![](/screenshots/24089eea-b82d-4eed-8851-af2e4bd8a5bc.png)
stub.linktothesafeplayer.click
Open in
urlscan Pro
3.144.207.224
Malicious Activity!
Public Scan
Effective URL: https://stub.linktothesafeplayer.click/kruy?fhst=2r2EPjwMddYzkJcZL0vmUVYvwuG-44bhCpZPyU9wjgc.&&cid=zrca750b42cb0411eeba4e0a7f1e64b7db19...
Submission: On February 14 via api from SG — Scanned from SG
Summary
TLS certificate: Issued by R3 on January 27th 2024. Valid for: 3 months.
This is the only time stub.linktothesafeplayer.click was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Apple Software Update (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 46.8.8.100 46.8.8.100 | 60592 (GRANSY Gr...) (GRANSY Gransy s.r.o. gransy.com) | |
2 | 44.210.224.67 44.210.224.67 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 2 | 137.74.180.226 137.74.180.226 | 16276 (OVH) (OVH) | |
1 | 3.144.207.224 3.144.207.224 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 172.253.118.95 172.253.118.95 | 15169 (GOOGLE) (GOOGLE) | |
7 | 13.33.100.120 13.33.100.120 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 4 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-210-224-67.compute-1.amazonaws.com
junon-amn.info |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-144-207-224.us-east-2.compute.amazonaws.com
stub.linktothesafeplayer.click |
ASN15169 (GOOGLE, US)
PTR: sl-in-f95.1e100.net
fonts.googleapis.com |
ASN16509 (AMAZON-02, US)
PTR: server-13-33-100-120.sin2.r.cloudfront.net
dlmn5z55ga5wj.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
cloudfront.net
dlmn5z55ga5wj.cloudfront.net |
2 MB |
2 |
admedit.net
2 redirects
kr1.admedit.net |
757 B |
2 |
junon-amn.info
junon-amn.info — Cisco Umbrella Rank: 314554 |
3 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 48 |
1017 B |
1 |
linktothesafeplayer.click
stub.linktothesafeplayer.click |
4 KB |
1 |
youtihe.com
1 redirects
youtihe.com |
300 B |
11 | 6 |
Domain | Requested by | |
---|---|---|
7 | dlmn5z55ga5wj.cloudfront.net |
stub.linktothesafeplayer.click
|
2 | kr1.admedit.net | 2 redirects |
2 | junon-amn.info |
junon-amn.info
|
1 | fonts.googleapis.com |
stub.linktothesafeplayer.click
|
1 | stub.linktothesafeplayer.click |
junon-amn.info
|
1 | youtihe.com | 1 redirects |
11 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
junon-amn.info Amazon RSA 2048 M02 |
2024-01-23 - 2025-02-20 |
a year | crt.sh |
stub.linktothesafeplayer.click R3 |
2024-01-27 - 2024-04-26 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-01-09 - 2024-04-02 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://stub.linktothesafeplayer.click/kruy?fhst=2r2EPjwMddYzkJcZL0vmUVYvwuG-44bhCpZPyU9wjgc.&&cid=zrca750b42cb0411eeba4e0a7f1e64b7db19ba53e49ad24e0eb509cc4c5451efe207995090354578fa0a&sid=alpha-key-1o94lqm626
Frame ID: 44B930EE9491759CD9F36AED53649322
Requests: 11 HTTP requests in this frame
Screenshot
![](/screenshots/24089eea-b82d-4eed-8851-af2e4bd8a5bc.png)
Page Title
SpaceTabPage URL History Show full URLs
-
http://youtihe.com/
HTTP 301
https://junon-amn.info/zclkvisitor/ca750b42-cb04-11ee-ba4e-0a7f1e64b7db/b71e37a0-18cb-11ea-9f38-0a1... Page URL
- https://junon-amn.info/zclkredirect?visitid=ca750b42-cb04-11ee-ba4e-0a7f1e64b7db&type=js&browserWid... Page URL
-
https://kr1.admedit.net/advertise/?adown=831&cmp=3207&ctrack=zrca750b42cb0411eeba4e0a7f1e64b7db19ba5...
