crt.sh |
ingest.sentry.io DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-10-03 - 2025-07-29 |
10 months | crt.sh |
plausible.io R10 |
2024-09-02 - 2024-12-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zez.am/xxtswe
Frame ID: A505326C63EB7D8EB790283FCFCD52F8
Requests: 31 HTTP requests in this frame
Screenshot
Page Title
YAHOO MAILPage URL History Show full URLs
- https://zez.am/xxtswe Page URL
-
https://zez.am/cdn-cgi/phish-bypass?atok=3SFtLJsS1OHffYGAXvUFZxInrAOngwRyzz61BC889_4-172903...
HTTP 301
https://zez.am/xxtswe Page URL
Detected technologies
Cloudflare Browser Insights (Analytics) ExpandDetected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Click Here To Continue
Search URL Search Domain Scan URL
Title: Create your free page with
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://zez.am/xxtswe Page URL
-
https://zez.am/cdn-cgi/phish-bypass?atok=3SFtLJsS1OHffYGAXvUFZxInrAOngwRyzz61BC889_4-1729030895-0.0.1.1-%2Fxxtswe
HTTP 301
https://zez.am/xxtswe Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
xxtswe
zez.am/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
zez.am/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
zez.am/cdn-cgi/images/ |
452 B 586 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
zez.am/ |
15 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
xxtswe
zez.am/ Redirect Chain
|
52 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
85a95acb8c6ed391.css
zez.am/_next/static/css/ |
48 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eyJrZXkiOiJOelJUbjc2MjhEcGgvY3JlYXRvci1wYWdlLXNlY3Rpb24taW1hZ2UvQ3h6a1JlZkJ1alV1L0RjSVcxT0dDdGZ1UC81Z3VsaUZJOWRLQUwiLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk2LCJoZWlnaHQiOjk2fX19
media.zezam.io/ |
2 KB 3 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eyJrZXkiOiJOelJUbjc2MjhEcGgvcHJvZmlsZS1pbWFnZS9xeFduYlNHZ0JKMHYiLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjIwMH19fQ==
media.zezam.io/ |
11 KB 12 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Inter-Bold.woff2
zez.am/fonts/ |
104 KB 104 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Inter-Medium.woff2
zez.am/fonts/ |
103 KB 104 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Inter-Regular.woff2
zez.am/fonts/ |
97 KB 97 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rocket-loader.min.js
zez.am/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vcd15cbe7772f49c399c6a5babf22c1241717689176015
static.cloudflareinsights.com/beacon.min.js/ |
19 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_ssgManifest.js
zez.am/_next/static/ixfIfDerezqlWwpOkbVu9/ |
77 B 600 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_buildManifest.js
zez.am/_next/static/ixfIfDerezqlWwpOkbVu9/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
%5BcreatorId%5D-ab9e07b52c8bbe2b.js
zez.am/_next/static/chunks/pages/creator/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
166-a291db72fcb56523.js
zez.am/_next/static/chunks/ |
82 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
323-6c98e347456142b7.js
zez.am/_next/static/chunks/ |
152 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
69-58da519493acc4d6.js
zez.am/_next/static/chunks/ |
119 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_app-da2f7145155bb5ac.js
zez.am/_next/static/chunks/pages/ |
513 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main-051ce4cc13c6cf3f.js
zez.am/_next/static/chunks/ |
70 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
framework-5d5971fdfab04833.js
zez.am/_next/static/chunks/ |
36 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
webpack-1f56c76d49b1a1c2.js
zez.am/_next/static/chunks/ |
4 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
zez.am/ |
15 KB 505 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
framework-5d5971fdfab04833.js
zez.am/_next/static/chunks/ |
138 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main-051ce4cc13c6cf3f.js
zez.am/_next/static/chunks/ |
115 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
_app-da2f7145155bb5ac.js
zez.am/_next/static/chunks/pages/ |
2 MB 666 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
o942608.ingest.sentry.io/api/6232686/envelope/ |
2 B 300 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plausible.exclusions.js
plausible.io/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
rum
zez.am/cdn-cgi/ |
0 154 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
event
plausible.io/api/ |
2 B 492 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication) Generic Cloudflare (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| __cfQR object| __cfBeacon boolean| __cfRLUnblockHandlers object| webpackChunk_N_E object| regeneratorRuntime function| __next_require__ object| next object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| _N_E object| __SENTRY__ object| __MIDDLEWARE_MATCHERS object| __BUILD_MANIFEST function| plausible object| __SSG_MANIFEST1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.zez.am/ | Name: __cf_mw_byp Value: 3SFtLJsS1OHffYGAXvUFZxInrAOngwRyzz61BC889_4-1729030895-0.0.1.1-/xxtswe |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
media.zezam.io
o942608.ingest.sentry.io
plausible.io
static.cloudflareinsights.com
zez.am
2400:52e0:1a00::1207:2
2600:9000:2511:b400:1:3e1a:c400:93a1
2606:4700:20::681a:aab
2606:4700::6810:5049
34.120.195.249
057db869bc87848695d23213fb84e8000d8ff6d93cc26dc1d27511782798f558
07b771e8719aded58343e68d8876fa62eec60014c99f8a4a23753668245f3c37
1b498b959e5b7decbf9185803591d25bc1fbf83e798372ed30d32d5c79d82ff6
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
35c096ddf29c41c7609557af02dd465758c478870431a8e6e4b1e5c7e41eb961
421dbb61692377d8cda80b79600232b813963bbd861fc3e6d1116744dafd310b
426948c13a82cb8cf4c3e82710c7ebba0745886bf9e03e75b275d1d5a9f0e7a7
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
52bcc9e8a2afa8447a8f6574e10065b2c35c7a499dd1fe3486eb4d4f5ccbbba0
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
757a445f83c348f615936dee8f5405ca5f15602db0d307bd1e345a9a5c5e0630
7ebfe5dec1078f731284e235769cea6c3106fb9c04e68812a18d95bc46830e76
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
972369db553e0c6532f6fabd511bc884b1fffe0353c2efedf8574d2933697409
aec3b9e006efadd4d304d2491e775414560ccc66530e0009da668fe4ddea06cf
b221e59ebff350f9bb8361afba8ef52f4db88af6a46014331c998580b5062a42
c00985f075ca4b3ac00450470cb94304a1126c25e920010b2fef277582099658
c63158babcb7902203ed73476ccf901db34825ea524d4a36a52b5e5f97e1abf7
cb18f5599a21d9faee5e029c0a8f345c1809c0aacec431fbd46ab1f992b972ef
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d1266467fa31d2075de435d41fef63ea380367327340696a137c556b8f0ac554
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e60390f1f7e83cf68ca7012810c49e1ba10ef66006c411db83cdcd66db624e7e
ed299f17042eced84a2fe0a893a51167934e46d8c51e95cb54082fa1e483840e
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016