3289209.tk - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3033::681c:1c2c, located in United States and belongs to CLOUDFLARENET, US. The main domain is 3289209.tk.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 20th 2020. Valid for: a year.

This is the only time 3289209.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3033::681c:1c2c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.229.133.221 192.229.133.221	15133 (EDGECAST) (EDGECAST)
4	2

3 2606:4700:3033::681c:1c2c (United States)

ASN13335 (CLOUDFLARENET, US)

3289209.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.133.221 (United States)

ASN15133 (EDGECAST, US)

www.w3schools.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	3289209.tk 3289209.tk	859 KB
1	w3schools.com www.w3schools.com	7 KB
4	2

	Domain	Requested by
3	3289209.tk	3289209.tk
1	www.w3schools.com	3289209.tk
4	2

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-05-20` - `2021-05-20`	a year	crt.sh
*.w3schools.com DigiCert SHA2 Secure Server CA	`2020-05-05` - `2022-05-10`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
Frame ID: E2C612AE50986CB1E675B6CC8BD69B6E
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

865 kB
Transfer

891 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request dashboard.html Show response
3289209.tk/dashboard-update/dashboard-update/Auth/ 3 KB
1 KB 279ms
217ms Document
text/html 2606:4700:3033::681c:1c2c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::681c:1c2c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3da4dbfa246a95185dd283db2ae3d2545827896e000ef9bb4f42c636f262a97a

Request headers

:method: GET
:authority: 3289209.tk
:scheme: https
:path: /dashboard-update/dashboard-update/Auth/dashboard.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Fri, 22 May 2020 00:25:33 GMT
content-type: text/html
set-cookie: __cfduid=d53641a961d354e09f90fdf76e0ead7c81590107133; expires=Sun, 21-Jun-20 00:25:33 GMT; path=/; domain=.3289209.tk; HttpOnly; SameSite=Lax
last-modified: Wed, 20 May 2020 19:54:48 GMT
vary: Accept-Encoding
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5972668e0cf21f19-FRA
content-encoding: br
cf-request-id: 02db5e6cc700001f19de0ad200000001

GET
H2 200 w3.css
www.w3schools.com/lib/ 32 KB
7 KB 117ms
28ms Stylesheet
text/css 192.229.133.221
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://www.w3schools.com/lib/w3.css

Requested by

Host: 3289209.tk
URL: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

192.229.133.221 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (fcn/4194) / ASP.NET

Resource Hash

d1f98037ced9040d5cc3f9e6d331bb71ade963f82e753a2ba5039a9d5bed5eac

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 00:25:33 GMT
content-encoding: gzip
etag: "80d5cb31c89cd21:0"
last-modified: Tue, 14 Mar 2017 13:37:59 GMT
server: ECS (fcn/4194)
age: 2663
x-powered-by: ASP.NET
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
status: 200
cache-control: public,max-age=14400,public
accept-ranges: bytes
vary: Accept-Encoding
content-length: 6691

GET
H2 200 bomb.png
3289209.tk/dashboard-update/dashboard-update/Auth/image/ 18 KB
19 KB 276ms
275ms Image
image/png 2606:4700:3033::681c:1c2c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3289209.tk/dashboard-update/dashboard-update/Auth/image/bomb.png
Requested by: Host: 3289209.tk
URL: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::681c:1c2c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: be2e9a139a53a358658b746924656ebcb08cafe09636949e4cdcd2cde9ce6d5d

Request headers

Referer: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 00:25:33 GMT
cf-cache-status: MISS
last-modified: Wed, 20 May 2020 19:54:53 GMT
server: cloudflare
etag: "5ec58b0d-49a2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5972668f8ecc1f19-FRA
content-length: 18850
cf-request-id: 02db5e6db300001f19de0b6200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 reds.jpg
3289209.tk/dashboard-update/dashboard-update/Auth/image/ 838 KB
839 KB 361ms
360ms Image
image/jpeg 2606:4700:3033::681c:1c2c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://3289209.tk/dashboard-update/dashboard-update/Auth/image/reds.jpg
Requested by: Host: 3289209.tk
URL: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3033::681c:1c2c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 083d9e0a4d922c512bb2e512ee7a5a47ce4d788bbdcde97e26194be6664b5eee

Request headers

Referer: https://3289209.tk/dashboard-update/dashboard-update/Auth/dashboard.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 22 May 2020 00:25:33 GMT
cf-cache-status: MISS
last-modified: Wed, 20 May 2020 19:55:08 GMT
server: cloudflare
etag: "5ec58b1c-d1645"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5972668f8ecf1f19-FRA
content-length: 857669
cf-request-id: 02db5e6db400001f19de0b7200000001
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.3289209.tk/	1970-01-19 10:24:59	Name: __cfduid Value: d53641a961d354e09f90fdf76e0ead7c81590107133

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3289209.tk
www.w3schools.com
192.229.133.221
2606:4700:3033::681c:1c2c
083d9e0a4d922c512bb2e512ee7a5a47ce4d788bbdcde97e26194be6664b5eee
3da4dbfa246a95185dd283db2ae3d2545827896e000ef9bb4f42c636f262a97a
be2e9a139a53a358658b746924656ebcb08cafe09636949e4cdcd2cde9ce6d5d
d1f98037ced9040d5cc3f9e6d331bb71ade963f82e753a2ba5039a9d5bed5eac

3289209.tk Open in urlscan Pro 2606:4700:3033::681c:1c2c Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

865 kBTransfer

891 kBSize

1 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

3289209.tk Open in urlscan Pro
2606:4700:3033::681c:1c2c Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

865 kB
Transfer

891 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!