0rnged06131.netlify.app Open in urlscan Pro
2a03:b0c0:3:e0::1b:1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 0rnged06131.netlify.app/	23 KB 3 KB	188ms 149ms	Document text/html	2a03:b0c0:3:e0::1b:1 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://0rnged06131.netlify.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a03:b0c0:3:e0::1b:1 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Netlify / Resource Hash 2944af968bd625170d1b65fab54d8fd1a5483f17de193bc894b122f07e134b10 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers :method GET :authority 0rnged06131.netlify.app :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control public, max-age=0, must-revalidate content-type text/html; charset=UTF-8 date Mon, 15 Feb 2021 22:43:36 GMT etag "21270fa52710d46780596f8677ad0cf9-ssl-df" strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding br content-length 2872 age 0 server Netlify vary Accept-Encoding x-nf-request-id ce5129dc-58c7-429a-809f-519286685464-33630511
GET H/1.1	401 Unauthorized	bundle.min.css cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-1.4.0/css/	0 0	233ms 139ms	Stylesheet text/html	2a01:c9c0:b3:3000::137 WANADOOPORTAILS-A...
General Check archive.org Show headers Download Go to Full URL https://cdn.woopic.com/c15d9d8fc98141b084d96f795046449b/auth-1.4.0/css/bundle.min.css Requested by Host: 0rnged06131.netlify.app URL: https://0rnged06131.netlify.app/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a01:c9c0:b3:3000::137 , France, ASN24600 (WANADOOPORTAILS-AS Wanadoo Portails/Direction technique, FR), Reverse DNS Software / Resource Hash Request headers Referer https://0rnged06131.netlify.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	ban.png fforces.com/public/imghost/images/	28 KB 29 KB	130ms 43ms	Image image/png	213.186.33.2 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://fforces.com/public/imghost/images/ban.png Requested by Host: 0rnged06131.netlify.app URL: https://0rnged06131.netlify.app/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 213.186.33.2 , France, ASN16276 (OVH, FR), Reverse DNS cluster002.ovh.net Software Apache / Resource Hash 1ca3486e7d9ea0c22994e8447e7646957ea37386447ddf9762701229c13a9bd4 Request headers Referer https://0rnged06131.netlify.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 15 Feb 2021 22:43:37 GMT last-modified Tue, 28 Aug 2018 21:01:18 GMT server Apache content-type image/png cache-control max-age=900 accept-ranges bytes content-length 29172 expires Mon, 15 Feb 2021 22:58:37 GMT
GET H2	200	logo.png fforces.com/public/imghost/images/	3 KB 3 KB	131ms 44ms	Image image/png	213.186.33.2 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://fforces.com/public/imghost/images/logo.png Requested by Host: 0rnged06131.netlify.app URL: https://0rnged06131.netlify.app/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 213.186.33.2 , France, ASN16276 (OVH, FR), Reverse DNS cluster002.ovh.net Software Apache / Resource Hash b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472 Request headers Referer https://0rnged06131.netlify.app/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 15 Feb 2021 22:43:37 GMT last-modified Fri, 27 Jul 2018 13:20:05 GMT server Apache content-type image/png cache-control max-age=900 accept-ranges bytes content-length 3354 expires Mon, 15 Feb 2021 22:58:37 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Orange (Telecommunication)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| m string| d

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0rnged06131.netlify.app
cdn.woopic.com
fforces.com
213.186.33.2
2a01:c9c0:b3:3000::137
2a03:b0c0:3:e0::1b:1
1ca3486e7d9ea0c22994e8447e7646957ea37386447ddf9762701229c13a9bd4
2944af968bd625170d1b65fab54d8fd1a5483f17de193bc894b122f07e134b10
b36e8ca10880ffc8a3903cd991589fbbe8aa75cbff6315f475be1ed0e9bda472