tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
43.174.247.29  Malicious Activity! Public Scan Open in urlscan Pro

Summary

This website contacted 5 IPs in 4 countries across 6 domains to perform 7 HTTP transactions. The main IP is 43.174.247.29, located in Singapore and belongs to ACE-AS-AP - ACE, SG. The main domain is tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev. 1mo old
TLS certificate: Issued by DigiCert Secure Site OV G2 TLS CN RSA... on November 20th 2025. Valid for: 1yr.
This is the only time tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev was scanned on urlscan.io!
Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 43.174.247.29 43.174.247.29 139341 (ACE-AS-AP) (ACE-AS-AP - ACE)
1 2404:6800:400... 2404:6800:4003:c02::5f 15169 (GOOGLE) (GOOGLE - Google LLC)
1 1 142.251.153.119 142.251.153.119 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2404:6800:400... 2404:6800:4003:c11::69 15169 (GOOGLE) (GOOGLE - Google LLC)
1 2606:4700:10:... 2606:4700:10::ac42:93f3 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 2a00:ab00:610... 2a00:ab00:610:1::1 49505 (SELECTEL ...) (SELECTEL JSC Selectel)
7 5
Apex Domain
Subdomains
Transfer
2 selcdn.ru
274418.selcdn.ru 4yr old
5 KB
2 edgeone.dev
tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev 1mo old
28 KB
1 example.com
www.example.com — Cisco Umbrella Rank: 36768 12yr old
473 B
1 gstatic.com
t3.gstatic.com — Cisco Umbrella Rank: 3171 10yr old
917 B
1 google.com 1 redirects
www.google.com — Cisco Umbrella Rank: 5 14yr old
18 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 823 10yr old
31 KB
7 6
Domain Requested by
2 274418.selcdn.ru
2 tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
1 www.example.com ajax.googleapis.com
1 t3.gstatic.com tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
1 www.google.com 1 redirects
1 ajax.googleapis.com tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
7 6

This site contains links to these domains. Also see Links.

Domain
iana.org
Subject Issuer Validity Valid
*.edgeone.dev
DigiCert Secure Site OV G2 TLS CN RSA4096 SHA256 2022 CA1
2025-11-20 -
2026-11-19
1yr crt.sh
upload.video.google.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
example.com
Cloudflare TLS Issuing ECC CA 3
2026-07-29 -
2026-10-27
3mo crt.sh
*.selcdn.ru
GlobalSign GCC R6 AlphaSSL CA 2025
2025-12-12 -
2027-01-13
1yr crt.sh

This page contains 2 frames:

Primary Page: https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Frame ID: 53672F4508EF9D80E8DE461B4F040DC4
Requests: 6 HTTP requests in this frame

Frame: https://www.example.com/
Frame ID: 2161FD999A8C933BD02A0B56D0F68F60
Requests: 1 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.


Detected technologies

(CDN)
Overall confidence: 100%
Detected patterns
  • ajax\.googleapis\.com/ajax/libs/

(Security)
Overall confidence: 100%
Detected patterns
  • ^https://[\w\d\.\-]+(?:\.dev)(?:/.+||/)$

(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • jquery
  • /(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js|(?:\.[\w-]*)*fancybox)[/.-][^u]

Page Statistics

7
Requests

86 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

5
IPs

4
Countries

65 kB
Transfer

141 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.google.com/s2/favicons?domain=example.com&sz=64 HTTP 301
  • https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://example.com&size=64

7 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.

0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H/1.1
200
OK
Primary Request / Show response
tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
22 KB
6 KB
105ms
30ms
Document
text/html
43.174.247.29
ACE
General
Full URL
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
43.174.247.29 , Singapore, ASN139341 (ACE-AS-AP - ACE, SG),
Reverse DNS
Software
edgeone-pages /
Resource Hash
2fac82a5ba16231c9bc88d08f4b597935e908383e57462d43c62f1ee9c628423

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Accept-Ranges
bytes
Age
10
Cache-Control
public,max-age=0,must-revalidate
Connection
keep-alive
Content-Encoding
br
Content-Length
5659
Content-Type
text/html
Date
Mon, 31 Aug 2026 09:52:41 GMT
EO-Cache-Status
Cache Hit
EO-LOG-UUID
388643690703481618
Etag
"4a35f79e4b439cbf2a38a0623546b424"
Last-Modified
Mon, 31 Aug 2026 09:52:09 GMT
Server
edgeone-pages
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
X-NWS-LOG-UUID
388643690703481618
GET
H2
200
jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/
87 KB
31 KB
54ms
7ms
Script
text/javascript
2404:6800:4003:c02::5f
Google LLC
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
URL: https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2404:6800:4003:c02::5f Singapore, Singapore, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
235394
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Sat, 28 Aug 2027 16:29:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 28 Aug 2026 16:29:27 GMT
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
31017
x-xss-protection
0
server
sffe
GET
H/1.1
200
OK
/
tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
22 KB
22 KB
22ms
20ms
Image
text/html
43.174.247.29
ACE
General
Full URL
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Requested by
Host: tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
URL: https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
43.174.247.29 , Singapore, ASN139341 (ACE-AS-AP - ACE, SG),
Reverse DNS
Software
edgeone-pages /
Resource Hash
2fac82a5ba16231c9bc88d08f4b597935e908383e57462d43c62f1ee9c628423

