![](/screenshots/40cabe2e-8af0-477f-962c-62277cf7c191.png)
whenupgrade.lovelyplayerset.click
Open in
urlscan Pro
3.144.207.224
Malicious Activity!
Public Scan
Effective URL: https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=...
Submission: On March 13 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on February 6th 2024. Valid for: 3 months.
This is the only time whenupgrade.lovelyplayerset.click was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Apple Software Update (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3034::6815:f6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 3.144.207.224 3.144.207.224 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 2600:9000:21e... 2600:9000:21ea:800:3:2be1:2280:21 | 16509 (AMAZON-02) (AMAZON-02) | |
6 | 2 |
ASN13335 (CLOUDFLARENET, US)
unglovinginducingmisreform.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-144-207-224.us-east-2.compute.amazonaws.com
whenupgrade.lovelyplayerset.click |
ASN16509 (AMAZON-02, US)
d1igqsiuxonr0q.cloudfront.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
cloudfront.net
d1igqsiuxonr0q.cloudfront.net |
33 KB |
1 |
lovelyplayerset.click
whenupgrade.lovelyplayerset.click |
5 KB |
1 |
unglovinginducingmisreform.com
1 redirects
unglovinginducingmisreform.com |
973 B |
6 | 3 |
Domain | Requested by | |
---|---|---|
5 | d1igqsiuxonr0q.cloudfront.net |
whenupgrade.lovelyplayerset.click
|
1 | whenupgrade.lovelyplayerset.click | |
1 | unglovinginducingmisreform.com | 1 redirects |
6 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.spacetabext.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
whenupgrade.lovelyplayerset.click R3 |
2024-02-06 - 2024-05-06 |
3 months | crt.sh |
*.cloudfront.net Amazon RSA 2048 M01 |
2023-10-10 - 2024-09-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1=
Frame ID: E3D8D9EEB8729D467B064146345D7AAE
Requests: 6 HTTP requests in this frame
Screenshot
![](/screenshots/40cabe2e-8af0-477f-962c-62277cf7c191.png)
Page URL History Show full URLs
-
http://unglovinginducingmisreform.com/tlrjk1c71688f742d0cf2b119ff40d6ececf672144dc3?s3=rqcrkhqeymzwuyxdsep7nc
HTTP 302
https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCA... Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms Of Service
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://unglovinginducingmisreform.com/tlrjk1c71688f742d0cf2b119ff40d6ececf672144dc3?s3=rqcrkhqeymzwuyxdsep7nc
HTTP 302
https://whenupgrade.lovelyplayerset.click/sets?news=rmBi3CEmAstkaQtBH4N612-vmXtkVbpC7j9iCDi2NPw.&cid=AIU58mW8WAUA9GYCAFVTFwASAAAAAACX&sid=350396&qs1= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
sets
whenupgrade.lovelyplayerset.click/ Redirect Chain
|
21 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_1.png
d1igqsiuxonr0q.cloudfront.net/lps/download_ext/images/ |
544 B 909 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow__blue.png
d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pattern__safari1.jpg
d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/ |
25 KB 25 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pattern__safari-arrow.png
d1igqsiuxonr0q.cloudfront.net/lps/flash_mac/images/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
download_arrow.png
d1igqsiuxonr0q.cloudfront.net/lps/download_ext/images/ |
173 B 540 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Apple Software Update (Online)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| getWindowLayout3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
whenupgrade.lovelyplayerset.click/ | Name: channel Value: m1_ChextSTname_allg2 |
|
whenupgrade.lovelyplayerset.click/ | Name: dist_id Value: 8898 |
|
whenupgrade.lovelyplayerset.click/ | Name: lp_id Value: 3453 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d1igqsiuxonr0q.cloudfront.net
unglovinginducingmisreform.com
whenupgrade.lovelyplayerset.click
2600:9000:21ea:800:3:2be1:2280:21
2606:4700:3034::6815:f6
3.144.207.224
5bbee510c3b5965532d53185cadd47753740b6445f2b9bded3849424fcd2661a
5edc99996d04888432ff40494a8dd8c2b13f710f321d73ede1c8d29212a8503f
6c50138038660fc26e39637c18245a7d85458c69c7f1f941615dc7acfa0f6c8c
7b4d70d5fb64a31f115e1e853b7272e1415ffec2234e78e00847350c23d607fe
7c48ecdfda540af22ecb4d9638c8c0082e401cc4b45aa2df46c976ec80d38c12
8e32d99e816a42958b9473f470a2600963602981007576d85220044e6137965b