HTTP 302
https://kr1.admedit.net/advertise/refine.php?adown=831&ptrack=alpha-key-1o94lqm626&ctrack=zrca750b42... HTTP 302
https://stub.linktothesafeplayer.click/kruy?fhst=2r2EPjwMddYzkJcZL0vmUVYvwuG-44bhCpZPyU9wjgc.&&cid=zrca750b42cb0411... Page URL
Detected technologies
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://youtihe.com/
HTTP 301
https://junon-amn.info/zclkvisitor/ca750b42-cb04-11ee-ba4e-0a7f1e64b7db/b71e37a0-18cb-11ea-9f38-0a157bfa6bfc?campaignid=9741d9b0-c03c-11ee-a2d9-0a4ababc2193 Page URL
- https://junon-amn.info/zclkredirect?visitid=ca750b42-cb04-11ee-ba4e-0a7f1e64b7db&type=js&browserWidth=1600&browserHeight=1200&iframeDetected=false&webdriverDetected%20%20%20%20%20%20%20%20=false&usingEventListener=true Page URL
-
https://kr1.admedit.net/advertise/?adown=831&cmp=3207&ctrack=zrca750b42cb0411eeba4e0a7f1e64b7db19ba53e49ad24e0eb509cc4c5451efe207995090354578fa0a&ptrack=alpha-key-1o94lqm626
HTTP 302
https://kr1.admedit.net/advertise/refine.php?adown=831&ptrack=alpha-key-1o94lqm626&ctrack=zrca750b42cb0411eeba4e0a7f1e64b7db19ba53e49ad24e0eb509cc4c5451efe207995090354578fa0a&cmp=3207&t=1707893195&rh=7&avs=avs3&utm_src=7&sids=3 HTTP 302
https://stub.linktothesafeplayer.click/kruy?fhst=2r2EPjwMddYzkJcZL0vmUVYvwuG-44bhCpZPyU9wjgc.&&cid=zrca750b42cb0411eeba4e0a7f1e64b7db19ba53e49ad24e0eb509cc4c5451efe207995090354578fa0a&sid=alpha-key-1o94lqm626 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://youtihe.com/ HTTP 301
- https://junon-amn.info/zclkvisitor/ca750b42-cb04-11ee-ba4e-0a7f1e64b7db/b71e37a0-18cb-11ea-9f38-0a157bfa6bfc?campaignid=9741d9b0-c03c-11ee-a2d9-0a4ababc2193
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
b71e37a0-18cb-11ea-9f38-0a157bfa6bfc
junon-amn.info/zclkvisitor/ca750b42-cb04-11ee-ba4e-0a7f1e64b7db/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zclkredirect
junon-amn.info/ |
528 B 1000 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
kruy
stub.linktothesafeplayer.click/ Redirect Chain
|
18 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
2 KB 1017 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
dlmn5z55ga5wj.cloudfront.net/lps/spacetab/ |
23 KB 23 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
store.png
dlmn5z55ga5wj.cloudfront.net/lps/spacetab/ |
10 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow__blue.png
dlmn5z55ga5wj.cloudfront.net/lps/flash_mac/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pattern__safari1.jpg
dlmn5z55ga5wj.cloudfront.net/lps/flash_mac/images/ |
25 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pattern__safari-arrow.png
dlmn5z55ga5wj.cloudfront.net/lps/flash_mac/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
back.jpg
dlmn5z55ga5wj.cloudfront.net/lps/spacetab/ |
2 MB 2 MB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
download_arrow.png
dlmn5z55ga5wj.cloudfront.net/lps/download_ext/images/ |
173 B 541 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Apple Software Update (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| hide_download function| showStep function| fillProgressBar function| addEvent3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
stub.linktothesafeplayer.click/ | Name: channel Value: kra_ChextSpaceT_allg |
|
stub.linktothesafeplayer.click/ | Name: dist_id Value: 8893 |
|
stub.linktothesafeplayer.click/ | Name: lp_id Value: 3447 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' |
X-Content-Security-Policy | default-src 'self'; script-src 'self' 'unsafe-inline' |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
dlmn5z55ga5wj.cloudfront.net
fonts.googleapis.com
junon-amn.info
kr1.admedit.net
stub.linktothesafeplayer.click
youtihe.com
13.33.100.120
137.74.180.226
172.253.118.95
3.144.207.224
44.210.224.67
46.8.8.100
56cf391cd84bd42a8ff3065b6b0009242b99f6ad9fcd849b0f2bd71583a32e60
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a
6014f37d6930e6f82b8f98e19e6155e81e6ae341c1dd6bd3283b5886c2383b31
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12
838e680ca964a26c94665951577f3f0902ef54de2ee063d3465f22945dc44afa
8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b
98ac999ce8b3550b3ced5ce7692cd90b3938675cf2a5126617999ea6fda1376c
aa5f0a09e04cc268d773bc13764aa13b3eacfd04249033a84a037916e6df27ea
bcd760955c9734b3abfc4ef92006ad01f7cc1e373ef6b280080f7f8bbaecfe38