www.cash67.com
Open in
urlscan Pro
13.248.213.45
Malicious Activity!
Public Scan
Effective URL: https://www.cash67.com/lander
Submission Tags: threatview.io malwar3ninja rule: suspected phishing scam automated-submission Search All
Submission: On November 29 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on October 27th 2024. Valid for: a year.
This is the only time www.cash67.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 7 | 2606:4700:310... 2606:4700:310c::ac42:2f2b | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 13.248.213.45 13.248.213.45 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2004 | 15169 (GOOGLE) (GOOGLE) | |
4 | 23.53.42.211 23.53.42.211 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
2 | 65.1.208.101 65.1.208.101 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 52.222.236.71 52.222.236.71 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 13.32.121.127 13.32.121.127 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 52.222.236.94 52.222.236.94 | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 13.225.78.26 13.225.78.26 | 16509 (AMAZON-02) (AMAZON-02) | |
29 | 10 |
ASN16509 (AMAZON-02, US)
PTR: a67c48129651a0940.awsglobalaccelerator.com
www.cash67.com |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-53-42-211.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-65-1-208-101.ap-south-1.compute.amazonaws.com
api.aws.parking.godaddy.com |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-71.fra56.r.cloudfront.net
widget.trustpilot.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-127.fra60.r.cloudfront.net
consent.truste.com |
ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-94.fra56.r.cloudfront.net
widget.trustpilot.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-26.fra2.r.cloudfront.net
consent.trustarc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
trustarc.com
consent.trustarc.com — Cisco Umbrella Rank: 3570 |
251 KB |
7 |
pages.dev
1 redirects
easyworks629.pages.dev |
10 KB |
4 |
wsimg.com
img1.wsimg.com — Cisco Umbrella Rank: 10742 |
176 KB |
2 |
trustpilot.com
widget.trustpilot.com — Cisco Umbrella Rank: 5857 |
8 KB |
2 |
godaddy.com
api.aws.parking.godaddy.com — Cisco Umbrella Rank: 61999 |
1 KB |
2 |
cash67.com
www.cash67.com |
1 KB |
1 |
truste.com
consent.truste.com — Cisco Umbrella Rank: 10535 |
13 KB |
1 |
google.com
www.google.com — Cisco Umbrella Rank: 3 |
54 KB |
29 | 8 |
Domain | Requested by | |
---|---|---|
10 | consent.trustarc.com |
consent.truste.com
consent.trustarc.com |
7 | easyworks629.pages.dev |
1 redirects
easyworks629.pages.dev
|
4 | img1.wsimg.com |
www.cash67.com
img1.wsimg.com |
2 | widget.trustpilot.com |
img1.wsimg.com
widget.trustpilot.com |
2 | api.aws.parking.godaddy.com |
img1.wsimg.com
|
2 | www.cash67.com |
www.cash67.com
|
1 | consent.truste.com |
img1.wsimg.com
|
1 | www.google.com |
www.cash67.com
|
29 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.godaddy.com |
trustarc.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
easyworks629.pages.dev WE1 |
2024-11-04 - 2025-02-02 |
3 months | crt.sh |
www.cash67.com Go Daddy Secure Certificate Authority - G2 |
2024-10-27 - 2025-10-27 |
a year | crt.sh |
*.google.com WR2 |
2024-10-21 - 2025-01-13 |
3 months | crt.sh |
*.wsimg.com Starfield Secure Certificate Authority - G2 |
2024-09-19 - 2025-10-21 |
a year | crt.sh |
*.aws.parking.godaddy.com Go Daddy Secure Certificate Authority - G2 |
2024-04-15 - 2025-05-17 |
a year | crt.sh |
*.trustpilot.com Amazon RSA 2048 M03 |
2024-01-03 - 2025-01-31 |
a year | crt.sh |
*.truste.com Amazon RSA 2048 M02 |
2024-10-17 - 2025-11-14 |
a year | crt.sh |
*.trustarc.com Amazon RSA 2048 M02 |
2024-03-16 - 2025-04-14 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.cash67.com/lander
Frame ID: 86F573DBA616A2454B1E569B66B1ED27
Requests: 27 HTTP requests in this frame
Frame:
https://widget.trustpilot.com/trustboxes/5419b637fa0340045cd0c936/index.html?templateId=5419b637fa0340045cd0c936&businessunitId=483fd2b90000640005029919
Frame ID: 90C97D2D3C98CD2EBCF1FB5FD373EAEF
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://easyworks629.pages.dev/
HTTP 307
https://easyworks629.pages.dev/ Page URL
-
https://easyworks629.pages.dev/cdn-cgi/phish-bypass?atok=BPvLrb6lhtBx0qACPj4LmMcBVJR1XTNr42bnIeJqf6I-173285...
