ross.golfappweb.com
Open in
urlscan Pro
2606:4700:3032::ac43:bc49
Malicious Activity!
Public Scan
Effective URL: https://ross.golfappweb.com/?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a
Submission: On November 03 via api from US — Scanned from DE
Summary
TLS certificate: Issued by WE1 on October 9th 2024. Valid for: 3 months.
This is the only time ross.golfappweb.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3035::6815:425d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2606:4700:303... 2606:4700:3032::6815:481b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 2606:4700:303... 2606:4700:3032::ac43:bc49 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3037::ac43:8ef5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 2 |
ASN13335 (CLOUDFLARENET, US)
facebook-verified.moonflowsad.shop |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
golfappweb.com
ross.golfappweb.com |
2 MB |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1222 |
426 KB |
1 |
moonflowsad.shop
1 redirects
facebook-verified.moonflowsad.shop |
724 B |
1 |
gracelandsad.shop
1 redirects
tenj.gracelandsad.shop |
926 B |
23 | 4 |
Domain | Requested by | |
---|---|---|
22 | ross.golfappweb.com |
ross.golfappweb.com
|
1 | use.fontawesome.com |
ross.golfappweb.com
|
1 | facebook-verified.moonflowsad.shop | 1 redirects |
1 | tenj.gracelandsad.shop | 1 redirects |
23 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
virus-checked.golfapp.club |
Subject Issuer | Validity | Valid | |
---|---|---|---|
golfappweb.com WE1 |
2024-10-09 - 2025-01-07 |
3 months | crt.sh |
use.fontawesome.com WE1 |
2024-09-09 - 2024-12-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ross.golfappweb.com/?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a
Frame ID: 65001EF08C46E1FBA48636CF8983FB3F
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Rossmann - UmfragebelohnungenPage URL History Show full URLs
-
http://tenj.gracelandsad.shop/index.php/campaigns/ar728fhcg5955/track-url/yn939l0j5m86a/e18cebf5c977499159...
HTTP 307
https://tenj.gracelandsad.shop/index.php/campaigns/ar728fhcg5955/track-url/yn939l0j5m86a/e18cebf5c977499159... HTTP 301
https://facebook-verified.moonflowsad.shop/KoiUjeBsRshTEbsjIowIshTQsvGf?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0... HTTP 301
http://ross.golfappweb.com/?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a HTTP 307
https://ross.golfappweb.com/?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Continuer
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://tenj.gracelandsad.shop/index.php/campaigns/ar728fhcg5955/track-url/yn939l0j5m86a/e18cebf5c977499159955caf564f25c423e3c11a
HTTP 307
https://tenj.gracelandsad.shop/index.php/campaigns/ar728fhcg5955/track-url/yn939l0j5m86a/e18cebf5c977499159955caf564f25c423e3c11a HTTP 301
https://facebook-verified.moonflowsad.shop/KoiUjeBsRshTEbsjIowIshTQsvGf?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a HTTP 301
http://ross.golfappweb.com/?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a HTTP 307
https://ross.golfappweb.com/?customer-id=ar728fhcg5955-ab1316xn9md23-yn939l0j5m86a Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ross.golfappweb.com/ Redirect Chain
|
31 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
ross.golfappweb.com/css/ |
17 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.min.css
ross.golfappweb.com/css/ |
70 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.js
use.fontawesome.com/releases/v5.15.4/js/ |
1 MB 426 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
datehead.js
ross.golfappweb.com/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
ross.golfappweb.com/images/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flaglogo.png
ross.golfappweb.com/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
