whenupgrade.lovelyplayerset.click

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 6 HTTP transactions. The main IP is 3.144.207.224, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is whenupgrade.lovelyplayerset.click.
TLS certificate: Issued by R3 on February 6th 2024. Valid for: 3 months.

This is the only time whenupgrade.lovelyplayerset.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple Software Update (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3034::6815:f6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.144.207.224 3.144.207.224	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:21e... 2600:9000:21ea:800:3:2be1:2280:21	16509 (AMAZON-02) (AMAZON-02)
6	2

1 2606:4700:3034::6815:f6 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

unglovinginducingmisreform.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.144.207.224 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-144-207-224.us-east-2.compute.amazonaws.com

whenupgrade.lovelyplayerset.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:21ea:800:3:2be1:2280:21 (United States)

ASN16509 (AMAZON-02, US)

d1igqsiuxonr0q.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	cloudfront.net d1igqsiuxonr0q.cloudfront.net	33 KB
1	lovelyplayerset.click whenupgrade.lovelyplayerset.click	5 KB
1	unglovinginducingmisreform.com 1 redirects unglovinginducingmisreform.com	973 B
6	3

	Domain	Requested by
5	d1igqsiuxonr0q.cloudfront.net	whenupgrade.lovelyplayerset.click
1	whenupgrade.lovelyplayerset.click
1	unglovinginducingmisreform.com	1 redirects
6	3

This site contains links to these domains. Also see Links.

Domain
www.spacetabext.com

Subject Issuer	Validity	Valid
whenupgrade.lovelyplayerset.click R3	`2024-02-06` - `2024-05-06`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1=
Frame ID: E3D8D9EEB8729D467B064146345D7AAE
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://unglovinginducingmisreform.com/tlrjk1c71688f742d0cf2b119ff40d6ececf672144dc3?s3=rqcrkhqeymzwuyxdsep7nc HTTP 302
https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCA... Page URL

Page Statistics

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

38 kB
Transfer

52 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.spacetabext.com/privacy-policy.html
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.spacetabext.com/term-of-use.html
Title: Terms Of Service