HTTP 301
https://easyworks629.pages.dev/ Page URL
- https://www.cash67.com/ Page URL
- https://www.cash67.com/lander Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
TrustArc (Cookie compliance) Expand
Detected patterns
- consent\.trustarc\.com
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Get This Domain
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://easyworks629.pages.dev/
HTTP 307
https://easyworks629.pages.dev/ Page URL
-
https://easyworks629.pages.dev/cdn-cgi/phish-bypass?atok=BPvLrb6lhtBx0qACPj4LmMcBVJR1XTNr42bnIeJqf6I-1732853705-0.0.1.1-%2F
HTTP 301
https://easyworks629.pages.dev/ Page URL
- https://www.cash67.com/ Page URL
- https://www.cash67.com/lander Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://easyworks629.pages.dev/ HTTP 307
- https://easyworks629.pages.dev/
- https://easyworks629.pages.dev/cdn-cgi/phish-bypass?atok=BPvLrb6lhtBx0qACPj4LmMcBVJR1XTNr42bnIeJqf6I-1732853705-0.0.1.1-%2F HTTP 301
- https://easyworks629.pages.dev/
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
easyworks629.pages.dev/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
easyworks629.pages.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
easyworks629.pages.dev/cdn-cgi/images/ |
452 B 540 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
easyworks629.pages.dev/ |
568 B 905 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
easyworks629.pages.dev/ Redirect Chain
|
568 B 1012 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
style.css
easyworks629.pages.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.cash67.com/ |
114 B 173 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
easyworks629.pages.dev/ |
568 B 1009 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
lander
www.cash67.com/ |
536 B 981 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
caf.js
www.google.com/adsense/domains/ |
149 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.c24ae23c.js
img1.wsimg.com/parking-lander/static/js/ |
676 KB 175 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.ef90a627.css
img1.wsimg.com/parking-lander/static/css/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
px.js
img1.wsimg.com/parking-lander/ |
0 0 |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
www.cash67.com
api.aws.parking.godaddy.com/v1/parking/landers/ |
802 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
www.cash67.com
api.aws.parking.godaddy.com/v1/parking/landers/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
px.js
img1.wsimg.com/parking-lander/ |
0 0 |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tp.widget.bootstrap.min.js
widget.trustpilot.com/bootstrap/v5/ |
23 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notice
consent.truste.com/ |
45 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.html
widget.trustpilot.com/trustboxes/5419b637fa0340045cd0c936/ Frame 90C9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tcfapi2.2.js
consent.trustarc.com/asset/ |
305 KB 81 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1.7-6252
consent.trustarc.com/asset/notice.js/v/ |
95 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log
consent.trustarc.com/ |
43 B 429 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
consent.trustarc.com/iab/ |
30 KB 30 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v2
consent.trustarc.com/iab/ |
30 KB 0 |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ic-error.svg