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

EO-Cache-Status
Cache Hit
Cache-Control
public,max-age=0,must-revalidate
X-NWS-LOG-UUID
2471316336358761199
Content-Encoding
br
Etag
"4a35f79e4b439cbf2a38a0623546b424"
Age
10
EO-LOG-UUID
2471316336358761199
Accept-Ranges
bytes
Content-Length
5659
Date
Mon, 31 Aug 2026 09:52:41 GMT
Last-Modified
Mon, 31 Aug 2026 09:52:09 GMT
Vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Server
edgeone-pages
Content-Type
text/html
GET
H2
404
faviconV2
t3.gstatic.com/
Redirect Chain
  • https://www.google.com/s2/favicons?domain=example.com&sz=64
  • https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://example.com&size=64
726 B
917 B
34ms
16ms
Image
image/png
2404:6800:4003:c11::69
Google LLC
General
Full URL
https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://example.com&size=64
Requested by
Host: tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev
URL: https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Protocol
H2
Server
2404:6800:4003:c11::69 Singapore, Singapore, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/

Response headers

cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
726
date
Mon, 31 Aug 2026 09:52:42 GMT
x-xss-protection
0
content-type
image/png
server
sffe

Redirect headers

cache-control
public, max-age=1800
location
https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://example.com&size=64
x-content-type-options
nosniff
expires
Mon, 31 Aug 2026 10:22:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
331
date
Mon, 31 Aug 2026 09:52:42 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
sffe
GET
H2
200
/ Show response
www.example.com/ Frame 2161
559 B
473 B
60ms
20ms
Document
text/html
2606:4700:10::ac42:93f3
Cloudflare
General
Full URL
https://www.example.com/
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac42:93f3 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff67a9d764d6a2367a187734e697f6a53217db9a21c101d410a113ca871a299d

Request headers

Referer
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

age
4052
allow
GET, HEAD
cf-cache-status
HIT
cf-ray
a33b24d78e053d9e-SIN
content-encoding
br
content-type
text/html
date
Mon, 31 Aug 2026 09:52:42 GMT
last-modified
Mon, 31 Aug 2026 04:09:32 GMT
server
cloudflare
GET
H2
200
f44bc6a9bb0214239dba6cb2fa2c4db7.ico
274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/images/62828/
5 KB
5 KB
1271ms
191ms
Other
image/vnd.microsoft.icon
2a00:ab00:610:1::1
SELECTEL JSC Sele...
General
Full URL
https://274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/images/62828/f44bc6a9bb0214239dba6cb2fa2c4db7.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:ab00:610:1::1 , Russian Federation, ASN49505 (SELECTEL JSC Selectel, RU),
Reverse DNS
Software
/
Resource Hash
834c9a09a16bfed16441e4f0c6dc2efa15ca3a355ce572d7ce0d5195ace13d6c

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-container-storage-policy-index
1
x-container-storage-policy-name
cold
access-control-expose-headers
Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges
etag
"797a62508d48d80e26fbcfb4a13c42e7"
age
20000
x-timestamp
1682073400.55251
accept-ranges
bytes
access-control-allow-origin
*
x-trans-id
4f7dc747-7e81-4a2b-a41d-95dcb5f5d511
content-length
4628
date
Mon, 31 Aug 2026 04:19:23 GMT
content-type
image/vnd.microsoft.icon
last-modified
Fri, 21 Apr 2023 10:36:41 GMT
GET
H2
200
f44bc6a9bb0214239dba6cb2fa2c4db7.ico
274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/images/62828/
5 KB
0
0ms
0ms
Other
image/vnd.microsoft.icon
2a00:ab00:610:1::1
SELECTEL JSC Sele...
General
Full URL
https://274418.selcdn.ru/cv08300-33250f0d-0664-43fc-9dbf-9d89738d114e/images/62828/f44bc6a9bb0214239dba6cb2fa2c4db7.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:ab00:610:1::1 , Russian Federation, ASN49505 (SELECTEL JSC Selectel, RU),
Reverse DNS
Software
/
Resource Hash
834c9a09a16bfed16441e4f0c6dc2efa15ca3a355ce572d7ce0d5195ace13d6c

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://tragic-copper-2wexnlf5-dpvbo28vqmfh.edgeone.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-container-storage-policy-index
1
x-container-storage-policy-name
cold
access-control-expose-headers
Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, Etag, X-Timestamp, X-Trans-Id, X-Openstack-Request-Id, Content-Length, Accept-Ranges
etag
"797a62508d48d80e26fbcfb4a13c42e7"
age
20000
x-timestamp
1682073400.55251
accept-ranges
bytes
access-control-allow-origin
*
x-trans-id
4f7dc747-7e81-4a2b-a41d-95dcb5f5d511
content-length
4628
date
Mon, 31 Aug 2026 04:19:23 GMT
content-type
image/vnd.microsoft.icon
last-modified
Fri, 21 Apr 2023 10:36:41 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

4 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery object| PageCtx

0 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
security warning URL: about:blank
Message:
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network error URL: https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://example.com&size=64
Message:
Failed to load resource: the server responded with a status of 404 ()