product.png
ross.golfappweb.com/images/ |
642 KB 643 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
loadingBL.gif
ross.golfappweb.com/images/ |
122 KB 122 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
prize1.png
ross.golfappweb.com/images/ |
643 KB 644 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1.jpg
ross.golfappweb.com/images/ |
53 KB 53 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2.jpg
ross.golfappweb.com/images/ |
38 KB 39 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
comm_pic_1.jpg
ross.golfappweb.com/images/ |
73 KB 74 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3.jpg
ross.golfappweb.com/images/ |
46 KB 47 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4.jpg
ross.golfappweb.com/images/ |
35 KB 36 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
comm_pic_2.jpg
ross.golfappweb.com/images/ |
95 KB 96 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
5.jpg
ross.golfappweb.com/images/ |
48 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f_guarantee.png
ross.golfappweb.com/images/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
f_secure_1.png
ross.golfappweb.com/images/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo2.png
ross.golfappweb.com/images/ |
37 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
ross.golfappweb.com/js/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg.png
ross.golfappweb.com/images/ |
285 KB 285 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
ross.golfappweb.com/ |
196 B 787 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| datehax function| datenhax function| datenhay function| startTimer object| answers number| lastQnum function| toNext object| states object| dones object| loadImg object| loadBgCol function| drawloader number| qn number| dsq object| ___FONT_AWESOME___ object| FontAwesomeConfig object| FontAwesome1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
tenj.gracelandsad.shop/ | Name: mwsid Value: 0n4jrm8rdhg87j400rtpdjplub |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
facebook-verified.moonflowsad.shop
ross.golfappweb.com
tenj.gracelandsad.shop
use.fontawesome.com
2606:4700:3032::6815:481b
2606:4700:3032::ac43:bc49
2606:4700:3035::6815:425d
2606:4700:3037::ac43:8ef5
0c7a3b7317394dd60e3133f86ca4e82ca5107a00c93fe248b1e377c9ace8e4ce
126d10d15fe82745b61efa4b92471ab582ba2057a2aadffd8a0c0d846550407a
369a79cca006827baf7e0cd3fe2482a2c2395965ddeb2523109075c281cb35ee
3726b1f4b3896a1732d72294945c4d459fcfa3341cd52eba3c53c2695e6ddc0a
4f7b917afd8fe42216c170d83013ba8e33ea0780576bc6df0ed7098ae6743859
4fb28bade9c42bcc3ea50a7a999ef2abca04c7b710e6d30d437d90a94ec281b2
590d8aeae9f63085d5e10ba4d7259b8f2eb68263612a07028ca47a1cebbcb394
609638eda5a0802f689f6cd7093b8c04203e8a7d380560703427202a0669c754
6b30009f4e913929f5ad7491a440865817a22917fb4c9624c0b62741eb4ad9ce
721fd25fad2ceea766b483f7692fc840097de75bb54185273920adf62da63e15
72cd874f947116cba053e9a1ce527aad1246fa78accaff5be04bec50706b980d
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
812ab0e46f86b2ce98ab2425ab2224b90d0845952a1ac0d5abd734b6217e98bf
9876a7ae2fff3841f6815203eea614d8cd0022ebbe6b9b4d97bfbc53bf422fe4
9e881c84c114503dfcf2681927f47ebfaeaeada94eeed9b0e4f411fea3f48439
b0d9b65a64ac267feaef7582d2b81993212f4e1ab4e562fc7daf48ebe1986fe8
b8268ce80bdb9ad4455d230ab92dd5081fe431aa2200188c9c617099df740931
bf50b75839e09bb51cda517f43430777465f51c52870472c932b5fb3ce6c7f1e
bf97443d681d2bc0ca04b707d0d3d443bcf99b1bf4fc0af84ac51286d0b4e02b
c6c896e27ff1f1d6cb22ce652dcca916946ce9f003bcb4fe30d1265fcb531a95
d20539463f7835cee50ddc2e6ff1eb479fbe85acafbadc6e50de49b91b5d1313
d769b5e89c5845baca4f51f91d02fdf4a4cbeb9db32c30e1c1c1f7a539518216
f8003f36c919d6bcd0798530b75697b91cbeb0588529d2a1ac43b935f1d87c1a