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://unglovinginducingmisreform.com/tlrjk1c71688f742d0cf2b119ff40d6ececf672144dc3?s3=rqcrkhqeymzwuyxdsep7nc HTTP 302
https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request sets Show response whenupgrade.lovelyplayerset.click/ Redirect Chain http://unglovinginducingmisreform.com/tlrjk1c71688f742d0cf2b119ff40d6ececf672144dc3?s3=rqcrkhqeymzwuyxdsep7nc https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1=	21 KB 5 KB	279ms 49ms	Document text/html	3.144.207.224 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305 Server 3.144.207.224 Columbus, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-144-207-224.us-east-2.compute.amazonaws.com Software nginx / Resource Hash `6c50138038660fc26e39637c18245a7d85458c69c7f1f941615dc7acfa0f6c8c` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 13 Mar 2024 23:40:53 GMT Server nginx Transfer-Encoding chunked Redirect headers Accept-Ch Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Mobile, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64 CF-Cache-Status DYNAMIC CF-RAY 863fdf20d832c440-EWR Connection keep-alive Content-Type text/html; charset=utf-8 Date Wed, 13 Mar 2024 23:40:53 GMT Location https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5kqLrUX%2BCHXgdZhCX3zG1RmbZG29%2BF4AGD6E4q3yyk%2FzIahEzNrge8er7b0%2B2pp7rEUN%2BFTLpmrxLEraF54FfZtNLcUgWdTRe%2F2ShWi5rIE7bgpG6SydcQX78LCq5aj1k2MY3p3jrO6P6m15%2BVPjKIRimIiDoqvc91YwJAo%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked alt-svc h3=":443"; ma=86400
GET H2	200	logo_1.png d1igqsiuxonr0q.cloudfront.net/lps/download_ext/images/	544 B 909 B	143ms 50ms	Image image/png	2600:9000:21ea:800:3:2be1:2280:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1igqsiuxonr0q.cloudfront.net/lps/download_ext/images/logo_1.png Requested by Host: whenupgrade.lovelyplayerset.click URL: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ea:800:3:2be1:2280:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `5edc99996d04888432ff40494a8dd8c2b13f710f321d73ede1c8d29212a8503f` Request headers accept-language en-US,en;q=0.9 Referer https://whenupgrade.lovelyplayerset.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 23:38:32 GMT via 1.1 759533d02225fb7e951ea4dc2b01fd48.cloudfront.net (CloudFront) last-modified Thu, 20 Aug 2020 10:15:05 GMT server AmazonS3 x-amz-cf-pop EWR50-C1 age 142 etag "b93f3be846e7bc39a4ad235429a1f451" x-amz-meta-origin-date-iso8601 2020-08-20T10:04:54.000Z x-cache Hit from cloudfront content-type image/png accept-ranges bytes content-length 544 x-amz-cf-id o4WrR4YuV4Go6NnU0I7SA6RVxY-r7AsSS4P5G5Ci-1QTpEHbhXGbpA==
GET H2	200	arrow__blue.png d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/	2 KB 3 KB	141ms 48ms	Image image/png	2600:9000:21ea:800:3:2be1:2280:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/arrow__blue.png Requested by Host: whenupgrade.lovelyplayerset.click URL: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ea:800:3:2be1:2280:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a` Request headers accept-language en-US,en;q=0.9 Referer https://whenupgrade.lovelyplayerset.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 15:29:45 GMT via 1.1 759533d02225fb7e951ea4dc2b01fd48.cloudfront.net (CloudFront) last-modified Wed, 30 May 2018 18:11:30 GMT server AmazonS3 x-amz-cf-pop EWR50-C1 age 29469 etag "6d26faedbdd557f7dcd86e9060de347f" x-cache Hit from cloudfront content-type image/png accept-ranges bytes content-length 2266 x-amz-cf-id fNRAhoWTuJgc1tUjbFN5-yYNGncqdO5YYXr_ONMvXhJAbNOgJkLgHA==
GET H2	200	pattern__safari1.jpg d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/	25 KB 25 KB	121ms 30ms	Image image/jpeg	2600:9000:21ea:800:3:2be1:2280:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/pattern__safari1.jpg Requested by Host: whenupgrade.lovelyplayerset.click URL: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ea:800:3:2be1:2280:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe` Request headers accept-language en-US,en;q=0.9 Referer https://whenupgrade.lovelyplayerset.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 15:29:45 GMT via 1.1 759533d02225fb7e951ea4dc2b01fd48.cloudfront.net (CloudFront) last-modified Wed, 30 May 2018 18:11:28 GMT server AmazonS3 x-amz-cf-pop EWR50-C1 age 29469 etag "918dfef192de7b99284e969e75d6cc29" x-cache Hit from cloudfront content-type image/jpeg accept-ranges bytes content-length 25293 x-amz-cf-id JEXQT6OYHDd4EqLuHAw45y6at5z__0kWGxRKKzoo38i_-rDhSGYruw==
GET H2	200	pattern__safari-arrow.png d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/	3 KB 4 KB	117ms 26ms	Image image/png	2600:9000:21ea:800:3:2be1:2280:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/pattern__safari-arrow.png Requested by Host: whenupgrade.lovelyplayerset.click URL: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ea:800:3:2be1:2280:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12` Request headers accept-language en-US,en;q=0.9 Referer https://whenupgrade.lovelyplayerset.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 22:46:54 GMT via 1.1 759533d02225fb7e951ea4dc2b01fd48.cloudfront.net (CloudFront) last-modified Wed, 30 May 2018 18:10:05 GMT server AmazonS3 x-amz-cf-pop EWR50-C1 age 3240 etag "496171f7f5272b0c3b8ae1d526110caf" x-cache Hit from cloudfront content-type image/png accept-ranges bytes content-length 3478 x-amz-cf-id eUtkdUFnc-dhn1W3f0TASwOzPw16D8NcMrZZ9aTaYyLC_oxEQXObMg==
GET H2	200	download_arrow.png d1igqsiuxonr0q.cloudfront.net/lps/download_ext/images/	173 B 540 B	116ms 50ms	Image image/png	2600:9000:21ea:800:3:2be1:2280:21 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://d1igqsiuxonr0q.cloudfront.net/lps/download_ext/images/download_arrow.png Requested by Host: whenupgrade.lovelyplayerset.click URL: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ea:800:3:2be1:2280:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b` Request headers accept-language en-US,en;q=0.9 Referer https://whenupgrade.lovelyplayerset.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 14:25:58 GMT via 1.1 759533d02225fb7e951ea4dc2b01fd48.cloudfront.net (CloudFront) last-modified Thu, 20 Aug 2020 10:15:02 GMT server AmazonS3 x-amz-cf-pop EWR50-C1 age 33296 etag "551bb1d3f364bc5fd05bf6e99b16bfc0" x-amz-meta-origin-date-iso8601 2020-08-20T10:08:40.000Z x-cache Hit from cloudfront content-type image/png accept-ranges bytes content-length 173 x-amz-cf-id P306uJcMrvvjIGo69fvPz7v31vh_8Vu99Lo9QSJoIOXUF24Er0BBGg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple Software Update (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getWindowLayout

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
whenupgrade.lovelyplayerset.click/	1970-01-20 19:06:14	Name: channel Value: m1_ChextSTname_allg2
whenupgrade.lovelyplayerset.click/	1970-01-20 19:06:14	Name: dist_id Value: 8898
whenupgrade.lovelyplayerset.click/	1970-01-20 19:06:14	Name: lp_id Value: 3453

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d1igqsiuxonr0q.cloudfront.net
unglovinginducingmisreform.com
whenupgrade.lovelyplayerset.click
2600:9000:21ea:800:3:2be1:2280:21
2606:4700:3034::6815:f6
3.144.207.224
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a
5edc99996d04888432ff40494a8dd8c2b13f710f321d73ede1c8d29212a8503f
6c50138038660fc26e39637c18245a7d85458c69c7f1f941615dc7acfa0f6c8c
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12
8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b

whenupgrade.lovelyplayerset.click Open in urlscan Pro 3.144.207.224 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

6 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

38 kBTransfer

52 kBSize

3 Cookies

2 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

3 Cookies

Indicators

whenupgrade.lovelyplayerset.click Open in urlscan Pro
3.144.207.224 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

38 kB
Transfer

52 kB
Size

3
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!