consent.trustarc.com/asset/ |
5 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ic-close-white.svg
consent.trustarc.com/asset/ |
7 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
get
consent.trustarc.com/ |
3 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bannermsg
consent.trustarc.com/ |
43 B 429 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
get
consent.trustarc.com/ |
242 KB 106 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- easyworks629.pages.dev
- URL
- https://easyworks629.pages.dev/style.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 number| googleNDT_ number| googleAltLoader object| google string| LANDER_SYSTEM function| clearImmediate function| setImmediate function| __tcfapi object| Trustpilot object| truste function| shouldRepop function| shouldResolveConsent string| userType function| _truste_eu object| PREF_MGR_API_DEBUG object| PrivacyManagerAPI object| TRUSTE_CMAPI_DEBUG10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.easyworks629.pages.dev/ | Name: __cf_mw_byp Value: BPvLrb6lhtBx0qACPj4LmMcBVJR1XTNr42bnIeJqf6I-1732853705-0.0.1.1-/ |
|
www.cash67.com/ | Name: traffic_target Value: reseller |
|
www.cash67.com/ | Name: caf_ipaddr Value: 45.141.152.72 |
|
www.cash67.com/ | Name: country Value: DE |
|
www.cash67.com/ | Name: city Value: Frankfurt%20am%20Main |
|
www.cash67.com/ | Name: lander_type Value: parkweb-reseller |
|
api.aws.parking.godaddy.com/ | Name: AWSALBCORS Value: kQIOY+32iUK7YHuthbI2MN/PjjHIS5qKasAwxhGyA9kEgZtpM0tljXkWtGQCM878csN3eGA5Ogi86lA3O1S9irwSGWxl9lG7e3ebWkYKPcvz6TnbUZsKoe92Qv49 |
|
api.aws.parking.godaddy.com/ | Name: pwvisitor Value: 145df500-d775-4e8c-800c-a4bd578446f7 |
|
.cash67.com/ | Name: TAsessionID Value: eb1c6e13-7bfc-4eb1-b472-e1e239decb48|NEW |
|
.cash67.com/ | Name: notice_behavior Value: implied,eu |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.aws.parking.godaddy.com
consent.trustarc.com
consent.truste.com
easyworks629.pages.dev
img1.wsimg.com
widget.trustpilot.com
www.cash67.com
www.google.com
easyworks629.pages.dev
13.225.78.26
13.248.213.45
13.32.121.127
23.53.42.211
2606:4700:310c::ac42:2f2b
2a00:1450:4001:80b::2004
52.222.236.71
52.222.236.94
65.1.208.101
0c47080feb6fe854cb361dc2471f19799e8773617f10e33cf78aea069d41a4e6
2ae747839644ff0267de4b04a695fb32d96bbab6f3c7ec9d51c2f4166b2d088d
3aaf2e785e43eb822d6c28de8cbc86a0170b438dc8f8747bf27a0577cb54125d
407d40651225e9ce7c887f32e1d10213df4aba24a4fc4ffbee407d26573eab89
4546243cf66f8dc8ed753b8bd6b6aa3d4272e5914a4f04e4105073148060c2cf
4a55504e190611693e5535b52786e50d8a209bcc5b2a99a3c08305e41784dc9e
5ea56ed1ed92d89dd6e8a23316891c8af7cd2150977d2e8431bd0e97c0cf5282
7510035d553a99fbf93eb67737b2df057ce096fa1ed7aad83cfd559e11f2320d
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8a04976c48fe25ba85733f46c4a6fa2fb954fa598506a0219d7da6ebb3e60544
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
bbc798fd4a11ddc7ac3444814445dbcee4a0fadc5a91ecd56798776c8338aa0c
c69de41dda83f00cc1b13dba90a57f25df046286ecd227bdd0c4d51d94947b61
da0d9dec187414eaac184877e362bfd09ac956b2ab490b6adbb525af80fb3d6a
e0acaced3f5686390c4c2ed8d3b447c725660252d1a20a71fdab5110a435c463
eb6782315dbfb6135215fd8a43875d52de62f87bd6214b9d79d01888fdaf6cba
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f2ad907999b2ef16ee6a7bde95750e15c7da0dc97f6dd96c626bf64f5e7ccab9
f5cf6d71e14baa130cc43ff54b422f332d775e3dcad83e70ccb0f74eb1e2fa5c